Chaos Based Security - aphrdi.ap.gov.inAPHRDI... · and difficult to trace digital currencies such...

Chaos Based Security

3 Day Residential Training Programme on

“Cyber Security & Open Source Network R & Latex”

Andhra Pradesh Human Resource Development Institute (Govt. of Andhra Pradesh)25-27, July, 2018

Venkata Sundaranand PutchaProfessor and Head

Department of Mathematics, Rayalaseema University, Kurnool-518007

Google Employees Use a Physical Token as Their Second Authentication Factor

➢ Krebs on Security is reporting that all 85,000 Google employees use two-factor authentication with a physical token.

➢ A Google spokesperson said Security Keys now form the basis of all account access at Google.

➢ "We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time."

DARPA

➢ Defense Advanced Research Projects Agency, Arlington County, Virginia, United States (United States Department of Defense)

➢ DARPA Wants Research into Resilient Anonymous Communications

Major Bluetooth Vulnerability

➢ Bluetooth has a serious security vulnerability:

➢ In some implementations, the elliptic curve parameters are not all validated by the cryptographic algorithm implementation, which may allow a remote attacker within wireless range to inject an invalid public key to determine the session key with high probability. Such an attacker can then passively intercept and decrypt all device messages, and/or forge and inject malicious messages.

5

IIT

Bom

bay

RFI

D 2

005

On Financial Fraud

Ransomware

Ransomware is a type of malicious software from cryptovirology that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them.

In a properly implemented cryptoviral extortion attack, recovering the files without the decryption key is an intractable problem – and difficult to trace digital currencies such as Ukash and cryptocurrency are used for the ransoms, making tracing and prosecuting the perpetrators difficult.

➢ Food security

➢ Energy security

➢ Information security

➢ Security is a state of well-being of information and infrastructures in which the possibility of successful yet undetected theft, tampering, and disruption of information and services is kept low or tolerable

➢ Security rests on confidentiality, authenticity, integrity, and availability

Three necessities

Information is the resolution of uncertainty

Claude Elwood Shannon

Key Security Concepts

Shannon 1946

“...breaking a good cipher should require as much effort as solving a system of simultaneous equations in large number of unknown of a complex type”

Jean Dieudonne

“...going from one to several variables is an important jump that is accompanied by great difficulties and calls for completely new methods..”

Bruce Schneier, Applied Cryptography

“...Any algorithm that gets its security from composition of polynomials over a finite field should be looked upon with skepticism if not outright suspicion” statement made before AES was announced.

What is “Secure”

The core principles of Cyber security for data preservation are

➢Confidentiality

➢ Integrity

➢ Authentication

➢Non-repudiation.

Cyber Security

12

What is Cyber-safety?

Cyber-safety Threats

Consequences of Inaction

Cyber-safety Actions

Cyber-safety at Home &Work

Campus Cyber-safety

Services

Cyber Security

➢ Cyber-safety is a common term used to describe a set of practices, measures and/or actions you can take to protect personal information and your computer from attacks.

➢ As part of this policy, all departments/divisions/ units provide annual reports demonstrating their level of compliance.

➢ Further, there are services in place to help all employs/ workers/students/ faculty/staff meet the cyber-safety standards. Specific information about these services is provided in this tutorial.

What is Cyber-safety?

VirusesViruses infect computers through email

attachments and file sharing. They delete files, attack other computers, and

make your computer run slowly. One infected computer can cause problems

for all computers on a network.

HackersHackers are people who “trespass” into your computer from a remote

location. They may use your computer to send spam or viruses,

host a Web site, or do other activities that cause computer

malfunctions.

Identity ThievesPeople who obtain unauthorized

access to your personal information, such as Social

Security and financial account numbers. They then use this

information to commit crimes such as fraud or theft.

SpywareSpyware is software that “piggybacks”

on programs you download, gathers information about your online habits,

and transmits personal information without your knowledge. It may also

cause a wide range of other computer malfunctions.

First, let’s talk about some common cyber-safety threats and the problems they can cause . . .

Cyber-Safety Threats

In addition to the risks identified on the previous slide, as part of the community you may face a number of other consequences if you fail to take actions to protect personal information and your computer. Consequences include:

Loss of access to the campus computing networkLoss of confidentiality, integrity and/or availability of valuable university information, research and/or personal electronic dataLawsuits, loss of public trust and/or grant opportunities, prosecution, internal disciplinary action or termination of employment

Consequences of Inaction

➢ The top seven actions you can take to protect personal information and your computer. These actions will help you meet the Cyber-safety Program policy standards.

➢ By implementing all seven of these security measures, you will protect yourself, others, and your computer from many common threats.

➢ In most cases, implementing each of these security measures will only take a few minutes.

Cyber-Safety Actions

1. Install OS/Software Updates

2. Run Anti-virus Software

3. Prevent Identity Theft

4. Turn on Personal Firewalls

5. Avoid Spyware/Adware

7. Back up Important Files

Additional information about each of the actions below is provided on slides 8-14. Faculty and staff should work with their technical support coordinator before implementing these measures.

6. Protect Passwords

Top Seven Cyber-safety Actions

➢ Updates-sometimes called patches-fix problems with your operating system (OS) (e.g., Windows XP, Windows Vista, Mac OS X) and software programs (e.g., Microsoft Office applications).

➢ Most new operating systems are set to download updates by default. After updates are downloaded, you will be asked to install them. Click yes!

➢ To download patches for your system and software, visit:➢ Windows Update: http://windowsupdate.microsoft.com to get or ensure you

have all the latest operating system updates only. Newer Windows systems are set to download these updates by default.

➢ Microsoft Update: http://www.update.microsoft.com/microsoftupdate/ to get or ensure you have all the latest OS and Microsoft Office software updates. You must sign up for this service.

➢ Apple: http://www.apple.com/support➢ Unix: Consult documentation or online help for system update

information and instructions.➢ Be sure to restart your computer after updates are installed so that the patches

can be applied immediately.

Install OS/Software Updates

19

➢ To avoid computer problems caused by viruses, install and run an anti-virus program like Sophos.

➢ Periodically, check to see if your anti-virus is up to date by opening your anti-virus program and checking the Last updated: date.

➢ Anti-virus software removes viruses, quarantines and repairs infected files, and can help prevent future viruses.

➢ UC Davis students, faculty and staff can get Sophos for their work and home computer for FREE on the Internet Tools CD (available from IT Express in Shields Library).

➢ Sophos can also be downloaded for free from the UC Davis Software License Coordination Web site (https://my.ucdavis.edu/software/).

Run Anti-Virus Software

➢ Don't give out financial account numbers, Social Security numbers, driver’s license numbers or other personal identity information unless you know exactly who's receiving it. Protect others people’s information as you would your own.

➢ Never send personal or confidential information via email or instant messages as these can be easily intercepted.

➢ Beware of phishing scams - a form of fraud that uses email messages that appear to be from a reputable business (often a financial institution) in an attempt to gain personal or account information. These often do not include a personal salutation. Never enter personal information into an online form you accessed via a link in an email you were not expecting. Legitimate businesses will not ask for personal information online.

➢ Order a copy of your credit report from each of the three major credit bureaus-Equifax, Experian, and Trans Union. Reports can be ordered online at each of the bureaus’ Web sites. Make sure reports are accurate and include only those activities you have authorized.

Prevent Identity Theft

➢ Check your computer's security settings for a built-in personal firewall. If you have one, turn it on. Microsoft Vista and Mac OSX have built-in firewalls. For more information, see:

➢ Mac Firewall  (docs.info.apple.com/article.html?path=Mac/10.4/en/mh1042.html)

➢ Microsoft Firewall (www.microsoft.com/windowsxp/using/networking/security/winfirewall.mspx)

➢ Unix users should consult system documentation or online help for personal firewall instructions and/or recommendations.

➢ Once your firewall is turned on, test your firewall for open ports that could allow in viruses and hackers. Firewall scanners like the one on http://www.auditmypc.com/firewall-test.asp simplify this process.

➢ Firewalls act as protective barriers between computers and the internet.➢ Hackers search the Internet by sending out pings (calls) to random

computers and wait for responses. Firewalls prevent your computer from responding to these calls.

21

Turn on Personal Firewalls

22

➢ Spyware and adware take up memory and can slow down your computer or cause other problems.

➢ Use Spybot and Ad-Aware to remove spyware/adware from your computer. UC Davis students, faculty and staff can get Spybot and Ad-Aware for free on the Internet Tools CD (available from IT Express in Shields Library).

➢ Watch for allusions to spyware and adware in user agreements before installing free software programs.

➢ Be wary of invitations to download software from unknown internet sources.

Avoid Spyware/Adware

➢ Do not share your passwords, and always make new passwords difficult to guess by avoiding dictionary words, and mixing letters, numbers and punctuation.

➢ Do not use one of these common passwords or any variation of them: qwerty1, abc123, letmein, password1, iloveyou1, (yourname1), baseball1.

➢ Change your passwords periodically.➢ When choosing a password:

➢ Mix upper and lower case letters➢ Use a minimum of 8 characters➢ Use mnemonics to help you remember a difficult password

➢ Store passwords in a safe place. Consider using KeePass Password Safe (http://keepass.info/), Keychain (Mac) or an encrypted USB drive to store passwords. Avoid keeping passwords on a Post-it under your keyboard, on your monitor or in a drawer near your computer!

Protect Passwords

➢ Reduce your risk of losing important files to a virus, computer crash, theft or disaster by creating back-up copies.

➢ Keep your critical files in one place on your computer’s hard drive so you can easily create a back up copy.

➢ Save copies of your important documents and files to a CD, online back up service, flash or USB drive, or a server.

➢ Store your back-up media in a secure place away from your computer, in case of fire or theft.

➢ Test your back up media periodically to make sure the files are accessible and readable.

Back Up Important Files

➢ Physically secure your computer by using security cables and locking doors and windows in the dorms and off-campus housing.

➢ Avoid leaving your laptop unsupervised and in plain view in the library or coffee house, or in your car, dorm room or home.

➢ Set up a user account and password to prevent unauthorized access to your computer files.

➢ Do not install unnecessary programs on your computer.➢ Microsoft users can download the free Secunia

Personal Software Inspector (https://psi.secunia.com/), which lets you scan your computer for any missing operating system or software patches and provides instructions for getting all the latest updates

Home CYBER-SAFETY AT HOME

➢ Be sure to work with your technical support coordinator before implementing new cyber-safety measures.

➢ Talk with your technical support coordinator about what cyber-safety measures are in place in your department.

➢ Report to your supervisor any cyber-safety policy violations, security flaws/weaknesses you discover or any suspicious activity by unauthorized individuals in your work area.

➢ Physically secure your computer by using security cables and locking building/office doors and windows.

➢ Do not install unnecessary programs on your work computer.

Work Cyber-Safety at Work

The following services and software to protect the organization /office / institute network against cyber-safety attacks. These include:

Services Software

➢email virus filtering ➢firewall services➢Email attachment filtering➢Vulnerability scanning➢Intrusion prevention

system

➢ Free anti-virus software: Sophos Anti-virus

➢ Free encryption software: Pointsec for PC

➢ Free change management software: Tripwire

Servic

es Cyber-Safety Services

Security Threats and Attacks

➢A threat is a potential violation of security.

➢Flaws in design, implementation, and operation.

➢An attack is any action that violates security.

➢Active adversary

➢An attack has an implicit concept of “intent”

➢Router mis-configuration or server crash can also cause loss of availability, but they are not attacks

Motivation➢The need for random and pseudorandom numbers

arises in many cryptographic applications.

➢Common cryptosystems employ keys that must be generated in a random fashion.

➢Many cryptographic protocols also require random or pseudorandom inputs at various points

➢Example: For auxiliary quantities used in generating digital signatures, for generating challenges in authentication protocols

Types of Generators

➢Random number generators (RNGs)

➢Pseudorandom number generators (PRNGs)

➢Both of these generator types produce a stream of zeros and ones that may be divided into substreams or blocks of random numbers.

Friends and enemies: Alice, Bob, Trudy➢ well-known in network security world

➢ Bob, Alice (lovers!) want to communicate “securely”

➢ Trudy (intruder) may intercept, delete, add messages

securesender

securereceiver

channel

data, control

messages

data data

Alice Bob

Trudy

Eavesdropping - Message Interception (Attack on

Confidentiality)➢ Unauthorized access to information

➢ Packet sniffers and wiretappers

➢ Illicit copying of files and programs

A B

Eavesdropper

Integrity Attack - Tampering With Messages

➢ Stop the flow of the message

➢ Delay and optionally modify the message

➢ Release the message again

A B

Perpetrator

Authenticity Attack - Fabrication

➢ Unauthorized assumption of other’s identity

➢ Generate and distribute objects under this identity

A B

Masquerader: from A

Attack on Availability

➢ Destroy hardware (cutting fiber) or software➢ Modify software in a subtle way (alias commands)➢ Corrupt packets in transit

➢ Blatant denial of service (DoS):➢ Crashing the server➢ Overwhelm the server (use up its resource)

A B

Classification

➢ Passive attacks - eavesdropping on, or monitoring of, transmissions to:– obtain message contents, or

– monitor traffic flows

➢ Active attacks – modification of data stream to:– masquerade of one entity as some other

– replay previous messages

– modify messages in transit

– denial of service

Security Policy and Mechanism

➢ Policy: a statement of what is, and is not allowed.➢ Mechanism: a procedure, tool, or method of enforcing a

policy.➢ Security mechanisms implement functions that help

prevent, detect, and respond to recovery from security attacks.

➢ Security functions are typically made available to users as a set of security services through APIs or integrated interfaces.

➢ Cryptography underlies many security mechanisms.

OSI Security Architecture

➢ ITU-T X.800 Security Architecture for OSI

➢ Defines a systematic way of defining and providing security requirements

➢ For us it provides a useful, if abstract, overview of concepts we will study

➢ X.800 defines security services in 5 major categories

Security Mechanisms

Pervasive security mechanisms:

– Trusted functionality

– Security labels

– Event detection

– Security audit trails

– Security recovery

Specific security mechanisms:

– Encipherment– Digital signatures– Access controls– Data integrity– Authentication

exchange– Traffic padding– Routing control– Notarization

Security Services

➢ Authentication - assurance that the communicating entity is the one claimed

➢ Access Control - prevention of the unauthorized use of a resource

➢ Data Confidentiality –protection of data from unauthorized disclosure

➢ Data Integrity - assurance that data received is as sent by an authorized entity

➢ Non-Repudiation - protection against denial by one of the parties in a communication

Standards Organizations

➢ National Institute of Standards & Technology (NIST)

➢ Internet Society (ISOC)➢ International Telecommunication Union

Telecommunication Standardization Sector (ITU-T)

➢ International Organization for Standardization (ISO)

➢ RSA Labs (de facto)

Levels of Impact

from a security breach perspective

➢ Low Impact: The loss could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

➢ Moderate Impact: The loss could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

➢ High Impact: The loss could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals

Aspects of Security

➢ aspects of information security:– security attack– security mechanism (control)– security service

➢ “terms”– threat – a potential for violation of security– vulnerability – a way by which loss can happen– attack – an assault on system security, a

deliberate attempt to evade security services

Passive Attack - Interception

Passive Attack: Traffic Analysis

Observe traffic pattern

Active Attack: Interruption

Block delivery of message

Active Attack: Fabrication

Fabricate message

Active Attack: Replay

Active Attack: Modification

Modify message

Randomness

➢ Flips of an unbiased “fair” coin with sides that are labeled “0” and “1,” with each flip having a probability of exactly ½ of producing a “0” or “1.”

➢The flips are independent of each other: the result of any previous coin flip does not affect future coin flips

➢The unbiased “fair” coin is thus the perfect random bit stream generator

➢Not Practical

Unpredictability

➢ Forward unpredictability : If the seed is unknown, the next output number in the sequence should be unpredictable in spite of any knowledge of previous random numbers in the sequence.

➢Backward unpredictability : Not be feasible to determine the seed from knowledge of any generated values

➢No correlation between a seed and any value generated from that seed should be evident; each element of the sequence should appear to be the outcome of an independent random event whose probability is 1/2.

Seeds

➢To ensure forward unpredictability, care must be exercised in obtaining seeds.

➢The values produced by a PRNG are completely predictable if the seed and generation algorithm are known.

➢ Since in many cases the generation algorithm is publicly available, the seed must be kept secret and should not be derivable from the pseudorandom sequence that it produces. In addition, the seed itself must be unpredictable

Random Number Generators ➢An RNG uses a nondeterministic source along with

some processing function to produce randomness.

➢Noise in an electrical circuit,

➢The timing of user processes (e.g., key strokes or mouse movements),

➢The quantum effects in a semiconductor.

➢Various combinations of these inputs may be used.

➢These may contain some periodicity and may prove to be nonrandom.

➢To produce large quantities of random numbers, pseudorandom number generators are used

Pseudorandom Number Generator

➢Uses one or more inputs and generates multiple “pseudorandom” numbers.

➢ Inputs - seeds.

➢A PRNG should obtain its seeds from the outputs of an RNG.

➢A PRNG requires a RNG as a companion.

➢Outputs - Deterministic functions of the seed

➢All true randomness is confined to seed generation.

Cryptography➢ In Cryptography, the meaning of the message is

hidden, not its existence➢ Kryptos = “hidden” in Greek

➢Historically, and also today, encryption involves➢ transposition of letters➢ Sparta’s scytale is first cryptographic device (5th Century BC)➢ Message written on a leather strip, which is then unwound to

scramble the message

➢ substitution➢ Hebrew ATBASH (אתבש)➢ Kama-Sutra suggests that women learn to encrypt their love

messages by substituting pre-paired letters (4th Century AD)➢ Cipher – replace letters➢ Code – replace words

Monoalphabetic Ciphers➢ Caesar Shift Cipher➢ Each letter substituted by shifting n=3 places

➢ E X A M P L E➢ H A D P S O H

➢ Only 25 such ciphers

➢ Jefferson wheel implementation➢ Set the message across the wheels➢ Select another line (in random) as cipher

➢ Substitution based on key phrase➢ Substitution key consists of phrase’s letters (uniquely) followed

by rest of the alphabet in order➢ Phrase: THIS IS ALICE AND BOB’S KEY➢ Key: THISALCENDBOKY-FGJMPQRUVWXZ

➢ 26! (roughly 1026) monoalphabetic substitution ciphers

Concept

Why to Use ChaosA Complexity Theoretic Approach based on

Applications

Inspiration

Multi-algorithmic Cryptography using Deterministic Chaos with Applications to Mobile Communications, J M Blackledge, International Society for Advanced Science & Technology, Transactions on Electronics and Signal Processing, No. 1, Vol. 2,23 - 64, 2008

Contents

➢ Basic Concepts in

Cryptography

➢ Substitution Ciphers

➢ Principal Conditions

➢ Example Algorithms

➢ Diffusion and Confusion

➢ Kerchhoff-Shannon Principle

➢ Summary

➢ Multi-algorithmicity

➢ Designing Chaotic

Algorithms

➢ Software Development

➢ Applications

➢ Crypstic

Contributing Subject Areas

What is a Cryptosystem?

A cryptosystem is a computer program transforminginformation in a key-dependent and apparentlyunpredictable manner

Basic Concepts in Cryptography

➢Box strength : strength of Encryptor E/D

➢Combination # : strength of Key K (length of #)

Symmetric Encryption

• A & B agree on combination # a priori

• A & B undertake the same lock/unlock process – a symmetric process

• Vulnerable to attack if interceptor obtains combination # when A & B agree upon it

• Problem: How should A & B exchange the key?

Multiple Encryption

Uses many locks or Keys Kn

Based on application of the same encryption/ decryption algorithm E/D

Used to increase effective key length, e.g.Digital Encryption Standard 3 (DES3)

Asymmetric Encryption

• A sends B an open lock with combination known only to A.

• B secures box with lock & sends box (with message) back to A – an asymmetric process

• A is vulnerable to receiving disinformation if open lock is intercepted

• Problem: How can A authenticate the message from B?

Three-Way-Pass Protocol

• A locks box with combination # known only to A and sends it to B.

• B locks box with another lock and a combination # known only to B and sends it back to A

• A (partially) unlocks box and sends it back to B

• B (completely) unlocks box to recover message

• Protocol is vulnerable to 3-pass interception

Public/Private Key Encryption

• A locks box with a public combination # unique to B - a public key.

• Some ‘property’ of this public key is known only to B.

• This ‘property’ (the private key) llows B to unlock the box

• Vulnerability of method depends on the ‘property’ which depends on the design details of the lock

Principal issues

Cryptographic systems should be designed with respect to three components:

- cyphertext generation- key exchange- authenticity

Each component tends to rely on separate and distinct methods of approach

Steganography

➢ In Greek➢ Steganos = covered➢ Graphein = to write

➢ Steganography is about hiding messages

➢ Historically, secret messages were often hidden (or memorized)

➢ Today, steganography is used primarily to protect digital rights➢ “watermarking” copyright notices➢ “fingerprinting” a serial ID

History of Steganography (Physically Hiding)➢ Runners were memorizing messages➢ Sometimes killed after delivering the message

➢ Demaratus tells Athens of Persia’s attack plans➢ Writes the secret message on a tablet, and covers it with wax

➢ Greek Histaiaeus encouraged Aristagoras of Miletus to revolt against the Persian King.➢ Writes message on the shaved head of the messenger, and sends

him after his hair grew

➢ Chinese silk balls➢ Message is written on silk, turned into wax-covered ball that was

swallowed by the messenger…

➢ Invisible ink-jet technology➢ Ink that is too small for human eye (Univ of Buffalo, 2000)

History of Steganography (cont.)• Invisible Ink

• Certain organic fluids (milk, fruit juice) are transparent when dried but the deposit can be charred and is then visible

• Romans used to write between the lines

• A mixture of alum and vinegar may be used to write on hardboiled eggs, so that can only be read once shell is broken

History of Steganography (cont.)

• Microdots• WW2 Germany - documents shrunk to the size of a

dot, and embedded within innocent letters• DNA microdot, embedding synthetically formed DNA

sequence (secret) into a normal DNA strand, then posting as microdot

• Inkjet dots, smaller than human eye can see• Microdots with barcode-like information

• Easter eggs• Programmers embed in software

• See http://www.eeggs.com

• Claims that Beatles embedded secret messages in their music

Hiding a message within a text

• An actual message from a German spy• read second letter in each word

“Apparently, neutral’s protest is thoroughly discounted

and ignored. Isman hard hit. Blockade issue affect

pretext for embargo on by products, ejecting suets and

vegetable oils.”

“Pershing Sails from NY June 1”

Hiding a message within a text (more)

➢ Shift some words by one point/pixel.➢ Shifted words (or their first letters) make the sentence

➢Use different fonts➢ Letter by letter or word by word (Francis Bacon Cipher)

➢ Lexical steganography uses the redundancy of the English language➢ “I feel well” and “I feel fine” seem the same, but one may be

used to encode “SOS”

➢Chaffing and winnowing➢ Riddle text with extra parts that the receiver will know how to

remove (e.g., those that don’t “authenticate”)

Modern Steganography

➢ Hiding one message within another (“container”)

➢ Most containers are rich media➢ Images, audio, video are very redundant, can be tweaked without

affecting human eye/ear➢ US argued that Bin Laden implanted instructions within taped interviews

➢ Copyright notices embedded in digital art➢ Prove ownership➢ Serial number embedded to prevent replication➢ Seek infringements on the web using spiders

➢ Digital cameras EXIF tags➢ Not secretive, but hidden from the eye➢ Embed info such as camera type, date, shutter speed, focal length,..

➢ Similarly, possible to embed messages in invisible parts of html pages 77

IIT

Bom

bay

RFI

D 2

005

78

• Example: use 1-2 Least Significant Bits (LSB) in each pixel• human eye wont notice the difference• message can be compressed to reduce number of bits needed• only half the bits are likely to change on average• prefer “containers” with a lot of variations

• Message (M1) in an Image• Steganography is the art and science of communicating in a way which hides the

existence of the communication. In contrast to cryptography, where the "enemy" is allowed to detect, intercept and modify messages without being able to violate certain security premises guaranteed by a cryptosystem, the goal of steganography is to hide messages inside other "harmless" messages in a way that does not allow any "enemy" to even detect that there is a second secret message present [Markus Kuhn 1995-07-03].

Hiding a Message in an Image

Check out Steganos (www.steganos.com), Digimarc (www.digimarc.com)

Example (Steganos)Original Picture Embedded Picture

With embedded picture JPG version

The Caesar CipherA Simple Cipher

80

IIT

Bom

bay

RFI

D 2

005

AMARAVATHI

DPDUDYDWKL

81

APHRD, BAPATLA

DSKUG, EDSDWOD

82

Breaking Monoalphabetic Ciphers

➢ The Arabs broke monoalphabetic substitution using frequency analysis➢ In English (Source: Beker & Piper)

➢ Thus, letters ciphering e, t, and a are easily discovered➢ Subsequently can look for the rest of the letters and letter pairs

a 8.2% j 0.2 s 6.3b 1.5 k 0.8 t 9.1c 2.8 l 4.0 u 2.8d 4.3 m 2.4 v 1.0e 12.7 n 6.7 w 2.4f 2.2 o 7.5 x 0.2g 2.0 p 1.9 y 2.0

h 6.1 q 0.1 z 0.1i 7.0 r 6.0

Computing the Caesar Cipherusing Modular Arithmetic

•

84

Homophonic Substitution

➢Homophonic substitution cipher can be used to foil frequency analysis➢ Keyed 2-digit substitution

➢ Reverse frequency

The Vigenere Cipher

•

The Vigenere Polyalphabetic Cipher

• Vigenere’s polyalphabetic cipher (19th century) generalizes Caesar’s shift cipher• Use keyword to select encrypting rows

➢ The Vigenere cipher is not amenable to simple frequency analysis

➢ Actually invented earlier (16th century)

➢ Called “The Unbreakable Cipher”

Vigenere Tableau

Babbage breaks Vigenere Cipher

➢Babbage broke Vigenere’s Cipher (1854, Crimean war)➢ Stage 1: Discover key length

Look for repeated sequences, and measure their distance

The key length is a factor of these distances

➢ Stage 2: Identify the key itselfCompare distributions for each of the key letters with the

standard distribution, to identify the shift

➢Babbage could not publish his workSimilar techniques developed independently by Kasiski

(a Prussian officer); Kerckhoff (French cryptographer)

➢ Check out an applet that breaks Vigenere: http://math.ucsd.edu/~crypto/java/EARLYCIPHERS/Vigenere.html

Vernam Cipher (1919)

•

89

Example of a Vernam Cipher

90

IIT

Bom

bay

RFI

D 2

005

Substitution (Stream) Ciphers•

91

8-bit XOR based Encryption

92

IIT

Bom

bay

RFI

D 2

005

• n - the cipher – is generated by some physical effect or computed using a numerical algorithm that can be seeded by a key K

• The algorithm should produce random numbers with no statistical bias – maximum confusion

• n should be ultra-sensitive to K :

a change of 1 bit in K should potentially effect all

• the bits of n – maximum diffusion

• n must have a long cycle length

93

Examples of Cipher Generation • SIGSALLY (Green Hornet): AT & T

(1942-46)

• Noise generated using a vacuum tube and stored on a phonograph record

• Record used to mask 1-to-1 voice signals

• Distribution of noise sources strictly controlled

• Records were in effect

• one-time-pads 94

Examples of Cipher GenerationHotBits (http://www.fourmilab.ch/hotbits/)

95

Atmospheric radio noise (http://www.random.org/)

Quantum Mechanical noise using a reverse biased semiconductor (junction http://www.araneus.fi/)

Iterative Cryptosystems

96

Most cryptographic systems are based on a series of so-called round transformations, which are relatively simple and produce Pseudo Random Number Streams Pseudo Random Number Generators (PRNG)

A PRNG is a function or an algorithm that produces a sequence of numbers from a relatively short seed (initial conditions: password, plaintext) based on some iteration function

The mod FunctionModular based functions tend to behave more erratically than conventional functionsamod(b) gives the remainder of a/b, e.g.23mod(7) = 2, 6mod(8) = 6amod(b)=a-bfloor(a/b)

97

IIT

Bom

bay

RFI

D 2

005

Example Algorithms for Computing

•

98

Maximum Entropy Encryption• Encryption process changes the statistics of cipher

• Statistics of the ciphertext become non-uniform

• Solution is to pad the plaintext (with ‘?’ = 63 for 7-bit ASCII)

99

c = n+p

Diffusion + Confusion

100

IIT

Bom

bay

RFI

D 2

005

Cycle Length Analysis usingAutocorrelation & Power Spectrum

101

IIT

Bom

bay

RFI

D 2

005

Kerchhoff-Shannon PrincipleKerchhoff’s Principle:

‘A cryptosystem should be secure even if everything about the system, except the key, is public knowledge’

Shannon’s Principle:

‘The enemy knows the system’, i.e.

THE ALGORITHM

Some Golden RulesSecurity is a process not a product

Never underestimate the enemy

The longer that any cryptosystem, or part thereof, remains of the same type with the same function, the more vulnerable the system becomes to a successful attack inclusive of THE ALGORITHM

If you want to know what you are eating then grow it and cook it yourself

The RSA AlgorithmThe Rivest, Shamir & Adleman algorithm is as follows:

➢ Prime numbers p & q are chosen together with e < pq

➢ A obtains public key for B - given by (e, pq) - and sends

B has a private key d such that ed-1 is divisible by (p-1)(q-1), i.e. d is the solution of

B recovers message using

Important Points

To compute d, e must be a relative prime of (p-1)(q-1). Thismeans that e & (p-1)(q-1) have no common factors except 1

• The prime numbers p & q and the number e < pq must bedistributed to Alice and Bob in such a way that they areunique to Alice and Bob on the condition that d exists!

• This requires an appropriate infrastructure to be establishedby a trusted third party who’s ‘business’ is to distribute valuesof e, pq & d to its clients – a Public Key Infrastructure (PKI)

Internet Communications

Vulnerability to an Attacke and pq are known and p and q must be prime

numbers - elements of a large but (assumed) known set.

• To attack the cipher, d must be found and it is known that d is the solution of de = mod [(p-1) (q-1)] which is only solvable if e < pq is a relative prime of (p-1)(q-1).

• An attack is based on searching through prime numbers whose magnitudes are consistent with the product pq until the relative prime condition is established for factors p and q.

Public Key Infrastructure (PKI)A PKI is required in order to distribute public keys,

i.e., different but appropriate values of e and pq,

for use in public key cryptography (RSA algorithm)

• Requires the establishment of appropriate authorities and directory services for the generation, management and certification of public keys

• Vulnerable to authorities (operating in UK) having to conform to the Regulation of Investigatory Powers Act (UK) 2000, Section 49

SummaryEncryption systems belong to two basic classes:- symmetric- asymmetricEncryption algorithm should provide a cipher with the

following basic properties:- Maximum entropy of cipher- Maximum diffusion of key- Long cycle length of cipherEncryption algorithm is taken to be public knowledgeThe Kerchhoff-Shannon Principle, e.g. RSA

Algorithm

Cryptography using Chaos

Brief History of Chaos-based CryptographyEarly 1950s: Shannon explicitly mentionsthat the basic stretch-and-fold mechanismof chaos can be used in cryptology.• Silent period until the late1980s.– Chaos theory becomes popular– Cryptography becomes more important• ~ 30 publications in 1990s– Various ciphers suggested– Focus on analog circuits• 2000++: Chaos begins to be recognized– spread spectrum for military

communications– launch of Crypstic by Lexicon Data Limited

Claude Shannon1916 - 2001

Chaos and Cryptology:Similarities 1Deterministic– chaotic map– encryption algorithmComplex and Unpredictablerandom-like behavior for any externalobserver with no a priori knowledge of thealgorithm and initial condition - key

112

IIT

Bom

bay

RFI

D 2

005

Chaos and CryptologySimilarities 2

Small variations of any variable changes theoutputs considerablyModification of 1 bit of the plaintext or keyshould change all bits of the ciphertext withprobability 50%.

Bounded state space, self-mapping, extensionof a state point over the whole state space

Iterative transformations with a single chaoticmap

Chaos and CryptologySimilarities 3

Chaos and CryptologyPrincipal Differences• Chaotic systems are defined on real/complexnumbers spaces (bounded continuous space)whereas cryptography uses binary sequences(finite discrete space).• Chaos theory aims to understand the asymptoticbehavior of iterative process whereas cryptographyfocuses on the properties of a number of first fewiterations

115

IIT

Bom

bay

RFI

D 2

005

Chaos Theory .v. Cryptography

Simple Example of an IFS:The Vurhulst Process

Example Iteration FunctionSystem (IFS)

Feigenbaum Diagram

Self-Affine Characteristics

Properties of Chaotic SystemsRequired for CryptographySensitivity to the initial conditionsIt is impossible to predict the behaviour

of the system even if we have partial knowledge of its organization.

Topological transitivityThe state point stays within a bounded

state space and approaches infinitely closely to any point of the state space.

A Deterministic Chaotic SystemDeterministic system is defined by a IFS f(x)Input is initial condition x0 and parameter rOutput is a sequence of states: x1 , x2 , x3 , …

where xi +1 = f (xi , r)

Matthews Cipher

Chaos and Pseudo-Chaos

True Chaos has an infinite number ofstatesPseudo-Chaos has a finite number ofstates– Involves approximation of continuouschaos with floating- or fixed-pointarithmetic– Leads to discrete chaos-like system withlow cycle lengths

Floating-point Approximation

Example Cycle LengthDistribution (Vurhulst Process)

Chaos .v. Pseudo Chaos

Cryptographically Good Orbits

Stability of an Iterative ProcessConsider the iterative process

and a model for the error at each iteration given by

Then

Measure of Stability

Rearranging and summing over N iterations:

Thus

The Lyapunov Exponent

Measures the sensitivityof an iterated function tothe initial condition (key)

Require the exponentto be:- >0 (chaotic behaviour)- approach 1(extent of chaoticity

Maximum Entropy CiphersPDFs of chaotic iterators are not uniform• Bit stream cipher generated using a uniform PDFpartitioning strategy to maximize entropy of cipher• Encryption based on XOR operation

Example of a Chaotic Cipher withPoor Statistical Characteristics

Basic Design Steps

Chaos-based .v. ConventionalEncryption Algorithms

135

Chaos-based cryptography has many disadvantages accept with regard to one important

issue: can inventan unlimited number of algorithms

Multi-algorithmicity:Meta-Encryption Engines

136

IIT

Bom

bay

RFI

D 2

005

Chaotic Function Selectionover Chaotic Block LengthsAnalogous to the ‘M Algorithm’ which is a method forcombining multiple pseudo random streams to increasetheir security where one generators output is used toselect a delayed output from another generator.The last floating point number of a current block cipheris used to seed the next block cipher

137

Example Algorithms andParameter Settings

IIT

Bom

bay

139

IIT

Bom

bay

RFI

D 2

005

Covert Access Through ObfuscationCamouflage encryptionengine by embedding it infiles of a similar type:a dll (Dynamic Link Library) fileExecution is based onrenaming a known dllto a known exe filethrough deletionRequires that application issoftware engineered to beForensically Inert

140

CrypsticMulti-Algorithmic Block Encryption Engine– Unique set of algorithms for each encryption engine– Algorithm selection & initiation seeded by file properties– Passes all statistical test recommended by NIST, USAImplementation– Flash memory– Forensically inert– Key-logging evasion

141

Applications to Cloud Computing

142

Advantages .v. DisadvantagesSovereignty is a potentialmajor problem for the Cloud

Need to treat the Cloud as ahostile territory

User-based security is themost likely solution

143

Cloud SecurityCloud computing only represents 4% of current IT spend and is expected to more than double by 2012

Software as a Service (SaaS) by itself is projected to nearly double from $9B to $17B (less than 10% of total market)

User-security underpins acceptance of cloud architecture

Each user has own encryption engine enabling both protection and control – PC + Crypstic

SummaryChaos-based encryption has many disadvantagescompared with conventional encryption algorithms:

- computationally inefficient- low cycle lengths

The principal advantage is that it provides the potential for developing an unlimited number of algorithms that can beused to produce a multi-algorithmic solution

Algorithms can be published so that approach conforms to the Kerchhoff-Shannon Principle in the knowledge that a new set of chaos-based algorithms can be developed.

Open Problems

Structurally stable pseudo-chaotic systems

Require a structurally stable cryptosystem, i.e. a systemthat has (almost) the same cycle length and Lyapunovexponents for all initial conditions. Most of the knownpseudo-chaotic systems do not possess this property

Conditions of unpredictability for chaotic systems

What properties of a chaotic system guarantee itscomputational unpredictability ?

Security

Cryptography & Cryptanalysis

System security

Network security Web security

Application security

Malware defense

Information securityPhysical device security

Database security Cyber forensics

Security

Cryptography & Cryptanalysis

System security

Network security Web security

Application security

Malware defense

Information securityPhysical device security

Database security Cyber forensics

Road is Difficult, but Future is Bright

◆ Any TIME◆ Any PLACE ◆ Any THING

Thanks for your Attention!!!