::Life of Security::: Lec 3 :: Modern Cryptography

Wednesday, August 12, 2009

Lec 3 :: Modern Cryptography

21 SYABAAN 1430
12 OGOS 2009( WEDNESDAY )

Today i learn about:-
* modern cryptography algorithm
* Block & Stream
* DES
* AES
* MAC
* Digital Signature

>> DES

* Provides a high level of security
* The security depends on keys, not the secrecy of the algorithm
* The security is capable of being evaluated
* The algorithm is completely specified and easy to understand
* It is efficient to use and adaptable
* Must be available to all users
* Must be exportable

0 comments:

::Aku Milik TUHANKU..::

Apakah pendirian hidupmu?

Azamku tak mungkin kau jadikan kelabu Tepis-tepis kata yg sinis Yang panas ku jadikan membeku Bahagia aku kemudi selalu Biar ku menuju jalan tak berbiku Biarkan cemburu berkubur Asalkan tak cemari hidupku Biarkan ku senyum selalu Tandanya ku tiada seteru Jangan kau terpenjuru Jangan kau bercelaru Diriku bukan milikmu*

"Ya Allah... Tunjukkan kepada kami yang benar dan jadikan pilihan kami mengikuti yang benar itu. Dan juga tunjukkan kepada kami yang tidak benar dan permudahkan kami meninggalkannya."

:; Sepintas Bicara ::

Name :

Web URL :

Message :

by. oggix.com

more smileys

LAB 6::SECURITY IN NETWORK.

In the field of networking, the specialist area of network security consists of the provisions made in an underlying computer network infrastructure, policies adopted by the network administrator to protect the network and the network-accessible resources from unauthorized access, and consistent and continuous monitoring and measurement of its effectiveness (or lack) combined together.

Network security starts from authenticating the user, commonly with a username and a password. Since this requires just one thing besides the user name, i.e. the password which is something you 'know', this is sometimes termed one factor authentication. With two factor authentication something you 'have' is also used (e.g. a security token or 'dongle', an ATM card, or your mobile phone), or with three factor authentication something you 'are' is also used (e.g. a fingerprint or retinal scan).

Once authenticated, a firewall enforces access policies such as what services are allowed to be accessed by the network users .Though effective to prevent unauthorized access, this component may fail to check potentially harmful content such as computer worms or Trojans being transmitted over the network. Anti-virus software or an intrusion prevention system (IPS)^[2] help detect and inhibit the action of such malware. An anomaly-based intrusion detection system may also monitor the network and traffic for unexpected (i.e. suspicious) content or behaviour and other anomalies to protect resources, e.g. from denial of service attacks or an employee accessing files at strange times. Individual events occurring on the network may be logged for audit purposes and for later high level analysis.

Communication between two hosts using the network could be encrypted to maintain privacy.

Honeypots, essentially decoy network-accessible resources, could be deployed in a network as surveillance and early-warning tools. Techniques used by the attackers that attempt to compromise these decoy resources are studied during and after an attack to keep an eye on new exploitation techniques. Such analysis could be used to further tighten security of the actual network being protected by the honeypot.

A useful summary of standard concepts and methods in network security is given by in the form of an extensible ontology of network security attacks.

IPSec Network Security

Description

IPSec is a framework of open standards developed by the Internet Engineering Task Force (IETF).

IPSec provides security for transmission of sensitive information over unprotected networks such as the Internet. IPSec acts at the network layer, protecting and authenticating IP packets between participating IPSec devices ("peers"), such as Cisco routers.

IPSec provides the following network security services. These services are optional. In general, local security policy will dictate the use of one or more of these services:

•Data Confidentiality—The IPSec sender can encrypt packets before transmitting them across a network.

•Data Integrity—The IPSec receiver can authenticate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.

•Data Origin Authentication—The IPSec receiver can authenticate the source of the IPSec packets sent. This service is dependent upon the data integrity service.

•Anti-Replay—The IPSec receiver can detect and reject replayed packets.

With IPSec, data can be transmitted across a public network without fear of observation, modification, or spoofing. This enables applications such as virtual private networks (VPNs), including intranets, extranets, and remote user access.

::LAB 5: WEB APPLICATION SECURITY

Over 700 million people worldwide bank, shop, buy airline tickets, and perform research using the World Wide Web. With each transaction, private information, including names, addresses, phone numbers, credit card numbers, and passwords, are routinely transferred and stored in a variety of locations. Billions of dollars and millions of personal identities are at stake every day. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough to protect websites from hackers. Today, with prominent
Web attacks taking place seemingly every week, the industry knows better.

The best way to begin exploring web application security is by learning how the Web works. While most IT professionals are very comfortable with using a web browser to surf the Web, few of us look behind the application, at the client-server4 structure that powers the Web. This structure governs the way web browsers (Firefox5, Microsoft Internet Explorer) must communicate with web servers7 (Apache8, Microsoft IIS ) to retrieve web pages10. To peer deeper into the world of the Web we’ll begin by looking at the web browser location bar .
All major web browsers possess a location bar that displays the web address(URL) of the current web page. URL manipulation is one of the many ways to launch a web application attack. And yet, they (location bars) are required to enable customers, partners, and hackers to view your website. URL’s are used to uniquely identify the location of a web page or on-line resource. When traveling from one web page to the next, the displayed URL is updated. URLs, also referred to as links, are commonly embedded in web pages to click on to visit other pages. URLs also tell us a lot about a website. They tell us what type of communication they expect, what type of operating system they run, the type of web application code is being used, and more. We’ll be exploring the anatomy of URLs closely in the following section and we’ll look at how each section can be vulnerable to attack.

A critical point to note here: lack of firewall protection on the Web.When visiting any one of the millions of websites that exist today, it’s unlikely that you will encounter firewall protection. It’s notthat firewalls aren’t there or not useful, they are. In fact, most websites have firewalls protecting them from network-based attack (worms, viruses, hackers). But network-based attacks are fundamentally different from web-based attacks (XSS, SQL Injection), which are
immune to a firewall’s defenses.
A firewall’s job is to prevent unauthorized connections to protected network devices. For instance, you probably do not want intruders
connecting to internal databases, workstations, printers, and so forth. For a website to be accessible to the public, firewalls must allow traffic to the web server. If it did not, no one would be able to visit a website. This means if a website has a vulnerability, firewalls are powerless, since web traffic must be allowed in. Web application security sits above the network layer, in a world of its own.

Web Applications
http://example.com/path/to/application.cgi?param1=value1&param2=value2 Web application security owes its name to the next section of the URL. The portion of the URL after the final forward slash and before the question mark is the “web application14.” Web applications are software that enables a website to serve-up dynamic content. They can do just about anything and be programmed in just about any language. When they receive requests, these applications dynamically create web pages to return to the web browser. Web applications turn an ordinary web server into a Google (www.google.com), a Yahoo! (www.yahoo.com), an online auction, web bank, message board, blog, etc. Without web applications, the web would be filled with static content and none of the interactivity that drives innovation.

Three Places to Attack a Website
Statistically, over 90% of all websites have serious security issues, but the big question is “how are they attacked?” If we look at everything we’ve covered so far, basically there are only three places to attack a website: URL’s, cookies, and Post Data. We’ll explore each of these attack points by analyzing real-world exploits. Recall that there are twenty-four classes of attack, and each of these points is vulnerable to all of them.

URL

In July of 2005, the University of Southern California (USC) was informed of a SQL Injection vulnerability found within one of their websites. The website in question is used to accept applications from prospective students. According to sources, a lack of security checks on the login web-form text boxes allowed commands to be sent to the back-end database. These commands enabled public access to personal information including the names, birth dates, addresses, and social-security numbers of up to 280,000 users. While the specific technical details remain undisclosed, here is a likely scenario of what took place. When filling out the login web-form with a username (johndoe) and password (abc123), the web browser would generate a URL similar to following:
http://victim.com/login.asp?username=johndoe&password=abc123.

Cookie

Just before Valentine’s Day 2003, FTD.com (a large online florist) received word that hackers could illegally access customer information by simply changing a particular number within a cookie16. The number was a customer identifier that could be easily guessed and changed to access the sensitive information of other users. This class of attack is
generally referred to as Credential Session Prediction17. Security experts confirmed the problem existed and that customer billing records, names, addresses, and phone numbers were exposed.

Here is an example of what of likely took place:
When users login to FTD.com or add products to their shopping carts, they are given a cookie to track the current session. The cookie contains a unique customer identifier; in this case “CustomerID”, with
a value of “1001.”

Post Data
In October 2005, in an incident known as the Samy Worm, a hacker (Samy) used a common, Cross-Site Scripting (XSS) vulnerability to exploit the MySpace social networking website. Users’ web browsers were forced to send web requests that they did not expect to make. Approximately one million users unwittingly altered their profile web
page with malicious JavaScript code when they visited other infected profiles.
Samy altered his MySpace profile web page to include some crafty JavaScript exploit code. When another MySpace user visited Samy’s
profile, the JavaScript code would execute its payload in the user’s browser. At this point, Samy had complete control over the user’s browser. The payload forced the user to automatically befriend Samy, and also add him as a hero (“Samy is my hero” was appended to each profile page). To propagate site-wide, the exploit code would copy itself to the user’s profile and wait to exploit other unsuspecting users. To halt the infection, MySpace was forced to shutdown its website for twenty hours. While the incident was severe, the payload of the Samy worm was relatively benign. It would have been trivial for Samy to force everyone to delete their profile and blog data, resulting in a far more damaging situation for users and for MySpace.

::LAB 4: Modern Cryptography(extended version)

The word cryptography comes from the Greek words kryptos meaning hidden and graphein meaning writing. Cryptography is the study of hidden writing, or the science of encrypting and decrypting text and messages.
::RSA::
In cryptography, RSA (which stands for Rivest, Shamir and Adleman who first publicly described it; see below) is an algorithm for public-key cryptography. It is the first algorithm known to be suitable for signing as well as encryption, and one of the first great advances in public key cryptography. RSA is widely used in electronic commerce protocols, and is believed to be secure given sufficiently long keys and the use of up-to-date implementations.

Operation

The RSA algorithm involves three steps: key generation, encryption and decryption.

Key generation

RSA involves a public key and a private key. The public key can be known to everyone and is used for encrypting messages. Messages encrypted with the public key can only be decrypted using the private key. The keys for the RSA algorithm are generated the following way:

Choose two distinct prime numbers p and q.
- For security purposes, the integers $p$ and $q$ should be chosen uniformly at random and should be of similar bit-length. Prime integers can be efficiently found using a Primality test.
Compute n = pq.
- $n$ is used as the modulus for both the public and private keys
Compute the totient: $\varphi(pq) = (p-1)(q-1)\,$ .
Choose an integer e such that e and share no divisors other than 1 (i.e. e and are coprime).
- $e$ is released as the public key exponent.
- Choosing e having a short addition chain results in more efficient encryption. Small public exponents (such as e=3) could potentially lead to greater security risks.^[2]
Determine d (using modular arithmetic) which satisfies the congruence relation .
- Stated differently, $e d - 1$ can be evenly divided by the totient $(p - 1)(q - 1)$ .
- This is often computed using the Extended Euclidean Algorithm.
- $d$ is kept as the private key exponent.

The public key consists of the modulus $n$ and the public (or encryption) exponent $e$ . The private key consists of the modulus $n$ and the private (or decryption) exponent $d$ which must be kept secret.

Notes on some variants:

PKCS#1 v2.0 and PKCS#1 v2.1 specifies using $\lambda(n) = {\rm lcm}(p-1, q-1) \,$ , where lcm is the least common multiple instead of $\varphi(pq) = (p-1)(q-1) \,$ .
For efficiency the following values may be precomputed and stored as part of the private key:
- $p$ and $q$ : the primes from the key generation,
- $d\mod (p - 1)$ and $d\mod(q - 1)$ ,
- $q^{-1} \mod(p)$ .

Encryption

Alice transmits her public key $(n, e)$ to Bob and keeps the private key secret. Bob then wishes to send message M to Alice.

He first turns M into an integer $0 < m < n$ by using an agreed-upon reversible protocol known as a padding scheme. He then computes the ciphertext $c$ corresponding to:

$c \equiv m^e \pmod{n}.$

This can be done quickly using the method of exponentiation by squaring. Bob then transmits $c$ to Alice.

Decryption

Alice can recover $m$ from $c$ by using her private key exponent $d$ by the following computation:

$m \equiv c^d \pmod{n}.$

Given $m$ , she can recover the original message M by reversing the padding scheme.

The above decryption procedure works because:

$c^d \equiv (m^e)^d \equiv m^{ed}\pmod{n}$ .

Now, since $ed = 1 + k\varphi(n)$ ,

$m^{ed} \equiv m^{1 + k\varphi(n)} \equiv m (m^{\varphi(n)})^{k} \equiv m \pmod{n}$ .

The last congruence directly follows from Euler's theorem when $m$ is relatively prime to $n$ . Using the Chinese remainder theorem, it can be shown that the equations holds for all $m$ .

This shows that we get the original message back:

$c^d \equiv m \pmod{n}.$

A working example

Here is an example of RSA encryption and decryption. The parameters used here are artificially small, but one can also use OpenSSL to generate and examine a real keypair.

Choose two prime numbers
$p = 61$ and $q = 53$
Compute $n = p q$
$n=61\cdot53=3233$
Compute the totient $\varphi(p,q) = (p-1)(q-1) \,$
$\varphi(p,q) = (61 - 1)(53 - 1) = 3120\,$
Choose $e > 1$ coprime to 3120
$e = 17$
Compute $d$ such that $d e \equiv 1\pmod{\varphi(p,q)}\,$ e.g., by computing the modular multiplicative inverse of $e$ modulo $\varphi(p,q)\,$ :
$d = 2753$
since 17 · 2753 = 46801 and mod (46801,3120) = 1 this is the correct answer.
(iterating finds (15 times 3120)+1 divided by 17 is 2753, an integer, whereas other values in place of 15 do not produce an integer)

The public key is ( $n = 3233$ , $e = 17$ ). For a padded message $m$ the encryption function is:

$c = m^e\mod {n} = m^{17} \mod {3233}.$

The private key is ( $n = 3233$ , $d = 2753$ ). The decryption function is:

$m = c^d\mod {n} = c^{2753} \mod {3233}.$

For example, to encrypt $m = 123$ , we calculate

$c = 123^{17}\mod {3233} = 855.$

To decrypt $c = 855$ , we calculate

$m = 855^{2753}\mod {3233} = 123$ .

Both of these calculations can be computed efficiently using the square-and-multiply algorithm for modular exponentiation. In real life situations the primes selected would be much larger, however in our example it would be relatively trivial to factor $n$ , 3233, obtained from the freely available public key back to the primes $p$ and $q$ . Given $e$ , also from the public key, we could then compute $d$ and so acquire the private key.

Padding schemes

When used in practice, RSA is generally combined with some padding scheme. The goal of the padding scheme is to prevent a number of attacks that potentially work against RSA without padding:

When encrypting with low encryption exponents (e.g., $e = 3$ ) and small values of the $m$ , (i.e. $m < n 1 / e$ ) the result of $m e$ is strictly less than the modulus $n$ . In this case, ciphertexts can be easily decrypted by taking the $e$ th root of the ciphertext over the integers.
If the same clear text message is sent to $e$ or more recipients in an encrypted way, and the receivers share the same exponent $e$ , but different $p$ , $q$ , and $n$ , then it is easy to decrypt the original clear text message via the Chinese remainder theorem. Johan Håstad noticed that this attack is possible even if the cleartexts are not equal, but the attacker knows a linear relation between them.^[3] This attack was later improved by Don Coppersmith.^[4]
Because RSA encryption is a deterministic encryption algorithm – i.e., has no random component – an attacker can successfully launch a chosen plaintext attack against the cryptosystem, by encrypting likely plaintexts under the public key and test if they are equal to the ciphertext. A cryptosystem is called semantically secure if an attacker cannot distinguish two encryptions from each other even if the attacker knows (or has chosen) the corresponding plaintexts. As described above, RSA without padding is not semantically secure.
RSA has the property that the product of two ciphertexts is equal to the encryption of the product of the respective plaintexts. That is $m_1^em_2^e\equiv (m_1m_2)^e\pmod{n}.$ Because of this multiplicative property a chosen-ciphertext attack is possible. E.g. an attacker, who wants to know the decryption of a ciphertext $c = m e mod n$ may ask the holder of the private key to decrypt an unsuspicious-looking ciphertext $c' = c r e mod n$ for some value $r$ chosen by the attacker. Because of the multiplicative property $c'$ is the encryption of $m r mod n$ . Hence, if the attacker is successful with the attack, he will learn $m r mod n$ from which he can derive the message m by multiplying $m r$ with the modular inverse of $r$ modulo $n$ .

To avoid these problems, practical RSA implementations typically embed some form of structured, randomized padding into the value $m$ before encrypting it. This padding ensures that $m$ does not fall into the range of insecure plaintexts, and that a given message, once padded, will encrypt to one of a large number of different possible ciphertexts.

Standards such as PKCS#1 have been carefully designed to securely pad messages prior to RSA encryption. Because these schemes pad the plaintext $m$ with some number of additional bits, the size of the un-padded message M must be somewhat smaller. RSA padding schemes must be carefully designed so as to prevent sophisticated attacks which may be facilitated by a predictable message structure. Early versions of the PKCS#1 standard (up to version 1.5) used a construction that turned RSA into a semantically secure encryption scheme. This version was later found vulnerable to a practical adaptive chosen ciphertext attack. Later versions of the standard include Optimal Asymmetric Encryption Padding (OAEP), which prevents these attacks. The PKCS#1 standard also incorporates processing schemes designed to provide additional security for RSA signatures, e.g, the Probabilistic Signature Scheme for RSA (RSA-PSS).

Signing messages

Suppose Alice uses Bob's public key to send him an encrypted message. In the message, she can claim to be Alice but Bob has no way of verifying that the message was actually from Alice since anyone can use Bob's public key to send him encrypted messages. So, in order to verify the origin of a message, RSA can also be used to sign a message.

Suppose Alice wishes to send a signed message to Bob. She can use her own private key to do so. She produces a hash value of the message, raises it to the power of $d mod n$ (as she does when decrypting a message), and attaches it as a "signature" to the message. When Bob receives the signed message, he uses the same hash algorithm in conjunction with Alice's public key. He raises the signature to the power of $e mod n$ (as he does when encrypting a message), and compares the resulting hash value with the message's actual hash value. If the two agree, he knows that the author of the message was in possession of Alice's private key, and that the message has not been tampered with since.

Note that secure padding schemes such as RSA-PSS are as essential for the security of message signing as they are for message encryption, and that the same key should never be used for both encryption and signing purposes.

Security and practical considerations

Integer factorization and RSA problem

The security of the RSA cryptosystem is based on two mathematical problems: the problem of factoring large numbers and the RSA problem. Full decryption of an RSA ciphertext is thought to be infeasible on the assumption that both of these problems are hard, i.e., no efficient algorithm exists for solving them. Providing security against partial decryption may require the addition of a secure padding scheme.^{[citation needed]}

The RSA problem is defined as the task of taking $e$ th roots modulo a composite $n$ : recovering a value $m$ such that $c = m e mod n$ , where $(n, e)$ is an RSA public key and $c$ is an RSA ciphertext. Currently the most promising approach to solving the RSA problem is to factor the modulus $n$ . With the ability to recover prime factors, an attacker can compute the secret exponent $d$ from a public key $(n, e)$ , then decrypt $c$ using the standard procedure. To accomplish this, an attacker factors $n$ into $p$ and $q$ , and computes $(p - 1)(q - 1)$ which allows the determination of $d$ from $e$ . No polynomial-time method for factoring large integers on a classical computer has yet been found, but it has not been proven that none exists. See integer factorization for a discussion of this problem.

As of 2008^[update], the largest (known) number factored by a general-purpose factoring algorithm was 663 bits long (see RSA-200), using a state-of-the-art distributed implementation. The next record is probably going to be a 768 bits modulus^[5]. RSA keys are typically 1024–2048 bits long. Some experts believe that 1024-bit keys may become breakable in the near term (though this is disputed); few see any way that 4096-bit keys could be broken in the foreseeable future. Therefore, it is generally presumed that RSA is secure if $n$ is sufficiently large. If $n$ is 300 bits or shorter, it can be factored in a few hours on a personal computer, using software already freely available. Keys of 512 bits have been shown to be practically breakable in 1999 when RSA-155 was factored by using several hundred computers and are now factored in a few weeks using common hardware.^[6] A theoretical hardware device named TWIRL and described by Shamir and Tromer in 2003 called into question the security of 1024 bit keys. It is currently recommended that $n$ be at least 2048 bits long.^[7]

In 1994, Peter Shor showed that a quantum computer could factor in polynomial time, breaking RSA. However, only small scale quantum computers have been realized.^{[citation needed]}

Key generation

Finding the large primes $p$ and $q$ is usually done by testing random numbers of the right size with probabilistic primality tests which quickly eliminate virtually all non-primes.

Numbers $p$ and $q$ should not be 'too close', lest the Fermat factorization for $n$ be successful, if $p - q$ , for instance is less than $2 n 1 / 4$ (which for even small 1024-bit values of $n$ is 3×10⁷⁷) solving for $p$ and $q$ is trivial. Furthermore, if either $p - 1$ or $q - 1$ has only small prime factors, $n$ can be factored quickly by Pollard's $p - 1$ algorithm, and these values of $p$ or $q$ should therefore be discarded as well.

It is important that the private key $d$ be large enough. Michael J. Wiener showed^[8] that if $p$ is between $q$ and $2 q$ (which is quite typical) and $d < n 1 / 4 / 3$ , then $d$ can be computed efficiently from $n$ and $e$ . There is no known attack against small public exponents such as $e = 3$ , provided that proper padding is used. However, when no padding is used or when the padding is improperly implemented then small public exponents have a greater risk of leading to an attack, such as for example the unpadded plaintext vulnerability listed above. 65537 is a commonly used value for $e$ . This value can be regarded as a compromise between avoiding potential small exponent attacks and still allowing efficient encryptions (or signature verification). The NIST Special Publication on Computer Security (SP 800-78 Rev 1 of August 2007) does not allow public exponents $e$ smaller than 65537, but does not state a reason for this restriction.

Speed

RSA is much slower than DES and other symmetric cryptosystems. In practice, Bob typically encrypts a secret message with a symmetric algorithm, encrypts the (comparatively short) symmetric key with RSA, and transmits both the RSA-encrypted symmetric key and the symmetrically-encrypted message to Alice.

This procedure raises additional security issues. For instance, it is of utmost importance to use a strong random number generator for the symmetric key, because otherwise Eve (an eavesdropper wanting to see what was sent) could bypass RSA by guessing the symmetric key.

Key distribution

As with all ciphers, how RSA public keys are distributed is important to security. Key distribution must be secured against a man-in-the-middle attack. Suppose Eve has some way to give Bob arbitrary keys and make him believe they belong to Alice. Suppose further that Eve can intercept transmissions between Alice and Bob. Eve sends Bob her own public key, which Bob believes to be Alice's. Eve can then intercept any ciphertext sent by Bob, decrypt it with her own private key, keep a copy of the message, encrypt the message with Alice's public key, and send the new ciphertext to Alice. In principle, neither Alice nor Bob would be able to detect Eve's presence. Defenses against such attacks are often based on digital certificates or other components of a public key infrastructure.

Timing attacks

Kocher described a new attack on RSA in 1995: if the attacker Eve knows Alice's hardware in sufficient detail and is able to measure the decryption times for several known ciphertexts, she can deduce the decryption key $d$ quickly. This attack can also be applied against the RSA signature scheme. In 2003, Boneh and Brumley demonstrated a more practical attack capable of recovering RSA factorizations over a network connection (e.g., from a Secure Socket Layer (SSL)-enabled webserver). This attack takes advantage of information leaked by the Chinese remainder theorem optimization used by many RSA implementations.

One way to thwart these attacks is to ensure that the decryption operation takes a constant amount of time for every ciphertext. However, this approach can significantly reduce performance. Instead, most RSA implementations use an alternate technique known as cryptographic blinding. RSA blinding makes use of the multiplicative property of RSA. Instead of computing $c d mod n$ , Alice first chooses a secret random value $r$ and computes $(r e c) d mod n$ . The result of this computation is $r m ~ \bmod ~n$ and so the effect of $r$ can be removed by multiplying by its inverse. A new value of $r$ is chosen for each ciphertext. With blinding applied, the decryption time is no longer correlated to the value of the input ciphertext and so the timing attack fails.

Adaptive chosen ciphertext attacks

In 1998, Daniel Bleichenbacher described the first practical adaptive chosen ciphertext attack, against RSA-encrypted messages using the PKCS #1 v1 padding scheme (a padding scheme randomizes and adds structure to an RSA-encrypted message, so it is possible to determine whether a decrypted message is valid.) Due to flaws with the PKCS #1 scheme, Bleichenbacher was able to mount a practical attack against RSA implementations of the Secure Socket Layer protocol, and to recover session keys. As a result of this work, cryptographers now recommend the use of provably secure padding schemes such as Optimal Asymmetric Encryption Padding, and RSA Laboratories has released new versions of PKCS #1 that are not vulnerable to these attacks.

Branch prediction analysis attacks

Branch prediction analysis is also called BPA. Many processors use a branch predictor to determine whether a conditional branch in the instruction flow of a program is likely to be taken or not. Usually these processors also implement simultaneous multithreading (SMT). Branch prediction analysis attacks use a spy process to discover (statistically) the private key when processed with these processors.

Simple Branch Prediction Analysis (SBPA) claims to improve BPA in a non-statistical way. In their paper, "On the Power of Simple Branch Prediction Analysis", the authors of SBPA (Onur Aciicmez and Cetin Kaya Koc) claim to have discovered 508 out of 512 bits of an RSA key in 10 iterations.

::DES::
Data Encryption Standard (DES) is a widely-used method of data encryption using a private (secret) key that was judged so difficult to break by the U.S. government that it was restricted for exportation to other countries. There are 72,000,000,000,000,000 (72 quadrillion) or more possible encryption keys that can be used. For each given message, the key is chosen at random from among this enormous number of keys. Like other private key cryptographic methods, both the sender and the receiver must know and use the same private key.

DES applies a 56-bit key to each 64-bit block of data. The process can run in several modes and involves 16 rounds or operations. Although this is considered "strong" encryption, many companies use "triple DES", which applies three keys in succession. This is not to say that a DES-encrypted message cannot be "broken." Early in 1997, Rivest-Shamir-Adleman, owners of another encryption approach, offered a $10,000 reward for breaking a DES message. A cooperative effort on the Internet of over 14,000 computer users trying out various keys finally deciphered the message, discovering the key after running through only 18 quadrillion of the 72 quadrillion possible keys! Few messages sent today with DES encryption are likely to be subject to this kind of code-breaking effort.

DES originated at IBM in 1977 and was adopted by the U.S. Department of Defense. It is specified in the ANSI X3.92 and X3.106 standards and in the Federal FIPS 46 and 81 standards. Concerned that the encryption algorithm could be used by unfriendly governments, the U.S. government has prevented export of the encryption software. However, free versions of the software are widely available on bulletin board services and Web sites. Since there is some concern that the encryption algorithm will remain relatively unbreakable, NIST has indicated DES will not be recertified as a standard and submissions for its replacement are being accepted. The next standard will be known as the Advanced Encryption Standard (AES).

::LAB 3: CLASSIC CRYPTOGRAPHY

cryptography is the study of

secret (crypto-) writing (-graphy)

concerned with developing algorithms which may be used to:
- conceal the context of some message from all except the sender and recipient (privacy or secrecy), and/or
- verify the correctness of a message to the recipient (authentication)

form the basis of many technological solutions to computer and communications security problems

Basic Concepts

cryptography: the art or science encompassing the principles and methods of transforming an intelligible message into one that is unintelligible, and then retransforming that message back to its original form
plaintext: the original intelligible message
ciphertext: the transformed message
cipher: an algorithm for transforming an intelligible message into one that is unintelligible by transposition and/or substitution methods
key: some critical information used by the cipher, known only to the sender & receiver
encipher (encode): the process of converting plaintext to ciphertext using a cipher and a key
decipher (decode): the process of converting ciphertext back into plaintext using a cipher and a key
cryptanalysis: the study of principles and methods of transforming an unintelligible message back into an intelligible message without knowledge of the key. Also called codebreaking
cryptology: both cryptography and cryptanalysis
code: an algorithm for transforming an intelligible message into an unintelligible one using a code-book

Concepts

Encryption C = E_(K)(P)

Decryption P = E_(K)^(-1)(C)

E_(K) is chosen from a family of transformations known as a cryptographic system.

The parameter that selects the individual transformation is called the key K, selected from a keyspace K

More formally a cryptographic system is a single parameter family of invertible transformations

E_(K) ; K in K : P -> C

with the inverse algorithm E_(K)^(-1) ; K in K : C -> P

such that the inverse is unique

Usually assume the cryptographic system is public, and only the key is secret information

Private-Key Encryption Algorithms

a private-key (or secret-key, or single-key) encryption algorithm is one where the sender and the recipient share a common, or closely related, key

all traditional encryption algorithms are private-key

overview of a private-key encryption system and attacker

Cryptanalytic Attacks

have several different types of attacks

ciphertext only

only have access to some enciphered messages
use statistical attacks only

known plaintext

know (or strongly suspect) some plaintext-ciphertext pairs
use this knowledge in attacking cipher

chosen plaintext

can select plaintext and obtain corresponding ciphertext
use knowledge of algorithm structure in attack

chosen plaintext-ciphertext

can select plaintext and obtain corresponding ciphertext, or select ciphertext and obtain plaintext
allows further knowledge of algorithm structure to be used

Unconditional and Computational Security

two fundamentally different ways ciphers may be secure
unconditional security
- no matter how much computer power is available, the cipher cannot be broken
computational security
- given limited computing resources (eg time needed for calculations is greater than age of universe), the cipher cannot be broken

A Brief History of Cryptography

Ancient Ciphers

have a history of at least 4000 years
ancient Egyptians enciphered some of their hieroglyphic writing on monuments

ancient Hebrews enciphered certain words in the scriptures
2000 years ago Julius Ceasar used a simple substitution cipher, now known as the Caesar cipher
Roger Bacon described several methods in 1200s
Geoffrey Chaucer included several ciphers in his works
Leon Alberti devised a cipher wheel, and described the principles of frequency analysis in the 1460s
Blaise de Vigenère published a book on cryptology in 1585, & described the polyalphabetic substitution cipher
increasing use, esp in diplomacy & war over centuries

Machine Ciphers

Jefferson cylinder, developed in 1790s, comprised 36 disks, each with a random alphabet, order of disks was key, message was set, then another row became cipher

Wheatstone disc, originally invented by Wadsworth in 1817, but developed by Wheatstone in 1860's, comprised two concentric wheels used to generate a polyalphabetic cipher

Enigma Rotor machine, one of a very important class of cipher machines, heavily used during 2nd world war, comprised a series of rotor wheels with internal cross-connections, providing a substitution using a continuosly changing alphabet

Classical Cryptographic Techniques

have two basic components of classical ciphers: substitution and transposition
in substitution ciphers letters are replaced by other letters
in transposition ciphers the letters are arranged in a different order
these ciphers may be:
monoalphabetic - only one substitution/ transposition is used, or
polyalphabetic - where several substitutions/ transpositions are used
several such ciphers may be concatentated together to form a product cipher

Caesar Cipher - a monoalphabetic cipher

replace each letter of message by a letter a fixed distance away eg use the 3rd letter on
reputedly used by Julius Caesar

eg.

	L FDPH L VDZ L FRQTXHUHG
	I CAME I SAW I CONQUERED

ie mapping is

	ABCDEFGHIJKLMNOPQRSTUVWXYZ
	DEFGHIJKLMNOPQRSTUVWXYZABC

can describe this cipher as:

Encryption E_(k) : i -> i + k mod 26

Decryption D_(k) : i -> i - k mod 26

Cryptanalysis of the Caesar Cipher

only have 26 possible ciphers
could simply try each in turn - exhaustive key search

				GDUCUGQFRMPCNJYACJCRRCPQ
				HEVDVHRGSNQDOKZBDKDSSDQR
	Plain	-	IFWEWISHTOREPLACELETTERS
				JGXFXJTIUPSFQMBDFMFUUFST
				KHYGYKUJVQTGRNCEGNGVVGTU
	Cipher -	LIZHZLVKWRUHSODFHOHWWHUV
				MJAIAMWLXSVITPEGIPIXXIVW

also can use letter frequency analysis

Single Letter              Double Letter             Triple Letter             
E                          TH                        THE                       
T                          HE                        AND                       
R                          IN                        TIO                       
N                          ER                        ATI                       
I                          RE                        FOR                       
O                          ON                        THA                       
A                          AN                        TER                       
S                          EN                        RES

Character Frequencies

in most languages letters are not equally common
in English e is by far the most common letter
have tables of single double & triple letter frequencies
these are different for different languages (see Appendix A in Seberry & Pieprzyk)

use these tables to compare with letter frequencies in ciphertext, since a monoalphabetic substitution does not change relative letter frequencies

[1] do need a moderate amount of ciphertext (100+ letters)

Modular Arithmetic monoalphabetic cipher

more generally could use a more complex equation to calculate the ciphertext letter for each plaintext letter

E_(a b) : i ->a.i + b mod 26

nb a must not divide 26 (ie gcd(a,26) = 1)

otherwise cipher is not reversible eg a=2

and a=0, b=1, c=2 ... , y=24, z=25

eg E_(5 7) : i ->5.i + 7 mod 26

Cryptanalysis:

use letter frequency counts to guess a couple of possible letter mappings
- nb frequency pattern not produced just by a shift
use these mappings to solve 2 simultaneous equations to derive above parameters

Example - Sinkov pp 34-35

Mixed Alphabets

most generally we could use an arbitrary mixed (jumbled) alphabet
each plaintext letter is given a different random ciphertext letter, hence key is 26 letters long

Plain:   ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher:  DKVQFIBJWPESCXHTMYAUOLRGZN
Plaintext:  IFWEWISHTOREPLACELETTERS
Ciphertext: WIRFRWAJUHYFTSDVFSFUUFYA

now have a total of 26! ^(~) 4 ^(x) 10^(26) keys
with so many keys, might think this is secure

!!!WRONG!!!

problem is not the number of keys, rather:

1) there is lots of statistical information in message

2) can solve the problem piece by piece

(ie can get key nearly right, and nearly get message)

(near enough MUST NOT be good enough!)

Cryptanalysis

use frequency counts to guess letter by letter
also have frequencies for digraphs & trigraphs

General Monoalphabetic

special form of mixed alphabet
use key as follows:
- write key (with repeated letters deleted)
- then write all remaining letters in columns underneath
- then read off by columns to get ciphertext equivalents

Example Seberry p66

	STARW
	BCDEF
	GHIJK
	LMNOP
	QUVXY
	Z

Plain:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher: SBGLQZTCHMUADINVREJOXWFKPY

Plaintext:  I KNOW ONLY THAT I KNOW NOTHING
Ciphertext: H UINF NIAP OCSO H UINF INOCHIT

Polyalphabetic Substitution

in general use more than one substitution alphabet
makes cryptanalysis harder since have more alphabets to guess
and because flattens frequency distribution
(since same plaintext letter gets replaced by several ciphertext letter, depending on which alphabet is used)

Vigenère Cipher

basically multiple caesar ciphers
key is multiple letters long K = k_(1) k_(2) ... k_(d)
ith letter specifies ith alphabet to use
use each alphabet in turn, repeating from start after d letters in message

Plaintext	THISPROCESSCANALSOBEEXPRESSED
Keyword		CIPHERCIPHERCIPHERCIPHERCIPHE
Plaintext	VPXZTIQKTZWTCVPSWFDMTETIGAHLH

can use a Saint-Cyr Slide for easier encryption

based on a Vigenère Tableau

   ABCDEFGHIJKLMNOPQRSTUVWXYZ

A  ABCDEFGHIJKLMNOPQRSTUVWXYZ
B  BCDEFGHIJKLMNOPQRSTUVWXYZA
C  CDEFGHIJKLMNOPQRSTUVWXYZAB
D  DEFGHIJKLMNOPQRSTUVWXYZABC
E  EFGHIJKLMNOPQRSTUVWXYZABCD
F  FGHIJKLMNOPQRSTUVWXYZABCDE
G  GHIJKLMNOPQRSTUVWXYZABCDEF
H  HIJKLMNOPQRSTUVWXYZABCDEFG
I  IJKLMNOPQRSTUVWXYZABCDEFGH
J  JKLMNOPQRSTUVWXYZABCDEFGHI
K  KLMNOPQRSTUVWXYZABCDEFGHIJ
L  LMNOPQRSTUVWXYZABCDEFGHIJK
M  MNOPQRSTUVWXYZABCDEFGHIJKL
N  NOPQRSTUVWXYZABCDEFGHIJKLM
O  OPQRSTUVWXYZABCDEFGHIJKLMN
P  PQRSTUVWXYZABCDEFGHIJKLMNO
Q  QRSTUVWXYZABCDEFGHIJKLMNOP
R  RSTUVWXYZABCDEFGHIJKLMNOPQ
S  STUVWXYZABCDEFGHIJKLMNOPQR
T  TUVWXYZABCDEFGHIJKLMNOPQRS
U  UVWXYZABCDEFGHIJKLMNOPQRST
V  VWXYZABCDEFGHIJKLMNOPQRSTU
W  WXYZABCDEFGHIJKLMNOPQRSTUV
X  XYZABCDEFGHIJKLMNOPQRSTUVW
Y  YZABCDEFGHIJKLMNOPQRSTUVWX
Z  ZABCDEFGHIJKLMNOPQRSTUVWXY

can describe this cipher as:

given K = k_(1) k_(2) ... k_(d)

then f_(i) (a) = a + k_(i) (mod n)

Beauford Cipher

similar to Vigenère but with alphabet written backwards
can be descibed by

given K = k_(1) k_(2) ... k_(d)

then f_(i) (a) = (k_(i) - a) (mod n)

and its inverse is

f_(i) ^(-1)(a) = (k_(i) - c) (mod n)

Example - Seberry p71

Key = d
Plain:   ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher:  DCBAZYXWVUTSRQPONMLKJIHGFE

Variant-Beauford Cipher

just the inverse of the Vigenère (decrypts it)

given K = k_(1) k_(2) ... k_(d)

then f_(i) (a) = a - k_(i) (mod n)

Language Redundancy & Unicity Distance

human languages are highly redundant
- eg th lrd s m shphrd shll nt wnt
Claude Shannon derived several important results about the information content of languages in 1949
entropy of a message H(X) is related to the number of bits of information needed to encode a message X [2]
- cannot exceed log_(2)n bits for n possible messages
the rate of langauge for messages of length k denotes the average number of bits in each character

D = F(H(M),k)

rate of English is about 3.2 bits/letter
distinguish information context and redundancy
Shannon defined the unicity distance of a cipher to give a quantatative measure of:
- the security of a cipher (must not be too small)
- the amount of ciphertext N needed to break it

N = F(H(K),D)

where H(K) is entropy (amount of info) of the key,

and is D the rate of the language used (eg 3.2)

for polynomial based monoalphabetic substitution ciphers have:

N = F(H(K),D) = F(log_(2)26,3.2) = 1.5

hence only need 2 letters to break

for general monoalphabetic substitution ciphers have

N = F(H(K),D) = F(log_(2)n!,D) = F(log_(2)26!,3.2) = F(26 log_(2)F(26,e),3.2) = 27.6

hence only need 27 or 28 letters to break

for polyalphabetic substitution ciphers, if have s possible keys for each simple subs, and d keys used, then

N = F(H(K),D) = F(log_(2)s^(d),D) = F(d log_(2)26,3.2) = 1.5d

hence need 1.5 times the number of separate substitutions used letters to break the cipher

but first need to determine just how many alphabets were used
- Kasiski method
- index of coincidence

Kasiski Method

use repetitions in ciphertext to give clues as to period, looking for same plaintext an exact period apart, leading to same ciphertext

Example - Seberry p71

Plaintext:   TOBEORNOTTOBE
Key:         NOWNOWNOWNOWN
Ciphertext:  GCXRCNACPGCXR

Since repeats are 9 chars apart, guess period is 3 or 9.

Index of Coincidence

Index of Coincidence (IC) was introduced in 1920s by William Friedman
measures variation of frequencies of letters in ciphertext
- period = 1 => simple subs => variation is high, IC high
- period > 1 => poly subs => variation is reduced, IC low

see Seberry Table 3.2 p72 and Table 3.3 p74

d           IC             
1           0.0660         
2           0.0520         
3           0.0473         
4           0.0450         
5           0.0436         
6           0.0427         
7           0.0420         
8           0.0415         
9           0.0411         
10          0.0408         
11          0.0405         
12          0.0403         
13          0.0402         
14          0.0400         
15          0.0399         
...         ...            
Inf         0.0380

	Table 3.3 - Period and IC for English

first define a measure of roughness (MR) giving variation of frequencies of individual characters relative to a uniform distribution

		MR = Isu(i=o,n-1,(p_(i) - F(1,n))^(2))

where p_(i) is probability an arbitrary character in ciphertext is the ith character a_(i) in the alphabet

			 Isu(i=o,n-1,p_(i)) = 1

for English letters can derive

		MR = Isu(i=o,n-1,p_(i)^(2)) - 0.038

		MR + 0.038 = Isu(i=o,n-1,p_(i)^(2))

is prob two arbitrary letters in ciphertext are the same

can compute MR for plaintext using characteristic letter frequencies

eg MR for English is 0.028 (0.066 - 0.038)

can also compute MR for a flat distribution as 0
since probabilities and period are unknown, cannot compute MR, however can estimate from ciphertext
now the number of pairs of letters that can be chosen from ciphertext of length N is

		Bbc[(S(N,2)) = F(1,2) N (N-1)

if F_(i) is the freq of the ith letter of English in the ciphertext, then the number of pairs containing just the ith letter is

		F(F_(i)(F_(i)-1),2)		and	Isu(i=o,n-1,F_(i)) = 1

now define the Index of Coincidence (IC) as the prob that two letters at random from the ciphertext are indeed the same

	IC = 	Isu(i=o,n-1,F(F_(i)(F_(i)-1),N(N-1)))

and use the IC estimate in

		MR + 0.038 = IC

since usually use IC in crypto work, expect that

		0.038 < IC < 0.066

for a cipher of period d the expected value of the IC is

		Exp(IC) = F(1,d) F(N-d,N-1)(0.066) + Bbc[(S(d-1,d))F(N,N-1)(0.038)

and we can use these values to estimate d from the ciphertext

Example program to compute IC - Seberry Fig3.4 p74

Solving Polyalphabetic Ciphers

use Kasiski method & IC to estimate period d
then separate ciphertext into d sections, and solve each as a monoalphabetic cipher

Example - Seberry pp73-77

Krypto program

this is a program to help solve simple substitution and transposition ciphers
invoke using

krypto [file]

has the following commands available

       Command                                    Meaning                           
?                       this message.                                               
!                       execute a shell command.                                    
f [ [n]]        print [the n most] frequent strings of length seqlen.       
g [ ]             print the frequency distribution graph of letters.          
i [
]                 calculate the index of coincidence of the text.             
l [ ]             list only the modified string.  [b=blklength, B=blks/line]  
p                       print current code.                                         
q                       exit.                                                       
s             substitute ch2 for ch1.                                     
S [-] -[gvbB] {keys}    Perform the substitution specified by the key.              
T [-] |key        Transpose text by perm or keyword. e.g. T 4,5,2,3,1         
t  [/regexp]         look for transpositions of period n;  [print only /regexp]. 
B [-] |key        apply the specifed rectangular encryption to the text.      
b  [/regexp]         look for block decryptions of size n;  [print only          
                       /regexp].                                                   
u                       undo previous modification.                                 
z                       reset the code to its initial state.                        
r                 enter code from file.                                       
w                 write code to file.                                         
e                       edit code.

see man entry for more details

Transposition Ciphers

transposition or permutation ciphers hide the message contents by rearranging the order of the letters

Scytale cipher

an early Greek transposition cipher
a strip of paper was wound round a staff
message written along staff in rows, then paper removed
leaving a strip of seemingly random letters

not very secure as key was width of paper & staff

For information on lots of simple substitution and permutation ciphers see:

A. Sinkov "Elementary Cryptanalysis", New Mathematical Library, Random House, 1968* other simple transposition ciphers include:

Reverse cipher

write the message backwards

Plain:	I CAME I SAW I CONQUERED
Cipher:	DEREU QNOCI WASIE MACI

Rail Fence cipher

write message with letters on alternate rows
read off cipher row by row

Plain:	I A E S W C N U R D
        C M I A I O Q E E
Cipher:	IAESW CNURD CMIAI OQEE

Geometric Figure

write message following one pattern and read out with another

Row Transposition ciphers

in general write message in a number of columns and then use some rule to read off from these columns
key could be a series of number being the order to: read off the cipher; or write in the plaintext

Plain:	THESIMPLESTPOSSIBLETRANSPOSITIONSXX
Key (R):      2 5 4 1 3	
Key (W):                           4 1 5 3 2 	

             T H E S I		S T I E H 	
             M P L E S		E M S L P 	
             T P O S S		S T S O P 	
             I B L E T		E I T L B 	
             R A N S P		S R P N A 	
             O S I T I		T O I I S 	
             O N S X X		X O X S N
Cipher:	STIEH EMSLP STSOP EITLB SRPNA TOIIS XOXSN

Example - Davies p26 Fig 2.14

or can use a word, with letter order giving sequence: to write in the plaintext; or read off the cipher

Plain:	ACONVENIENTWAYTOEXPRESSTHEPERMUTATION
Key (W):      C O M P U T E R
Key (W):      1 4 3 5 8 7 2 6
	
             A N O V I N C E
             E W T A O T N Y
             H E P R T U E M
             A O I N Z Z T Z

Cipher:       ANOVI NCEEW TAOTN YHEPR TUEMA OINZZ TZ

Example - Davies p26 Fig 2.15

key idea for row transposition ciphers is that message is in groups that have the letters reordered in each
Exercise using key sorcery (to read out) encipher:

Key(R):	sorcery => 6 3 4 1 2 5 7
laser beams can be modulated to carry more intelligence than radio waves

gives

erasb lecam snabd umole atoed ctamo ryrre elntl iicee ntgha dnria oesav w

decryption consists of:
- writing the message out in columns
- reading off the message by reordering columns
- (use T command in krypto, uses read out keys)
hint - its not a good idea to leave message in groups matching the size of your key!!!

Cryptanalysis of Row Transposition ciphers

a frequency count will show a normal language profile
hence know have letters rearranged
basic idea is to guess period, then look at all possible permutations in period, and search for common patterns (eg t command in krypto)
use lists of common pairs & triples & other features

Example - Seberry p67-8 [3]

to determine the complexity of this cipher, we can calculate its unicity distance
- given blocks of period d, there are d! keys, hence

N = F(H(K),D) = F(log_(2)d!,D) = F(d log_(2)(d/e),3.2)

Seberry Table 3.1 p69

Block (Columnar) Transposition ciphers

another group of ciphers are block (columnar) transposition ciphers where the message is written in rows, but read off by columns in order given by key (use B command in krypto)
for ease of recovery may insist matrix is filled

Key(R):       s o r c e r y        s o r c e r y
Key(R):       6 3 4 1 2 5 7        6 3 4 1 2 5 7

             l a s e r b e        l a s e r b e
             a m s c a n b        a m s c a n b
             e m o d u l a        e m o d u l a
             t e d t o c a        t e d t o c a
             r r y m o r e        r r y m o r e
             i n t e l l i        i n t e l l i
             g e n c e t h        g e n c e t h
             a n r a d i o        a n r a d i o
             w a v e s            w a v e s q r

giving ciphertext (by reading off cols 4, 5, 2, 3, 6, 1, 7)

ecdtm ecaer auool edsam merne nasso dytnr vbnlc rltiq laetr igawe baaei hor

decryption consists of:
- calculating how many rows there are (by dividing message length by key length)
- then write out message down columns in order given by key

Example - Sinkov p148

exercise - Sinkov p148 #74

Sinkov p148

Cryptanalysis of Block Transposition ciphers

again know must be a transposition, and guess is perhaps a block transposition
guess size of matrix by looking at factors of message length, and write out by columns
then look for ways of reordering pairs of columns to give common pairs or triples (very much trial & error)
(nb use b command in krypto to try possibilities)

Example - Sinkov p 149-151

Nihilist ciphers

a more complex transposition cipher using both row and column transpositions is the nihilist cipher
write message in rows in order controlled by the key (as for a row cipher)
then read off by rows, but in order controlled by the key, this time written down the side
uses a period of size the square of the key length

Plaintext:    NOWISTHETIMEFORALLGOODMEN

Key (W):             L E M O N
                    2 1 3 5 4
             L 2    O N W S I
             E 1    H T E I T
             M 3    E M F R O
             0 5    L A L O G
             N 4    D O M N E

Nihilist Cipher:     HTEIT ONWSI EMFRO DOMNE LALOG

Diagonal Cipher:     ONHET WSEML DAFII TRLOM OOGNE

Example - Davis Fig2.16 p27

attacking this cipher depends on column and row rearrangement, with much trial and error
for more complexity can vary readout algorithm
- diagonal cipher reads out on fwd diag (/) in alternate directions (up diag, down diag etc), ie a zig-zag read out

Product ciphers

can see that in general ciphers based on just substitutions or just transpositions are not secure
what about using several ciphers in order
- two substitutions are really only one more complex substitution
- two transpositions are really only one more complex transposition
- but a substitution followed by a transposition makes a new much harder cipher
product ciphers consist substitution-transposition combinations chained together
in general are far too hard to do by hand, however one famous product cipher, the 'ADFGVX' cipher was used in WW1 (see Kahn pp339-350)
instead there use had to wait for the invention of the cipher machine, particularly the rotor machines (eg Enigma, Hagalin) mentioned briefly earlier

ADFGVX Product Cipher

named since only letters ADFGVX are used
chosen since have very distinct morse codes
uses a fixed substitution table to map each plaintext letter to a letter pair (row-col index)
then uses a keyed block transposition

	
Substitution Table

\\    A     D     F     G     V     X    
A     K     Z     W     R     1     F    
D     9     B     6     C     L     5    
F     Q     7     J     P     G     X    
G     E     V     Y     3     A     N    
V     8     O     D     H     0     2    
X     U     4     I     S     T     M

	Plaintext:	PRODUCTCIPHERS
	
	Intermediate Text:
				FG AG VD VF XA DG XV
				DG XF FG VG GA AG XG

Keyed Block Columnlar Transposition Matrix

D     E     U     T     S     C     H        Key                    
2     3     7     6     5     1     4        Sorted Order           
F     G     A     G     V     D     V                               
F     X     A     D     G     X     V                               
D     G     X     F     F     G     V                               
G     G     A     A     G     X     G

	Ciphertext:	DXGX FFDG GXGG VVVG VGFG CDFA AAXA

Lab 1-introduction to vmware

This lab we learn about vmware . What is vmware?? Virtual machine software from VMware, that allows multiple copies of the same operating system or several different operating systems to run in the same x86-based machine. For years, VMware has been the leader in virtualization software.

VMware Workstation installation

This is simple step by step on how to install VMware Workstation:

1.Download VMware Workstation from http://www.vmware.com/download/ws/. Then, double click the VMware launcher to start the installation wizards.

2. Click NEXT and choose Typical setup type

3. Choose the location for VMware Workstation installation. Then, click NEXT

4. Configure the shortcuts for the VMware Workstation and click NEXT

5. Click INSTALL. This will take several minutes to finish

6. Enter the serial number for the VMware Workstation.

7. Click FINISH and restart the computer.

::Life of Security::

Wednesday, August 12, 2009

Lec 3 :: Modern Cryptography

0 comments:

::HalWa qALbU::

::Aku Milik TUHANKU..::

::SaHaBaT::

::Sepintas Lalu::

:; Sepintas Bicara ::

<< ASMA ALLAH >>

- DeMi MaSa-

-Menghitung Hari-

Blog Archive

Teman Sebicara

::LINK ::

LAB 6::SECURITY IN NETWORK.

IPSec Network Security

Description

::LAB 5: WEB APPLICATION SECURITY

::LAB 4: Modern Cryptography(extended version)

Operation

Key generation

Encryption

Decryption

A working example

Padding schemes

Signing messages

Security and practical considerations

Integer factorization and RSA problem

Key generation

Speed

Key distribution

Timing attacks

Adaptive chosen ciphertext attacks

Branch prediction analysis attacks

::LAB 3: CLASSIC CRYPTOGRAPHY

Basic Concepts

Concepts

Private-Key Encryption Algorithms

Cryptanalytic Attacks

ciphertext only

known plaintext

chosen plaintext

chosen plaintext-ciphertext

Unconditional and Computational Security

A Brief History of Cryptography

Ancient Ciphers

Machine Ciphers

Classical Cryptographic Techniques

Caesar Cipher - a monoalphabetic cipher

Cryptanalysis of the Caesar Cipher

Character Frequencies

Modular Arithmetic monoalphabetic cipher

Mixed Alphabets

General Monoalphabetic

Polyalphabetic Substitution

Vigenère Cipher

Beauford Cipher

Variant-Beauford Cipher

Language Redundancy & Unicity Distance

Kasiski Method

Index of Coincidence

Solving Polyalphabetic Ciphers

Krypto program

Transposition Ciphers

Scytale cipher

Reverse cipher

Rail Fence cipher

Geometric Figure

Row Transposition ciphers

Cryptanalysis of Row Transposition ciphers

Block (Columnar) Transposition ciphers

Cryptanalysis of Block Transposition ciphers

Nihilist ciphers

Product ciphers

ADFGVX Product Cipher

Lab 1-introduction to vmware