Encryption for IT Staff

1. Encryption for IT Staff James Leinweber WI State Lab of Hygiene & BadgIRT • Kerckhoff's second requirement (La Cryptologie militaire, 1883) • "... compromise of the system [algorithms] should not inconvenience the correspondents" Encryption for IT Staff

2. Encryption for IT Staff James Leinweber WI State Lab of Hygiene & BadgIRT • John von Neumann (1951): • "Anyone who considers arithmetical methods of producing random • digits is, of course, in a state of sin." Encryption for IT Staff

3. Encryption for IT Staff James Leinweber WI State Lab of Hygiene & BadgIRT Bruce Schneier (preface to Applied Cryptography, 1996): "There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments ..." Encryption for IT Staff

4. Encryption for IT Staff James Leinweber WI State Lab of Hygiene & BadgIRT an NSA employee, asked about DES: "Real systems are so insecure that the NSA needn't bother breaking the crypto" Encryption for IT Staff

5. Goals • Lay out some basic crypto concepts • Yes, there will be occasional formulas and details • Analyze their roles in some common protocols and applications • Roughly, the crypto architecture of the ‘Net • Become educated lay users of crypto implemented by trained professionals ™ • No, you shouldn’t try this at home :-( Encryption for IT Staff

6. Non Goals • No proofs • Hardly any history • Skipping or simplifying many implementation details • Not a tutorial on the protocols & apps • our focus is on the cryptography • We won’t become either cryptographers (designers) or cryptanalysts (breakers) Encryption for IT Staff

7. Outline • Warmup • Two cipher examples, today’s notations • 8 Cryptographic primitives • Block ciphers, public key algorithms, … • Decomposing applications and protocols • PGP, Certificates, TLS (SSL), SSH, IPSEC,… • Guidance • key lengths, snake oil, trust models, do’s and don’ts, … Encryption for IT Staff

8. Warm up Introduction and Notation Encryption for IT Staff

9. An (old) Cipher example M: I came, I saw, I conquered. C: L fdph, L vdz, L frqtxhuhg. • Start with a plaintext message (M), encrypt(via a monoalphabetic circular shift), obtaining obfuscated ciphertext(C). • Decrypt the ciphertext C back to plaintext M via the opposite shift • Very easily broken, via letter frequency statistics plus the word boundaries. Encryption for IT Staff

10. A better (Renaissance) Cipher M: blaise is much harder K: HOLSTE IN BLAI SEISMU C: izlali qf nfcp zezvql • Depends on a secret key (holstein) • Incorporates feedback (autokey) • Ciphers the same letter differently • E.g. ‘h’ becomes p,z; ‘z’ comes from l,h,r • “a” is weak – it leaks plain and key text Encryption for IT Staff

11. Notation – persons A is for Alice (sender, client) B is for Bob (receiver, server) V is for Victor (villain / eavesdropper / spy / bad guy / black hat) T is for Theresa (a trusted third party) Encryption for IT Staff

12. Notation - math p, q = large prime numbers xor = exclusive or 1 xor 1 = 0 mod = modular arithmetic 5 mod 3 = 2 ^ = exponentiation 2^(2^4) + 1 = 65537 || = string concatenation “a”||”b” = “ab” <> = vectors or lists <1,2,’sha1’> [ ] = text slice/block, { } = annotation Encryption for IT Staff

13. Notation - crypto M = plaintext message (file, packet, …) C = encrypted ciphertext of M k, k1, k2, k3 = secret symmetric keys K{As} = Alice’s private (secret) key, K{Bp} = Bob’s public key E(k,M) = encrypt plaintext M via key k Using whatever algorithm we’re working with D(k,C) = decrypt ciphertext C via key k Encryption for IT Staff

14. man in the middle attacks • Instead of Alice <-> Bob, we might have Alice <-> Victor <-> Bob • Some things Victor can do: • tell different lies to Alice than to Bob • pass their traffic, but record and analyze it • inject packets, or delete packets • change packet contents • replay packet streams • Lots of effort goes into preventing this! Encryption for IT Staff

15. A few acronyms and sources • NIST National Institute of Standards and Technologies • FIPS Federal Information Processing Standard (Available from NIST) • RFC Request For Comments Internet Engineering Task Force candidates for standards Encryption for IT Staff

16. 8 cryptographic primitives (building blocks) Part One Encryption for IT Staff

17. 1: symmetric secret key block ciphers Symmetric A enciphers and B deciphers with the same key Secret Key The security depends only on how well A and B protect their shared key. Block works on chunks of message, usually 64 or 128 bits Cipher output size of gobbledegook ~ input size of message Encryption for IT Staff

18. Block cipher design goals • Avalanche • 1 bit change in input flips 50% of output bits • Non-correlation • No input bit correlates with any output bit. No pair of input bits … No triple of input bits … • Full dependency • Each output bit depends on all input bits • Key dependent, with hardly any weak keys • No attacks easier than guessing for the key • 2^(N-1) tries, on average, to break a single N-bit key Encryption for IT Staff

19. How to make a block cipher • use multiple rounds of interleaved confusion (via substitution) and diffusion (via permutation) • Claude Shannon, c. 1945 • cryptographically strong • easy in either hardware or software • 1 byte table lookups do substitution • circular shifts with and/or/xor do permutation • key gets expanded into internal state Encryption for IT Staff

20. Some well known block ciphers • DES: Data Encryption Standard (FIPS 46-2) • 64 bit blocks, 56 bit keys, 16 S-P rounds • Unsafe: publicly brute forced 1997. Withdrawn! • CAST-128 (RFC-2144) • 64 bit blocks, 128 bit key, 16 rounds • currently a good choice for interoperability • IDEA: International Data Encryption Algorithm • 64 bit blocks, 128 bit key, 8 Rounds (patent 2007) • AES: Advanced Encryption Standard (FIPS 197) • 128 bit blocks; 3 key size / round variants: 128 bit key / 10 rounds , 192 / 12, 256 / 14 Encryption for IT Staff

21. Safe variants of DES • DESX: E(k1, M xor k2) xor k3 • k2 and k3 provide pre- and post- whitening, like unix password salt. • net strength ~ 2^120; as fast as DES • Extensively used by Microsoft in Win2K • 3DES: E(k3, D(k2, E(k1, M))) • E-D-E resists differentialattacks better than E-E-E • Often used with just two keys: k3=k1 • If k1=k2=k3, degenerates to DES • IBM bank hardware interoperated that way • net strength ~ 2^96; sluggish but oddly popular Encryption for IT Staff

22. 2: block cipher usage modes • What if our message isn’t 64 bits? • Too short: pad, ideally with random bits • Too long: chop into multiple blocks • Do we care about: • interblock feedback? • error propagation? • Military radios: yes. Computers: no. • random access? • 4-7 modes in common use • AES has 23 proposed modes (NIST SP 800-38a) Encryption for IT Staff

23. Mode ECB: Electronic Code Book • Encrypt each block independently • Simplest mode, adds no space overhead • Not good for long messages • Victor knows that identical ciphertext came from identical plaintext, which reveals message structure • Victor can conduct known text attacks to build a code book • If Victor is a man in the middle, he can fiddle whole blocks undetected Encryption for IT Staff

24. Mode CBC: Cipher Block Chaining • Start, block 0: xor a random initialization vector • Block worth of salt / whitening bits (128 bits for AES) • Unlike key, IV is not secret C[0] = E(k, M[0] xor IV) M[0] = D(k, C[0]) xor IV • Middle, blocks j: xor prior ciphertext C[j] = E(k, M[j] xor C[j-1]) M[j] = D(k, C[k]) xor C[j-1] • Last block: • online (M size unknown): adopt a padding convention • TLS: always pad, padding char = length of padding • offline (M size known): ciphertext stealing gimmick? • needs to swap the order of the last two blocks Encryption for IT Staff

25. 3: Diffie – Hellman key exchange From 1976 paper "New Directions in Cryptography" • An on-line protocol for Alice and Bob to generate a shared secret S • Widely used: SSH, TLS, IPSEC, ... • Depends on the difficulty of the discrete logarithm problem Computing z = g^w mod p is easy z = 2^4 mod 11 … z = 5 Inverse, finding w given z, g, p is hard 3 = 2^ w mod 11 … w = ? Encryption for IT Staff

26. Diffie-Hellman details 1. start: large prime p, generator g 1 < g < p. These can be public, and can be reused. 2. Alice: pick x, send A = g^x mod p picks a random x, computes A, sends <A,p,g> to Bob. X is secret, Message <A,p,g> is unencrypted. 3. Bob: pick y, send B = g^y mod p picks a random y, computes B , sends B to Alice. Y is also secret, B is again unencrypted. 4. Both: compute S = g ^ (x*y) mod p Alice: S=B^x mod p. Bob: S=A^y mod p. • Victor, eavesdropping on p,g,A,B, can’t find S Encryption for IT Staff

27. 4: Public Key: proposed Diffie & Hellman also analyzed the possibilities of asymmetric cryptosystems • Alice would use one key to encrypt, Bob would use a different key to decrypt. • Allows offline key exchange, and digital signature protocols • Needs a one way trapdoor function • Something easy to compute but hard to invert, unless you possess an extra secret Encryption for IT Staff

28. Public Key: realized • A flurry of candidates for one way trapdoor functions were proposed. Three survive: • Factoring, discrete logarithms, elliptic curves • It’s all number theory: modular exponentiation in finite fields and groups • But: they are all slow and weak • 1000x slower than block ciphers, or worse • Solutions much faster than key guessing exist • significantly vulnerable to known text attacks Encryption for IT Staff

29. Public key: RSA (factoring) • Choose p, q large random primes. Let N=p*q • p and q are 350-2000 bits (10^155-10^600) • Choose e relatively prime to (p-1)*(q-1) • e can be reused; 65537 is popular. • Compute d = 1/e mod (p-1)*(q-1) • Private key is <d>, public key is <N,e> • Alice discards p,q, or keeps them secret with d • Encrypt: C = M^e mod N • Decrypt: M = C^d mod N Encryption for IT Staff

30. Pubkey: ElGamal (discrete log) • choose large random prime p, and random g, x both less than p. Let y = g^x mod p. • private key is x; public key is <p,g,y> • encrypt: • choose new, previously unused random k, relatively prime to p-1. • let a = g^k mod p, b = ((y^k) * M) mod p. • Ciphertext: C = <a, b> • decrypt: M = b/(a^x) mod p Encryption for IT Staff

31. Pubkey: Elliptic curves • Elliptic curve cryptography is based on the integer solutions to equations of the form: Y^2 = X^3 +a*X + b (coefficients a and b are from a finite field) • The trapdoor problem is scalar multiplication, g = s * f, for curves f,g • Not yet widely used; details omitted. • Appeal is much shorter key sizes Encryption for IT Staff

32. 5: cryptographic hash functions • Also known as message digest algorithms • E.g. MD5, SHA-1, Haval, RIPEM-160, … • Design goals: • fast, fixed size output, one-way (exponential work to invert), strongly collision free, avalanche property, … • NB: CRC32 flunks all the crypto properties • Used for: identifying blob contents • messages, files, packets, PGP keys, digital certificates, … Encryption for IT Staff

33. Two popular hashes • MD5: 128 bits (RFC 1321) • Derived from the RC4 stream cipher. • Don’t use it in new apps • SHA1: 160 bits (FIPS 180-1) • An NSA tweak of SHA, a stronger cousin of MD5 • Currently a good choice • hash size should be 2x block cipher key size. • due to a birthday attack, some breaks of an N-bit hash function average only 2^(N/2) operations • Yes, NIST will have longer ones to accompany AES. Encryption for IT Staff

34. 6: HMAC • Keyed hash based message authentication code (RFC 2104) • detects various man-in-the-middle attacks • Uses a shared secret key k, a hash algorithm H (twice), and special constants ipad, opad. • HMAC(k,H,M) = H((k xor opad) || H((k xor ipad) || M)) • Example from a TLS 1.0 packet: • HMAC(write_key, sha1, record_seq_no || C) • An alternative: last block from CBC-mode cipher Encryption for IT Staff

35. 7: Digital Signature Algorithms • Goal: validate Alice’s message to Bob • Authenticate sender • Prevent tampering • May provide non-repudiation • Tactic: encipher a message hash H via a public key algorithm. H=SHA1 is popular. • RSA example: (PGP, rfc2437, PKCS#1, X9.31) • Alice: send SIG = E(K{As}, H(M)) • Bob: compare H(M) =? D(K{Ap}, SIG) Encryption for IT Staff

36. NIST DSA, slide 1 of 3: signing • Alice: create secret key x, public key <p,q,g,y> • p 512-1024 bit prime, q 160 bit prime factor of p-1 • Choose a random large x for secret key, with x < q • g = f^((p-1)/q) mod p, with f < p-1 such that g > 1 • y = g^x mod p • Using SHA-1 as H(), compute signature <r,s> • choose random k < q • Let r = (g^k mod p) mod q, s = ((H(M) + x*r)/k) mod q Encryption for IT Staff

37. NIST DSA, 2 of 3: verifying Bob: Receive message M with signature <r,s> obtain public DSA key of Alice: <p,q,g,y> Compute: w = 1/s mod qu1 = (H(M) * w) mod q, u2 = (r*w) mod qv = ((g^u1 * y^u2) mod p) mod q If v=r, then Alice’s signature of M is valid Encryption for IT Staff

38. NIST DSA, 3 of 3: comments • DSA annoyances • 1024 bit p / 160 bit q will soon be too small • Bob is doing more work than Alice • See FIPS 186-2 “Digital Signature Standard” (DSS) for 3 choices: • DSA (discrete logs) (FIPS 186) • X9.31 (an RSA variant) (FIPS 186-1) • Elliptic curves (FIPS 186-2) Encryption for IT Staff

39. 8: cryptographic pseudorandom number generating functions • We need good choices for p,q,k,x,y,IV,... • Design goals: • can't invert, can't deduce seed, can't predict runs, no bit correlations, no weak seeds, … • you must seed it with real entropy • best: disk spindle speed jitter, thermal noise • tolerable: I/O latencies (keyboard, mouse, …) • unacceptable: time of day || process id Encryption for IT Staff

40. A good CPRNG is very important • linear congruential is not a CPRNG Y = a * X + b mod N • often the weakest link in a cryptosystem! • guessing Bell Labs passwords on a pdp-11 • Netscape 2 doing SSLv2 • PGP 6 doing DH/DSS on NT4 prior to sp4 • numerous CERT advisories: • weak TCP sequence numbers and DNS packet ID's • PkZip archives with 3+ files? • Next version has real crypto from RSA, Inc. Encryption for IT Staff

41. Summary: crypto primitives • 5 basic primitives • Symmetric secret key block ciphers (DESX, AES, …) • Diffie-Hellman key exchange • Public key encryption (RSA, ElGamal, Elliptic) • Hash functions (MD5, SHA1, …) • Cryptographic psuedo random number generators • 3 more things we built from those: • Block cipher usage modes: ECB, CBC, … • HMAC (from hash + key + usage) • Digital signatures (from hash + public key) Encryption for IT Staff

42. Decomposing Applications and Protocols Part two Encryption for IT Staff

43. Signed, encrypted e-mail: PGP Alice sending e-mail M to Bob, with Bcc to self • Choose a signing algorithm (RSA) and private/public key pair (<K{As}, K{Ap}>), a block cipher (IDEA), a hash algorithm (SHA1), and a compression algorithm (ZLIB) • Seed CPRNG with entropy • Set up block cipher. Generate: • a random 128 bit session key k • a random 64 bit initialization vector IV Encryption for IT Staff

44. PGP e-mail: Alice to Bob (2 of 7) • Compute signature: hash message, encrypt (RSA) with Alice’s private key: SIG =E{rsa}(K{As}, SHA1(M)) • Compress and encrypt M C = E{idea-cbc}(k, IV, zlib(M)) • Encrypt the session key with each recipients (Bob, Alice), RSA public key: E{rsa}(K{Bp}, k) E{rsa}(K{Ap}, k) Encryption for IT Staff

45. PGP e-mail: Alice to Bob (3 of 7) • Assemble a multipart nested message: < <E(K{Bp}, k), E(K{Ap}, k)>, <‘idea’, IV, ‘zlib’, C>, <'rsa', H(K{Ap}), ‘sha1’, SIG > > • ascii-encode the result, e-mail it, and archive it. Encryption for IT Staff

46. PGP e-mail 4: Bob receiving • Bob locates his copy of the session key, decrypts it with his private RSA key: k = D{rsa}(K{Bs}, ...) • Bob decrypts ciphertext, decompresses it M = Expand( D{idea-cbc}(k, IV, C) ) • Bob checks the signature, using the hash algorithm and Alice’s public key K{Ap}: SHA1(M) =? D{rsa}(K{Ap}, SIG) Encryption for IT Staff

47. PGP mail 5: primitive roles • Block cipher in CBC mode • Strong and fast: protects the message • CPRNG • session key, initialization vector, padding, … • Hash functions • Identification of message and key packets • Public key algorithms • distribute session key, sign message hash Encryption for IT Staff

48. PGP mail 6: crypto remarks • Compressing plaintext improves strength • 100% of standards are naïve about signing • Signing cryptotext invites repudiation issues and is subject to Anderson’s attack. Don’t do it. • Signing plaintext really needs an IV for strength and a signed recipient name to detect forwarding • Public keys are slow, weak, and long-lived • So our public keys are muchlonger than our one time use block cipher session keys • We only use public keys on small, random things: session keys, message hashes Encryption for IT Staff

49. PGP: v4 keys • Our example used v3 RSA Legacy keys • A single RSA key pair is used for both encryption and signing • Symmetric cipher is always IDEA • Newfangled version 4 keys are better: • separate encryption and signing key pairs • Rubber hose decryption attack: court order • Can use RSA/RSA or Elgamal/DSA (called DH/DSS) • Can use other block ciphers: CAST, 3DES, AES, … Encryption for IT Staff

50. Digital Envelopes : reprise • Tweak our our PGP example: • put Alice’s key into a digital certificate • make Bob the file system recovery agent • let the message M be a disk file • Choose DESX as the block cipher • We'd be very near to Microsoft’s Encrypting File System • Recent service packs add AES cipher Encryption for IT Staff