Modelling and Analysing of Security Protocol: Lecture 2 Cryptology for Protocols Analysis

1. Modelling and Analysing of Security Protocol: Lecture 2Cryptology for Protocols Analysis Tom Chothia CWI

2. Today • You just saw: • Simple notation for protocols • Modelling “rules” • Needham-Schroeder and Kerberos protocols • Now: • The different uses of encryption • Symmetric key encryption, public key encryptions and signing • Abstract equation for modelling encryption

3. Encryption • Encryption has many uses in security protocol: not just hiding information. • A high level “equational” view of cryptography is best for analysis protocol.

4. Caesar Cipher • One of the first codes was used by Julius Caesar. • The Caesar Cipher replaces each letter of the alphabet with one three to the right, i.e. • a becomes d, • b becomes e, • .... • z becomes c.

5. ROT13 • The Caesar Cipher is in use today as ROT13, which rotates the letters 13 places. • It is used to make information hard to read i.e., • “What happens in the last Harry Potter book? Urezvbar qvrf ng gur raq.” • New Paradigm Resources Group mistakenly used it to encrypt their e-books worth $3000.

6. Using a Key • These ciphers are easy to break because as soon as you know the scheme you can decrypt the message. • Modern encryption schemes use a “key”. • The scheme is public but it produces different results for each key.

7. Using a Key • For instance we can use the Caesar cipher rotating “n” rotations. • But only 26 possible keys so you can just try them all (breaking the cipher is 26 times harder without the key). • A better scheme replaces each letter with an other letter. Here there are 26! ≈ 4 x 1026

8. Frequency analysis • While hard to break by brute force, replacing each letter with another is each to break using frequency analysis. • Frequency analysis counts the number of times each symbol occurs and tries to draw conclusions.

9. Frequency Analysis picture for wikipedia GNU

10. The Enigma Machine • Encryption got serious in the run up to World War 2. • The Enigma Machine is better demonstrated than described.

11. Block Ciphers • Modern ciphers work on blocks of plain text, not just a single symbol. • They are made up of a series of permutations and substitutions repeated on each block. • The key controls the exact nature of the permutations and substitutions.

12. Advanced Encryption Standard ( AES ) • AES is a state-of-the-art block cipher. • It works on blocks of 128-bits. • It generates 10 round keys from a single 128-bit key. • It uses one permutation: ShiftRows and three substitutions SubBytes, MixColumns, AddRoundKey.

13. Modulo Arithmetic • Arithmetic modulo “n” means that you count up to “n” then loop back to 0 • i.e., 0,1,2,...,n,0,1,2,...,n,0,1,2,... • a mod b = r for largest whole number k such that a = b.k + r • e.g. 9 mod 4 = 1 because 9 = 2.4 +1

14. SubBytes a0,0 a0,1 a0,2 a0,3 b0,0 b0,1 b0,2 b0,3 • The “SubByte” is a fixed substitution based on matrix multiplication, one byte at a type. a1,2 b1,2 a1,0 a1,1 a1,3 b1,0 b1,1 b1,2 b1,3 a2,0 a2,1 a2,2 a2,3 b2,0 b2,1 b2,2 b2,3 a3,0 a3,1 a3,2 a3,3 b3,0 b3,1 b3,2 b3,3

15. ShiftRows no change a0,0 a0,1 a0,2 a0,3 a0,0 b0,0 b0,1 a0,1 a0,2 b0,2 a0,3 b0,3 • “ShiftRows” moves the • 2nd row one byte to the left, • the 3rd row two bytes • and the 4th row 3 bytes. 1 to the left a1,0 a1,1 a1,2 a1,3 b1,0 a1,1 a1,2 b1,1 b1,2 a1,3 b1,3 a1,0 2 to the left a2,0 a2,1 a2,2 a2,3 b2,0 a2,2 a2,3 b2,1 a2,0 b2,2 b2,3 a2,1 3 to the left a3,0 a3,1 a3,2 a3,3 a3,3 b3,0 b3,1 a3,0 a3,1 b3,2 a3,2 b3,3

16. b0,2 a0,2 b1,2 a1,2 b2,2 a2,2 a3,2 b3,2 MixColumn a0,0 a0,1 a0,3 b0,0 b0,1 b0,2 b0,3 • “MixColumn” is a substitution of each column such that: (a0.x3 +a1.x2 + a2.x+ a3) x (a0.x3+a1.x2+a2.x+a3) mod (x4+1) = ( b0.x3 + b1.x2 + b2.x+ b3 ) a1,0 a1,1 a1,3 b1,0 b1,1 b1,2 b1,3 a2,0 a2,1 a2,3 b2,0 b2,1 b2,2 b2,3 a3,0 a3,1 a3,3 b3,0 b3,1 b3,2 b3,3

17. AddRoundKey a0,0 a0,1 a0,2 a0,3 b0,0 b0,1 b0,2 b0,3 • “AddRoundKey” xor’s the block with the 128-bit round key (which was generated from the main key). • bi,j = ai,j xor ki,j a1,0 a1,1 a1,2 a1,3 xor with key b1,0 b1,1 b1,2 b1,3 a2,0 a2,1 a2,2 a2,3 b2,0 b2,1 b2,2 b2,3 a3,0 a3,1 a3,2 a3,3 b3,0 b3,1 b3,2 b3,3

18. AES • AES encrypts data by first generating the round keys from the main key • Then 9 rounds of: • SubBytes • ShiftRows • MixColumns • AddRoundKey • Finally: • SubBytes • ShiftRows • AddRoundKey

19. Equations • Including the details of AES in our model would make it impossible to work with so we assume that the encryption scheme just works. • When analysing protocols we need a formal way of writing down how it works. • We use constructor and destructor functions. • Constructor build up data structures. • Destructor functions break down data structures that are build with the constructors.

20. Equations • For example we can mode AES encryption with two functions: encrypt(m,k) decrypt(m,k) • The constructor function “encrypt(m,k)” is the same as writing { m }k. • The destructor function “decrypt(m,k)” can return the data m if the keys match: decrypt( encrypt(m,k), k ) = m

21. Probabilistic Encryption • These equations tell us that you cannot find “m” without the key “k” but: encrypt(m,k) = encrypt(m’,k’) iff m=m’ /\ k=k’ • Probabilistic encryption schemes use random elements to make every encryption different. • We model this with: { m }k means encrypt(m,r,k) for random r decrypt( encrypt(m,r,k), k ) = m

22. The Key Problem • These encryption schemes work well. AES is effectively unbreakable with a “long enough key”. • The problem is how do you get the key in the first place?

23. Public Key Encryption • Public key encryption helps (but doesn’t solve) this problem. • The idea of public key encryption is that you have two keys: • one for encryption • and another for decryption. • The encryption key is made public, the decryption key is always secret.

24. RSA • RSA is the most popular public key cipher. • It uses two large primes p & q. We set n = p.q and o(n) = (p-1)(q-1) • And we pick random • e such that 1 ≤ e ≤ o(n) and e and o(n) are co-prime. • d such that d.e mod o(n) = 1 The public key is (e,n) and the private key is (d,n)

25. RSA • To encrypt a message, turn it into numbers “m” that are less than “n” • The encrypt as cipher text c do: c = me mod n • To decrypt a cipher text c as a message m do: m = cd mod n

26. Public Key Equations • We can formulate this using the functions: • pub(sk) • encrypt(m,sk) • decrypt(m,pk) decrypt( encrypt (m, pub(sk)), sk) = m This tells us everything we need to know about public key encryption for checking protocols.

27. Public Key Equations • Another formulation could be: • pub(seed) pri(seed) • encrypt(m,sk) • decrypt(m,pk) decrypt( encrypt (m, pub(seed) ), pri(seed) ) = m decrypt( encrypt (m, pri(seed) ), pub(seed) ) = m Now you cannot learn the public key from the private key and either key can decrypt the other.

28. Signatures Encrypting with a private key can work as signing. Anyone that has my public key can check that it was me that signed a message. Treating encryption and signing in the same way can lead to confusion, so authentication is handled separately, using the functions “auth”, “sign”, “pub” and “value”: • auth ( sign (m, k) , pub(k) ) = m • message ( sign(m, k) ) = m

29. Secure Hash • A hash is a short “unique” code generated from a message. It is very hard to find a message with the same hash as another message. • We model this with a singe function hash(m). • hash(m) = hash(m’) iff m = m’ • So given “m” and a hash “h” we can test is “hash(m) = h”

30. The Uses of Encryption • Keep data secret • Only the holders of the key can read the encrypted data 2) Authentication • The encrypted message must have come from someone who had the key. 3) Binding: • The attacker cannot break up an encrypted message

31. The Uses of Encryption in Kerberos • A S : A,B,NA • S A : {KAB,B,L,NA}KAS,{KAB,A,L}KBS • A B : {A,TA}KAB,{KAB,A,L}KBS • B A : {TA+1 }KAB • Keeping data secret: encryption keeps KAB secret from an outside observer.

32. The Uses of Encryption in Kerberos • A S : A,B,NA • S A : {KAB,B,L,NA}KAS, {KAB,A,L}KBS • A B : {A,TA}KAB, {KAB,A,L}KBS • B A : {TA+1 }KAB • Authentication: encryption with the key KBS lets B know that the message came from S

33. The Uses of Encryption in Kerberos • A S : A,B,NA • S A : {KAB,B,L,NA}KAS, {KAB,A,L}KBS • A B : {A,TA}KAB, {KAB,A,L}KBS • B A : {TA+1 }KAB • Binding: encryption bind the key KAB to the nonce NA therefore A knows that KAB is fresh.

34. Encryption: Conclusion • We assume encryption always works but we still need to know some details e.g. • Does the same message encrypted twice look the same both times? • Simple equations are good at doing this. You should keep them in mind when designing / analysing protocol. • It is very, very important to know exactly why encryption is used.

35. Next Time • Different types of attacks on protocols • The goals a protocol might have. • Good design principles.