Symmetric Encryption 2: IntegrityWith material from Dave Levin, Jon Katz, David Brumley

http

://w

wm

site

.wpe

ngin

e.co

m/w

p-co

nten

t/upl

oads

/201

1/12

/Inte

grity

-lion

-300

x222

.jpg

1

Summing up (so far)• Computational security

• Adversary receives encryption of either m0 or m1 • Can’t do better than guess which it is

• Secure PRF: Adversary can’t distinguish between PRF and actual random function

• Block ciphers: Secure when used properly (IVs!) • Multiple encryption modes

2

Message integrity and authentication

3

• Privacy and integrity are orthogonal

• Up to now we’ve had privacy without integrity

• Now we will do integrity without privacy

• And later, both at once

• Reminder: Goal is to detect tampering

• Not to prevent it!

4

Bob

D

Goal: Integrity

Alice

message m: “curiouser and curiouser!”

Eve

Public channel

Eve should not be able to alter m without detection.

E

message m’: “curious and curious?”

ERROR!

5

Bob

V

Message authentication (MAC)

Alice

Public channelS

m true or false

m||t

t = Sign(m, ks)

ks ks

Verify(m,t,ks) ?= true

Only someone who knows ks could have sent the message!

6

Non-repudiation

• A special case of authentication

• Only Alice can have sent the message • Bob could not have made it up • Alice cannot effectively deny having sent it

• Why would you want this?

7

MAC definition

• t:T = S(k,m)

• V(k,m,t) = yes or no

• V(k, m, S(k,m)) = yes

8

Straw example #1: CRC

• CRC = cyclic redundancy check • Binary division gives short, deterministic

“summary” of data

• S(k,m) = CRC(m)

• What’s wrong with this plan?

9

MAC security• Alice sends message m with tag t

• Attacker’s power: Chosen plaintext • Can observe correct (mi, ti) pairs • Can use MAC oracle to get tx for chosen mx

• Attacker’s goal: Generate some valid m’, t’ for m’ not previously seen • m’ does not have to make sense!

• Secure if: Pr[V(k, m’, t’) == yes] is very smallCalled: Existential forgery

10

Replay attacks

• Does a MAC prevent a replay attack?

• NO — Must be prevented at a higher level • Application-dependent scenario • Nonce, timestamp, etc. (more later)

11

Straw example #2: Block cipher

• Suppose message is exactly one block

• t = S(k,m) = E(k,m) • t is 128 bits long under AES

• Is this secure? Why?

12

Security sketch• Since E(k,m) is a secure block cipher, can

conceptually replace E(k,m) with a random permutation.

• Seeing E(k,m1) … E(k,mn) doesn’t help predict unseen mn+1

• Probability of a random guess is 1/2L • L = length of output tag (in bits) • Need to make sure L is long enough!

But this only works for tiny messages!13

Encrypted CBC (ECBC)

IV = 0 m1 m2 m3 m4

t

� �

E E

�

E

�

E

Verify: Same algorithm as signing

Using key k0

EUsing key k1

14

ECBC vs. CBC• Output only one block instead of many

• Don’t need to recover the plaintext • AES => 2-128 chance of guessing

• We used two keys • Necessary to prevent existential forgery

• Both require serial computation

15

Why two keys?

• Attacker requests tag for message m (m1 .. mn) • Get corresponding tag t = c[n]

• Attacker creates message m’ (one block long) • Request tag t’ for (t XOR m’)

• Resulting t’ is valid for m || m’

Uh oh.16

MACs with Hashes

17

Hash functions• A pseudorandom, one-way function

• Does not require a key

• H(m) = h • Input m = pre-image, can be arbitrary length • Output h = digest or hash, fixed small length

• Generally very fast to compute

18

Cryptographic hash• Pre-image resistance:

• Given H(m), it’s hard to find m

• Collision resistant: • Given H(m), it’s hard to find m’ s.t.

• m’ != m • H(m’) = H(m)

• Even more: Pr[any bit matching] = 1/2

19

Example hash functions• MD5: Known collision attacks, still frequently used

• SHA-1, SHA-256, SHA-512, etc. • SHA1: theoretically broken since 2005 • Deprecated by NIST in 2011 • Practical attack (SHAttered) as of February! • (Still in use many places)

• New SHA-3 (224, 256, 385, 512) • Public contest 2007-2012 • Officially standardized August 2015

20

Hash-MAC• Most widely used MAC on internet

• General idea: hash then PRF (short MAC) • Translate arbitrary message into one block • Works if H and E are both secure

m t

Using key k

EH

21

Aside: Birthday paradox

• How likely 2 people in a room share a birthday? • Pr > 50% with 23 people! • Why? There are n2 different pairs

• With X possibility space and n samples: • Pr[xi = xj] ~ 50% when n = X1/2

22

Integrity vs. Authentication

• Recall: What is the difference? • Don’t forget non-repudiation

• Do symmetric MACs like ECBC and Hash-Mac give one, or both? Which?

• Problem: More than one person knows the key

23

Authenticated Encryption

24

• Previously:

• Privacy / secrecy

• Integrity

• Now: Both at once

25

Ciphertext integrity• Maintain semantic secrecy under CPA attack

• Attacker cannot create a new ciphertext that decrypts properly!

Eve(polynomial time)

Ciphertext integrity IFF prob. of decryption without error is very small

———

Encryption oraclem1 … mn

c1 = E(k,m1) … cn

c (not in c1 … cn)Decrypt c or error

26

D

Bob

CCA revisited

Alice

c = E(k,m)

Eve

VPN

Eve can get a cipher text decrypted

E

c’ = forged cipher text

m

m’

27

CCA game• Attacker gets encryption oracle + decryption oracle

• (Encryption oracle not shown)

Eve(polynomial time)

Eve’s job: Guess whether x or y was picked. CCA-secure IFF no better than guessing

Decryption oracle

c1 … cn

m1 = D(k,c1) … mn

mx and my (not in m1 … mn)

Challenge: Choose b = x or y at uniform random

c = E(k,mb)

28

CBC is not CCA-secure

Eve(polynomial time)

mx and my

|mx| = |my| = 1 blk Challenge: Choose b = x or y at uniform random

c = E(k,mb) = IV || c[0]

c’ = (IV xor 1) || c[0]

m’ = D(k,c’) = mb xor 1

Decryption oracle

Uh oh.29

Ciphertext integrity (aka authenticated encryption) can protect against CCA!

Because only someone who knows k can send a message that will decrypt properly.

30

Auth. Encr. limitations

• Does not protect against replay

• Does not protect against e.g. timing attacks

31

Constructing authenticated encryption

32

Three basic options

• Encrypt and MAC

• MAC then encrypt

• Encrypt then MAC

Can you guess?

33

Encrypt and MAC

• Send E(m) || MAC(m)

• This is not secure b/c MAC may leak information about the message • Secrecy is not a MAC property

m t

kIS

cE

kE

34

MAC then encrypt

mkI

S EkE

tm c

• Send E(m || MAC(m))

• This can be insecure in some combinations • Always follow standards!

35

Encrypt then MAC

mkI

SEkE

c

• Send E(m) || Mac(E(m))

• This is always secure! Intuition: • MAC reveals only info about ciphertext (OK) • MAC ensures ciphertext has not been tampered

tc

36

Key exchange

37

• Up to now, we have assumed Alice and Bob share a secret key

• How did that happen?

• How does this scale to many users?

38

TTP

One solution: Trusted third party (TTP)

• TTP is a bottleneck for every message • TTP must be online at all times • TTP can read every message • Does not solve bootstrapping problem

U1 U2

U3 U4

k1 k2

k3 k4

39

TTP

Session keys and ticketsUsed for Kerberos

BobAlice

“Bob”

kAT KAB, Ticket

“Hi”kAB

Ticket

Ticket = E(KBT, “Alice||Bob||kAB”)

(fresh kAB)

• TTP is a bottleneck for every message • TTP must be online at all times • TTP can read every message • Does not solve bootstrapping problem

40

A (very) little number theory• p => a random, large prime number

• g => a generator for p: 1 < g < p • For all k between 1 and p: • There is some i, s.t. k = gi mod p

• This is called discrete log• Easy: Given p, g, x, compute y = gx mod p • Believed hard: Given p, g, y, compute x • Candidate one-way function!

41

Generator examples: p = 7

31 mod 7 3

32 mod 7 2

33 mod 7 6

34 mod 7 4

35 mod 7 5

36 mod 7 1

21 mod 7 2

22 mod 7 4

23 mod 7 1

24 mod 7 2

25 mod 7 4

26 mod 7 1

g = 3 g = 2

YES NO42

Diffie-Hellman protocol

BobAlicesecret value x secret value y

p, g, A

1 Compute A = gx mod p

2

3Compute B = gy mod pB 4

5 k = Bx mod p 6k = Ay mod pk = gxy mod p

Successful secret key exchange!43

Diffie-Hellman today

• Widely used on the internet for session keys (forward secrecy)

• Can be broken if parameters chosen poorly • Precompute some of the attack to speed it up

(“Logjam”)

• Currently switching to elliptic curves

44