Chapter 2
Cryptographic Tools
Cryptographic algorithms and protocols
can be grouped into four main areas:
Symmetric encryption
• Used to conceal the contents of blocks or streams of data of any size,
including messages, files, encryption keys, and passwords
Asymmetric encryption
• Used to conceal small blocks of data, such as encryption keys and hash
function values, which are used in digital signatures
Data integrity algorithms
• Used to protect blocks of data, such as messages, from alteration
Authentication protocols
• Schemes based on the use of cryptographic algorithms designed to
authenticate the identity of entities
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
1.1 - Symmetric Encryption
• The universal technique for providing confidentiality for
transmitted or stored data
• Also referred to as conventional encryption or single-key
encryption
• Two requirements for secure use:
• Need a strong encryption algorithm
• Sender and receiver must have obtained copies
of the secret key in a secure fashion and must
keep the key secure
Symmetric Cryptographic Systems
• Characterized along two independent dimensions:
The type of operations
The way in which the
used for transforming
plaintext is processed
plaintext to ciphertext
Substitution Block cipher
Stream
Transposition
cipher
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Attacking Symmetric
Encryption
Cryptanalytic Attacks Brute-Force Attack
Rely on: Try all possible keys on some
Nature of the algorithm ciphertext until an intelligible
Some knowledge of the general translation into plaintext is obtained
characteristics of the plaintext On average half of all possible keys
must be tried to achieve success
Some sample plaintext-ciphertext
pairs
Exploits the characteristics of the
algorithm to attempt to deduce a
specific plaintext or the key being
used
If successful all future and past
messages encrypted with that key are
compromised
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Table 2.1
Comparison of Three Popular Symmetric
Encryption Algorithms
The Data
Encryption Standard (DES)
The most widely used encryption scheme
FIPS PUB 46
Referred to as the Data Encryption Algorithm
(DEA)
Uses 64 bit plaintext block and 56 bit key to produce a 64
bit ciphertext block
Strength concerns:
Concerns about algorithm
DES is the most studied encryption algorithm in existence
Use of 56-bit key
Electronic Frontier Foundation (EFF) announced in July
1998 that it had broken a DES encryption
General structure of DES
6.12
Figure DES cipher and reverse cipher for the first approach
6.13
Table 4.3 Avalanche Effect in DES: Change in Plaintext
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Triple DES (3DES)
Repeats basic DES algorithm three times using either two or
three unique keys
First standardized for use in financial applications in ANSI
standard X9.17 in 1985
Attractions:
168-bit key length overcomes the vulnerability to brute-force attack of
DES
Underlying encryption algorithm is the same as in DES
Drawbacks:
Algorithm is sluggish in software
Uses a 64-bit block size
The Advanced Encryption
Standard (AES)
Needed a NIST called for Selected
replacement for proposals for a Rijndael in
3DES new AES in 1997 November 2001
Should have a security
strength equal to or better
than 3DES
Significantly improved
3DES was not efficiency
Published as
reasonable for long
term use FIPS 197
Symmetric block cipher
128 bit data and
128/192/256 bit keys
General Design of AES Encryption Cipher
7.18
Modes of Operation
Typically symmetric encryption is applied to a unit of data
larger than a single 64-bit or 128-bit block
Electronic codebook (ECB) mode is the simplest approach to
multiple-block encryption
Each block of plaintext is encrypted using the same key
Cryptanalysts may be able to exploit regularities in the plaintext
Modes of operation
Alternative techniques developed to increase the security of symmetric
block encryption for large sequences
Overcomes the weaknesses of ECB
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Table 2.2
Average Time Required for Exhaustive Key Search
Block & Stream Ciphers
Block Cipher
• Processes the input one block of elements at a time
• Produces an output block for each input block
• Can reuse keys
• More common
Stream Cipher
• Processes the input elements continuously
• Produces output one element at a time
• Primary advantage is that they are almost always faster and use far less
code
• Encrypts plaintext one byte at a time
• Pseudorandom stream is one that is unpredictable without knowledge of
the input key
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
The RC4 Stream Cipher
• Designed in 1987 by Ron Rivest for RSA Security
• Variable key size stream cipher with byte-oriented operations
• Based on the use of a random permutation
• Eight to sixteen machine operations are required per output
byte and the cipher can be expected to run very quickly in
software
• Used in the Secure Sockets Layer/Transport Layer Security
(SSL/TLS) standards that have been defined for
communication between Web browsers and servers
• Is also used in the Wired Equivalent Privacy (WEP) protocol
and the newer WiFi Protected Access (WPA) protocol that are
part Inc.,
© 2017 Pearson Education, of Hoboken,
the IEEE NJ. All802.11 wireless LAN standard
rights reserved.
2.2 - Message Authentication &
Hash Functions
Protects against
active attacks
• Contents have not been altered
Verifies received • From authentic source
message is authentic • Timely and in correct sequence
Can use
• Only sender & receiver share a
conventional key
encryption
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Hash Functions
• A hash function H accepts a variable-length
block of data M as input and produces a fixed-
size hash value : h = H(M)
• Principal object is data integrity
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Hash Function Requirements
Can be applied to a block of data of any size
Produces a fixed-length output
H(x) is relatively easy to compute for any given x
One-way or pre-image resistant
• Computationally infeasible to find x such that H(x) = h
Computationally infeasible to find y ≠ x such that H(y) = H(x)
Collision resistant or strong collision resistance
• Computationally infeasible to find any pair (x,y) such that H(x) = H(y)
2.3 - Public-Key Encryption
Asymmetric
• Uses two
Publicly separate keys
• Public key Some form of
proposed by Based on
and private protocol is
Diffie and mathematical
key needed for
Hellman in functions • Public key is distribution
1976 made public
for others to
use
Plaintext
Readable message or data that is fed into the algorithm as input
Encryption algorithm
Performs transformations on the plaintext
Public and private key
Pair of keys, one for encryption, one for decryption
Ciphertext
Scrambled message produced as output
Decryption key
Produces the original plaintext
User encrypts data using his or her own
private key
Anyone who knows the corresponding
public key will be able to decrypt the
message
Requirements for Public-Key
Cryptosystems
Computationally easy to
create key pairs
Computationally easy
Useful if either key can for sender knowing
be used for each role public key to encrypt
messages
Computationally Computationally easy
infeasible for opponent for receiver knowing
to otherwise recover private key to decrypt
original message ciphertext
Computationally
infeasible for opponent to
determine private key
from public key
Applications for Public-Key
Cryptosystems
• Public-key cryptosystems can be classified into
three categories:
• The sender encrypts a message
Encryption/decryption with the recipient’s public key
• The sender “signs” a message
Digital signature with its private key
• Two sides cooperate to
Key exchange exchange a session key
• Some algorithms are suitable for all three
applications, whereas others can be used only for
one or two
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Public-Key Cryptosystems
RSA Encryption & Decryption
• to encrypt a message M the sender:
• obtains public key of recipient PU={e,n}
• computes: C = Me mod n, where 0≤M<n
• to decrypt the ciphertext C the owner:
• uses their private key PR={d,n}
• computes: M = Cd mod n
• note that the message M must be smaller than
the modulus n (block if needed)
Example of RSA Algorithm
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
A more realistic example
n = 309 digits.
public key of recipient PU={e,n} private key PR={d,n}
10.47
2.4 - Digital Signatures
Used for authenticating both source and data integrity
Created by encrypting hash code with private key
Does not provide confidentiality
Even in the case of complete encryption
Message is safe from alteration but not eavesdropping
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Distribution of Public Keys
• Several
techniques have
been proposed Public Publicly available
for the announcement directory
distribution of
public keys.
Virtually all these
proposals can be Public-key Public-key
grouped into the authority certificates
following
general schemes:
© 2017 Pearson Education, Inc., Hoboken, NJ. All rights reserved.
Summary
• Confidentiality with
symmetric encryption • Public-key encryption
Structure
Symmetric encryption
Applications for public-key
Symmetric block encryption cryptosystems
algorithms Requirements for public-key
Stream ciphers cryptography
Asymmetric encryption
• Message authentication algorithms
and hash functions • Digital signatures and
Authentication using symmetric key management
encryption Digital signature
Message authentication without Public-key certificates
message encryption Symmetric key exchange using
Secure hash functions public-key encryption
Digital envelopes
Other applications of hash
functions
• Random and
pseudorandom numbers
The use of random numbers
