Message authentication and cryptographic hashing 2MMC10 Cryptology - PowerPoint PPT Presentation

Message authentication and cryptographic hashing 2MMC10 Cryptology Andreas H¨ ulsing September 20, 2018 A. H¨ ulsing 2MMC10 Cryptology 1 / 12

Message authentication Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! ? Encryption ⇒ Authenticity / integrity? PRG-ENC , PRF-ENC , ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc. A. H¨ ulsing 2MMC10 Cryptology 2 / 12

Message authentication Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! ? Encryption ⇒ Authenticity / integrity? PRG-ENC , PRF-ENC , ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc. A. H¨ ulsing 2MMC10 Cryptology 2 / 12

Message authentication Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! ? Encryption ⇒ Authenticity / integrity? PRG-ENC , PRF-ENC , ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc. A. H¨ ulsing 2MMC10 Cryptology 2 / 12

Message authentication Sometimes we want more than secrecy! Acknowledgement of receipt, social communication, source of executable, . . . We need integrity and authenticity! ? Encryption ⇒ Authenticity / integrity? PRG-ENC , PRF-ENC , ... any stream cipher allows controlled bit-flips. If format is known this may be disastrous Block ciphers make similar attacks harder but no guarantees. ECB-mode allows to switch order of blocks, repeat blocks, etc. A. H¨ ulsing 2MMC10 Cryptology 2 / 12

Message authentication codes (MAC) Definition (message authentication code) A message authentication code or MAC is a tuple of probabilistic polynomial-time algorithms MAC = ( Gen , Mac , Vrfy ) over a message space M , fulfilling the following: 1 Upon input 1 n , the algorithm Gen outputs a key k . The set of possible outputs of Gen is called the key space K . 2 The algorithm Mac receives as input a key k ∈ K and a message m ∈ M , and outputs a tag t ∈ T . The set of possible outputs of Mac is called tag space T . 3 The algorithm Vrfy receives as input a key k ∈ K , message m ∈ M , and tag t ∈ T , and outputs a bit b ∈ { 0 , 1 } . 4 Correctness: For every n , every k ← − Gen (1 n ), and every m ∈ M it holds that Vrfy k ( m , Mac k ( m )) = 1 . A. H¨ ulsing 2MMC10 Cryptology 3 / 12

Existential unforgeability under (adaptive) chosen message attacks (EU-CMA) -Experiment Experiment ( Exp EU − CMA ( n )) A , MAC 1 k ← Gen (1 n ) 2 ( m , t ) ← A Mac k ( · ) (1 n ) . Let { m i } q 1 denote A ’s queries to Mac k 3 if ( Vrfy k ( m , t ) := 1 , and m �∈ { m i } q 1 ) return 1 4 else return 0. A. H¨ ulsing 2MMC10 Cryptology 4 / 12

Existential unforgeability under (adaptive) chosen message attacks (EU-CMA) -Definition Definition (EU-CMA) A message authentication code MAC = ( Gen , Mac , Vrfy ) over a message space M is existentially unforgeable under an adaptive chosen-message attack, or just secure, if for all probabilistic polynomial-time adversaries A , there exists a negligible function negl such that: � � Exp EU − CMA Pr ( n ) = 1 ≤ negl ( n ) A , MAC A. H¨ ulsing 2MMC10 Cryptology 5 / 12

Existential unforgeability under (adaptive) chosen message attacks (EU-CMA) -Definition Definition (EU-CMA) A message authentication code MAC = ( Gen , Mac , Vrfy ) over a message space M is ( t , ε ) existentially unforgeable under an adaptive chosen-message attack, if for all t -time adversaries A � � Exp EU − CMA Pr ( n ) = 1 ≤ ε A , MAC A. H¨ ulsing 2MMC10 Cryptology 6 / 12

Remarks There exists a constant time attack with success probability 1 / |T | against every MAC ⇒ Tags must not be too short MAC’s do not prevent replay attacks! Replay attacks have to be handled on protocol level (e.g., using sequence numbers). A. H¨ ulsing 2MMC10 Cryptology 7 / 12

Remarks There exists a constant time attack with success probability 1 / |T | against every MAC ⇒ Tags must not be too short MAC’s do not prevent replay attacks! Replay attacks have to be handled on protocol level (e.g., using sequence numbers). A. H¨ ulsing 2MMC10 Cryptology 7 / 12

PRF = MAC Theorem A ( t , ε ) -secure PRF F leads a ( t , ε ) -secure MAC with Gen (1 n ) returns k ← R { 0 , 1 } n . Mac k ( m ) returns t := F k ( m ) . Vrfy k ( m , t ) returns 1 if t = F k ( m ) , and 0 otherwise. Proof see board. A. H¨ ulsing 2MMC10 Cryptology 8 / 12

CBC-MAC Construction Let F be an efficient, length-preserving keyed function over { 0 , 1 } n . CBC-MAC has message space M = ( { 0 , 1 } ℓ n ) . The algorithms are as follows: Gen (1 n ) returns k ← R { 0 , 1 } n . Mac k ( m ) upon input key k ∈ { 0 , 1 } n and a message m of length ℓ n, do the following: 1 Denote m = m 1 , . . . , m ℓ where each m i is of length n, and set t 0 = 0 n . 2 For i = 1 to ℓ , set t i ← F k ( t i − 1 ⊕ m i ) . 3 Output t ℓ . Vrfy k ( m , t ) returns 1 if t = Mac k ( m ) , and 0 otherwise. A. H¨ ulsing 2MMC10 Cryptology 9 / 12

Variable message length CBC-MAC CBC-MAC is not secure for variable length messages Solutions for variable ℓ : Derived key: Compute k ′ = F k ( ℓ ) and use k ′ to compute t = Mac k ′ ( m ) Prepend length: Compute t = Mac k ( ℓ � m ). Encrypted tag: Use two keys k 1 , k 2 ∈ { 0 , 1 } n , compute t ′ = Mac k 1 ( m ) and output t = F k 2 ( t ′ ). We can generate k 1 , k 2 from a single key using F as a length-doubling PRG ( < k 1 , k 2 > = < F k (0) , F k (1) > ) A. H¨ ulsing 2MMC10 Cryptology 10 / 12

Variable message length CBC-MAC CBC-MAC is not secure for variable length messages Solutions for variable ℓ : Derived key: Compute k ′ = F k ( ℓ ) and use k ′ to compute t = Mac k ′ ( m ) Prepend length: Compute t = Mac k ( ℓ � m ). Encrypted tag: Use two keys k 1 , k 2 ∈ { 0 , 1 } n , compute t ′ = Mac k 1 ( m ) and output t = F k 2 ( t ′ ). We can generate k 1 , k 2 from a single key using F as a length-doubling PRG ( < k 1 , k 2 > = < F k (0) , F k (1) > ) A. H¨ ulsing 2MMC10 Cryptology 10 / 12

Padding What if the message length is not a multiple of the block length: | m | � = x · n ? Solution: Padding Expand message to match multiple of block length. Usually injective function Pad : { 0 , 1 } ∗ → ( { 0 , 1 } n ) ∗ . E.g., m → m � 10 ∗ . Properties depend on cryptographic application: Encryption - invertible MAC - injective Often used for additional purposes: Randomization, or encoding message length. A. H¨ ulsing 2MMC10 Cryptology 11 / 12

Padding What if the message length is not a multiple of the block length: | m | � = x · n ? Solution: Padding Expand message to match multiple of block length. Usually injective function Pad : { 0 , 1 } ∗ → ( { 0 , 1 } n ) ∗ . E.g., m → m � 10 ∗ . Properties depend on cryptographic application: Encryption - invertible MAC - injective Often used for additional purposes: Randomization, or encoding message length. A. H¨ ulsing 2MMC10 Cryptology 11 / 12

Secrecy + Authenticity We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enc k 1 ( m ) , t = Mac k 2 ( m ). MAC-then-Encrypt. t = Mac k 2 ( m ) , c = Enc k 1 ( m � t ). Encrypt-then-MAC. c = Enc k 1 ( m ) , t = Mac k 2 ( c ). A. H¨ ulsing 2MMC10 Cryptology 12 / 12

Secrecy + Authenticity We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enc k 1 ( m ) , t = Mac k 2 ( m ). MAC-then-Encrypt. t = Mac k 2 ( m ) , c = Enc k 1 ( m � t ). Encrypt-then-MAC. c = Enc k 1 ( m ) , t = Mac k 2 ( c ). A. H¨ ulsing 2MMC10 Cryptology 12 / 12

Secrecy + Authenticity We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enc k 1 ( m ) , t = Mac k 2 ( m ). Possibly insecure as MAC might leak! MAC-then-Encrypt. t = Mac k 2 ( m ) , c = Enc k 1 ( m � t ). Encrypt-then-MAC. c = Enc k 1 ( m ) , t = Mac k 2 ( c ). A. H¨ ulsing 2MMC10 Cryptology 12 / 12

Secrecy + Authenticity We want a combination of encryption and MAC that provides IND-CCA and EU-CMA security. Options: Encrypt-and-MAC: c = Enc k 1 ( m ) , t = Mac k 2 ( m ). Possibly insecure as MAC might leak! MAC-then-Encrypt. t = Mac k 2 ( m ) , c = Enc k 1 ( m � t ). Possibly insecure but counter-examples are more involved Encrypt-then-MAC. c = Enc k 1 ( m ) , t = Mac k 2 ( c ). A. H¨ ulsing 2MMC10 Cryptology 12 / 12