Unbreakable Cryptosystems ??? Almost all of the practical - PowerPoint PPT Presentation

Unbreakable Cryptosystems ??? • Almost all of the practical cryptosystems are theoretically breakable given the time are theoretically breakable given the time Security Notions and computational resources. 密碼學與應用 • However, there is one system which is even oweve , e e s o e sys e w c s eve 海洋大學資訊工程系 theoretically unbreakable (perfectly secure): One time pad One-time pad. 丁培毅 丁培毅 1 2 One-time pad (Vernam Cipher) Unbreakable Cryptosystems!!! shared secret shared secret • One-time pad requires exchanging key that is … 101 • A kind of stream cipher codebook as long as the plaintext. g p • Gilbert Vernam in 1918 0100 Encryption Key Decryption Key • Security of one-time pad relies on the condition that keys are generated using truly random sources. a do sou ces. plaintext ciphertext plaintext Ali Alice B b Bob … 0101101 ...1111001 … 0101101 • However impractical, it is still being used in p g Encrypt Encrypt Decrypt Decrypt certain applications which necessitate very • Nothing more about the plaintext can be deduced from the ciphertext, high-level security Also, the " masked by the high level security. Also, the masked by the i.e., probability: Pr[M|C] Pr[M] or entropy H(M|C) H(M) i.e., probability: Pr[M|C] = Pr[M] or entropy H(M|C) = H(M) • Information-theoretical bound: for any efficient adversarial algorithm random key " structure is used everywhere. A , Pr[ A (C)=M]=1/2. 3 4

Modern Cryptography Modern Cryptography • What tasks, were the adversary to accomplish them, • Perfect security: possession of the ciphertext is not would make us declare the system insecure? y adding any new information to adding any new information to • What tasks, were the adversary unable to what is already known accomplish would make us declare the scheme accomplish, would make us declare the scheme • There may be useful information in a ciphertext, secure? but if you can t compute it, the ciphertext hasn t but if you can’t compute it, the ciphertext hasn’t • It is much easier to think about insecurity than really given you anything. security. security. traditional cryptography  traditional cryptography  modern cryptography (considering ode c yptog ap y (co s de g modern cryptography (considering provably secure) computational difficulties of the adversary) 5 6 Provably Secure Scheme Security Goals of Encryption • Provide evidence of computational security by • Provide evidence of computational security by Various Security Definitions: ‘breakable?’ reducing the security of the cryptosystem to some • Perfect security • Perfect security information theoretically secure information-theoretically secure well-studied problem thought to be difficult (e.g., • Plaintext recovery factoring or discrete log). g g) • Key recovery – An encryption scheme based on some atomic primitives Computationally secure – Take some goal, like achieving privacy via encryption Take some goal, like achieving privacy via encryption & provably secure p y • Partial information recovery: • Partial information recovery: – Define the meaning of an encryption scheme to be secure – Message indistinguishability – Choose an adversarial model with suitable capability Choose an adversarial model with suitable capability – Semantic Security – Provide a reduction statement, which shows that the only • Non-malleability Non malleability way to defeat the scheme is to break the underlying way to defeat the scheme is to break the underlying atomic primitive • Plaintext awareness 7 8

Security Goals (cont’d) Security Goals (cont’d) • Ex: leaking partial information about E l ki ti l i f ti b t  Simulation paradigm : a scheme is secure if “buy” or “sell” a stock ‘whatever a feasible adversary can obtain after attacking n bits, one bit per stock, 1:buy, 0:sell it, is also feasibly attainable from scratch’. if any one bit were revealed, y , • Semantic security : Whatever can be obtained from Semantic security : Whatever can be obtained from the adversary knows what I like to do. the ciphertext can be computed without the ciphertext • Changing format might avoid the above attack • Changing format might avoid the above attack. • Non-malleability : Given a ciphertext, an adversary N ll bilit Gi i h d However, making assumptions, or requirements, cannot produce a different ciphertext that decrypts to meaningfully related plaintext i f ll l d l i on how users format data, how they use it, or what the data content should be, is a bad and • Plaintext awareness : an adversary cannot create a y dangerous approach to secure protocol designs. ciphertext y without knowing its underlying plaintext x 9 10 Adversary Models for Encryption Security Goals for Signature • Total break : key recovery • Ciphertext Only p y • Universal forgery : finding an efficient • Known Plaintext equivalent algorithm to produce signatures for arbitrary messages • Chosen Plaintext gent • Selective forgery : forging the signature for a stin • Non-adaptive Chosen Ciphertext particular message chosen a priori by the attacker • Adaptive Chosen Ciphertext • Existential forgery : forging at least one signature i t 11 12

Adversary Models for Signature Secure Multiparty Protocols • Key-only attack : no-message attacks • Secure multiparty protocol : A group of n participants, each provides a secrect input x i , want to compute jointly each provides a secrect input x want to compute jointly • Known-message attack a function f i (x 1 , x 2 , …, x n ) for each participant while • Generic chosen-message attack : non-adaptive, keeping their individual input/output secret to that person. werful messages not depending on public key • Security Notion : Whatever can be obtained by a group Security Notion : Whatever can be obtained by a group pow of participants and the adversary during a real world • Directed chosen-message attack : non- adaptive messages depending on public key adaptive, messages depending on public key protocol can also be calculated in the ideal model in t l l b l l t d i th id l d l i which a trusted party helps every participant reaching his • Adaptive chosen-message attack : messages Adaptive chosen message attack : messages functional and security goals. depending on the previously seen signatures 13 14 資訊安全的定義 電腦安全的威脅 電腦安全的威脅 ‧資訊安全:利用各種方法及工具 人為災害 以保護靜態資訊(電腦安全)或 以保護靜態資訊(電腦安全)或 駭客 駭客 自然災害 網路恐佈份子 動態資訊(網路安全) 動態資訊(網路安全) 地震 內部人員 破壞 電腦威脅 破壞 雷 雷 管理者 管理者 停止 停止 火災 業者 水害 電腦病毒 資訊安全 資訊安全 阻絕服務 阻絕服務 壞 破壞 止 停止 硬體損害 硬體損害 故障 電腦安全 網路安全 停電 ... from Cryptography and Network Security Lab., NCKU Cryptography and Network Security Lab., NCKU 15 16

資訊安全課題分析 機房與電腦主機實體之安全 ‧避免大自然(如水災、雷擊等)各種自然災害的 危害 危害 稽核 ‧建築安全 內部人員 之安全管理 ‧避免硬體設備受到無法預測因素(如停電、 地 震等)的傷害 ) 網路服務之安全 網路服務之安全 ‧備份（必須以距離隔離） 稽核 內部人員 之安全管理 與外部連線之安全 與外部連線之安全 ‧實體安全 ‧實體安全 網路服務之安全 ‧備用電源（發電機，UPS等） 與外部連線之安全 機房與電腦主機實體之安全 機房與電腦主機實體之安全 Cryptography and Network Security Lab., NCKU Cryptography and Network Security Lab., NCKU 17 18 與外部連線之安全 網路服務之安全 • 利用密碼器、電子簽章及識別協定等資訊安全 • 避免遭外部駭客之入侵及病毒之散播 技術建立安全之通道及使用者連線之認證機制 技術建立安全之通道及使用者連線之認證機制 • 確保網路能正常服務 • 定期安全健康檢查 • 保護自己在與外部連線通訊之隱私性及認證性 • 危機應變處理 稽核 稽核 內部人員 內部人員 之安全管理 之安全管理 網路服務之安全 網路服務之安全 網路服務之安全 網路服務之安全 與外部連線之安全 與外部連線之安全 機房與電腦主機實體之安全 機房與電腦主機實體之安全 Cryptography and Network Security Lab., NCKU Cryptography and Network Security Lab., NCKU 19 20