Mes Messa sage ge Aut uthe hent ntica ication tion Cod Codes - PowerPoint PPT Presentation

Data and Network Security Lab Sharif University of Technology Department of Computer Engineering Mes Messa sage ge Aut uthe hent ntica ication tion Cod Codes es Instructor: Ahmad Boorghany Most of the slides are obtained from Bellare and Rogaway’s “Introduction to Modern Cryptography” course. Sharif University Introduction to Modern Cryptography Spring 2015 1 / 80

Outline  Message Authentication  Message Authentication Code (MAC)  PRFs as good MACs  Constructing MACs  Birthday Attack and Security Bounds  HMAC  Universal Hashing and Message Authentication Sharif University Introduction to Modern Cryptography Spring 2015 2 / 80

Message Authentication Sharif University Introduction to Modern Cryptography Spring 2015 3 / 80

Integrity and authenticity Sharif University Introduction to Modern Cryptography Spring 2015 4 / 80

Integrity and authenticity example Sharif University Introduction to Modern Cryptography Spring 2015 5 / 80

Medical databases Sharif University Introduction to Modern Cryptography Spring 2015 6 / 80

Does privacy provide authenticity? Sharif University Introduction to Modern Cryptography Spring 2015 7 / 80

Counterexample: OTP Sharif University Introduction to Modern Cryptography Spring 2015 8 / 80

Adding redundacy Sharif University Introduction to Modern Cryptography Spring 2015 9 / 80

What went wrong? Sharif University Introduction to Modern Cryptography Spring 2015 10 / 80

Message Authentication Code (MAC) Sharif University Introduction to Modern Cryptography Spring 2015 11 / 80

Message authentication codes Sharif University Introduction to Modern Cryptography Spring 2015 12 / 80

Example Sharif University Introduction to Modern Cryptography Spring 2015 13 / 80

Security: What the adversary gets Sharif University Introduction to Modern Cryptography Spring 2015 14 / 80

Security: Key-recovery Sharif University Introduction to Modern Cryptography Spring 2015 15 / 80

Security: Forgery Sharif University Introduction to Modern Cryptography Spring 2015 16 / 80

uf-cma adversaries Sharif University Introduction to Modern Cryptography Spring 2015 17 / 80

uf-cma adversaries Sharif University Introduction to Modern Cryptography Spring 2015 18 / 80

UF-CMA Sharif University Introduction to Modern Cryptography Spring 2015 19 / 80

Definition: UF-CMA Sharif University Introduction to Modern Cryptography Spring 2015 20 / 80

The measure of success Sharif University Introduction to Modern Cryptography Spring 2015 21 / 80

MAC security Sharif University Introduction to Modern Cryptography Spring 2015 22 / 80

Tag lengths Sharif University Introduction to Modern Cryptography Spring 2015 23 / 80

Example 1 Sharif University Introduction to Modern Cryptography Spring 2015 24 / 80

Example 1 Sharif University Introduction to Modern Cryptography Spring 2015 25 / 80

Example 1 Sharif University Introduction to Modern Cryptography Spring 2015 26 / 80

Example 1 Sharif University Introduction to Modern Cryptography Spring 2015 27 / 80

Example 1 Sharif University Introduction to Modern Cryptography Spring 2015 28 / 80

Example 1 Sharif University Introduction to Modern Cryptography Spring 2015 29 / 80

Example 2 Sharif University Introduction to Modern Cryptography Spring 2015 30 / 80

Example 2 Sharif University Introduction to Modern Cryptography Spring 2015 31 / 80

Example 2 Sharif University Introduction to Modern Cryptography Spring 2015 32 / 80

Attack on Example 2 Sharif University Introduction to Modern Cryptography Spring 2015 33 / 80

PRFs as good MACs Sharif University Introduction to Modern Cryptography Spring 2015 34 / 80

Any PRF is a MAC Sharif University Introduction to Modern Cryptography Spring 2015 35 / 80

Intuition for why PRFs are good MACs Sharif University Introduction to Modern Cryptography Spring 2015 36 / 80

Random functions are good MACs Sharif University Introduction to Modern Cryptography Spring 2015 37 / 80

Random functions are good MACs Sharif University Introduction to Modern Cryptography Spring 2015 38 / 80

PRFs are nearly as good MACs as random functions Sharif University Introduction to Modern Cryptography Spring 2015 39 / 80

PRFs are good MACs Sharif University Introduction to Modern Cryptography Spring 2015 40 / 80

Games for proof Sharif University Introduction to Modern Cryptography Spring 2015 41 / 80

Adversary B Sharif University Introduction to Modern Cryptography Spring 2015 42 / 80

Analysis Sharif University Introduction to Modern Cryptography Spring 2015 43 / 80

Proof of Claim Sharif University Introduction to Modern Cryptography Spring 2015 44 / 80

Proof of Claim Sharif University Introduction to Modern Cryptography Spring 2015 45 / 80

Proof of Claim Sharif University Introduction to Modern Cryptography Spring 2015 46 / 80

Constructing MACs Sharif University Introduction to Modern Cryptography Spring 2015 47 / 80

Basic CBC MAC Sharif University Introduction to Modern Cryptography Spring 2015 48 / 80

Splicing attack on basic CBC MAC Sharif University Introduction to Modern Cryptography Spring 2015 49 / 80

Preventing the splicing attack Sharif University Introduction to Modern Cryptography Spring 2015 50 / 80

ECBC MAC Sharif University Introduction to Modern Cryptography Spring 2015 51 / 80

Birthday Attack and Security Bounds Sharif University Introduction to Modern Cryptography Spring 2015 52 / 80

Birthday attacks on MACs Sharif University Introduction to Modern Cryptography Spring 2015 53 / 80

The birthday attack Sharif University Introduction to Modern Cryptography Spring 2015 54 / 80

Internal collisions Sharif University Introduction to Modern Cryptography Spring 2015 55 / 80

Exploiting internal collisions to forge Sharif University Introduction to Modern Cryptography Spring 2015 56 / 80

Exploiting internal collisions to forge Sharif University Introduction to Modern Cryptography Spring 2015 57 / 80

Finding internal collisions Sharif University Introduction to Modern Cryptography Spring 2015 58 / 80

Birthday attack on 3-restricted basic CBC MAC T Sharif University Introduction to Modern Cryptography Spring 2015 59 / 80

Truncation Sharif University Introduction to Modern Cryptography Spring 2015 60 / 80

Security of basic CBC MAC Sharif University Introduction to Modern Cryptography Spring 2015 61 / 80

Security of basic CBC MAC Sharif University Introduction to Modern Cryptography Spring 2015 62 / 80

Security of ECBC Sharif University Introduction to Modern Cryptography Spring 2015 63 / 80

Security of ECBC Sharif University Introduction to Modern Cryptography Spring 2015 64 / 80

Non-full messages Sharif University Introduction to Modern Cryptography Spring 2015 65 / 80

Non-full messages Sharif University Introduction to Modern Cryptography Spring 2015 66 / 80

HMAC Sharif University Introduction to Modern Cryptography Spring 2015 67 / 80

MACing with hash functions Sharif University Introduction to Modern Cryptography Spring 2015 68 / 80

Extension attack Sharif University Introduction to Modern Cryptography Spring 2015 69 / 80

Extension attack Sharif University Introduction to Modern Cryptography Spring 2015 70 / 80

HMAC [BCK96] Sharif University Introduction to Modern Cryptography Spring 2015 71 / 80

HMAC Sharif University Introduction to Modern Cryptography Spring 2015 72 / 80

HMAC Security Sharif University Introduction to Modern Cryptography Spring 2015 73 / 80

Universal Hashing and Message Authentication Sharif University Introduction to Modern Cryptography Spring 2015 74 / 80

Paradigms for MACing Sharif University Introduction to Modern Cryptography Spring 2015 75 / 80

AU Families Sharif University Introduction to Modern Cryptography Spring 2015 76 / 80

NH [BHKKR] Sharif University Introduction to Modern Cryptography Spring 2015 77 / 80

From AU to MAC Sharif University Introduction to Modern Cryptography Spring 2015 78 / 80

Performance Sharif University Introduction to Modern Cryptography Spring 2015 79 / 80

Questions? Sharif University Introduction to Modern Cryptography Spring 2015 80 / 80