MAC. SKE in Practice. Lecture 5

(1)

MAC.

SKE in Practice.

Lecture 5

(2)

Active Adversary

(3)

Active Adversary

An active adversary can inject messages into the channel

(4)

Active Adversary

An active adversary can inject messages into the channel Eve can send ciphertexts to Bob and get them decrypted

(5)

Active Adversary

Chosen Ciphertext Attack (CCA)

(6)

Active Adversary

If Bob decrypts all ciphertexts for Eve, no security possible

(7)

Active Adversary

If Bob decrypts all ciphertexts for Eve, no security possible

What can Bob do?

(8)

SIM-CCA secure if:

∀

∃ s.t.

∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL

IDEAL

Replay Filter

SIM-CCA Security

Symmetric-Key Encryption

REAL ≈_IDEAL RECALL

(9)

SIM-CCA secure if:

∀

∃ s.t.

∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL

IDEAL

Replay Filter

SIM-CCA Security

Symmetric-Key Encryption

Invalid ciphertexts are silently ignored

(10)

SIM-CCA secure if:

∀

∃ s.t.

∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL

IDEAL

Replay Filter

SIM-CCA Security

Symmetric-Key Encryption

(11)

SIM-CCA secure if:

∀

∃ s.t.

∀

Key/Enc Key/Dec

Env

Send Recv

Env REAL

IDEAL

Replay Filter

SIM-CCA Security

Symmetric-Key Encryption

Alternately (slightly weaker form): Adv can send its own messages

(12)

Experiment picks b←{0,1} and K←KeyGen

For as long as Adversary wants

Adv sends two messages m0, m1 to the experiment

Expt returns Enc(mb,K) to the adversary

Adversary returns a guess b’

Experiments outputs 1 iff b’=b

IND-CCA secure if for all feasible adversaries Pr[b’=b] ≈ 1/2

b

Key/Enc

b←{0,1}

b’=b?

m0,m1

mb

b’

Yes/No

Adv gets (guarded) access to DecK oracle ^Enc(m^b^,K)

Key/Dec

No challenge ciphertext

answered

IND-CCA Security

Symmetric-Key Encryption

~correctness ^{IND-CCA +} equivalent to

SIM-CCA RECALL

(13)

Experiment picks b←{0,1} and K←KeyGen

For as long as Adversary wants

Adv sends two messages m0, m1 to the experiment

Expt returns Enc(mb,K) to the adversary

Adversary returns a guess b’

Experiments outputs 1 iff b’=b

IND-CCA secure if for all feasible adversaries Pr[b’=b] ≈ 1/2

b

Key/Enc

b←{0,1}

b’=b?

m0,m1

mb

b’

Yes/No

Adv gets (guarded) access to DecK oracle ^Enc(m^b^,K)

Key/Dec

No challenge ciphertext

answered

IND-CCA Security

Symmetric-Key Encryption

~correctness ^{IND-CCA +} equivalent to

SIM-CCA RECALL

Weaker

(14)

CCA Security

(15)

CCA Security

How to obtain CCA security?

(16)

CCA Security

Use a CPA-secure encryption scheme, but make sure Bob

“accepts” and decrypts only ciphertexts produced by Alice

(17)

CCA Security

“accepts” and decrypts only ciphertexts produced by Alice i.e., Eve can’t create new ciphertexts that will be

accepted by Bob

(18)

CCA Security

accepted by Bob

Achieves the stronger guarantee: in IDEAL, Eve can’t send its own messages to Bob

(19)

CCA Security

accepted by Bob

CCA secure SKE reduces to the problem of CPA secure SKE and (shared key) message authentication

(20)

CCA Security

accepted by Bob

CCA secure SKE reduces to the problem of CPA secure SKE and (shared key) message authentication

MAC: Message Authentication Code

(21)

Message Authentication

Codes

(22)

Message Authentication Codes

A single short key shared by Alice and Bob

(23)

Message Authentication Codes

A single short key shared by Alice and Bob Can sign any (polynomial) number of messages

(24)

Message Authentication Codes

A triple (KeyGen, MAC, Verify)

MACK VerK

(25)

Message Authentication Codes

Correctness: For all K from KeyGen, and all messages M, VerifyK(M,MACK(M))=1

MACK VerK

(26)

Message Authentication Codes

Correctness: For all K from KeyGen, and all messages M, VerifyK(M,MACK(M))=1

Security: probability that an adversary can produce (M,s) s.t. VerifyK(M,s)=1 is negligible unless Alice produced an output s=MACK(M)

Mi

si = MACK(Mi)

(M,s)

VerK(M,s)

Advantage

= Pr[ VerK(M,s)=1 and (M,s) ∉ {(Mi,si)} ]

MACK VerK

(27)

CCA Secure SKE

(28)

CCA Secure SKE

CCA-EncK1,K2(m) = ( c:= CPA-EncK1(m), t:= MACK2(c) )

(29)

CCA Secure SKE

CPA secure encryption: Block-cipher/CTR mode construction

(30)

CCA Secure SKE

CPA secure encryption: Block-cipher/CTR mode construction MAC: from a PRF or Block-Cipher (coming up)

(31)

CCA Secure SKE

SKE in practice can just use Block-Ciphers (coming up)

(32)

CCA Secure SKE

SKE in practice can just use Block-Ciphers (coming up)

In principle, constructions (less efﬁcient) possible based on any One-Way Permutation or even any One-Way Function

(33)

Making a MAC

(34)

One-time MAC

MAC Ver

(35)

To sign a single n bit message

One-time MAC

MAC Ver

(36)

To sign a single n bit message A simple (but inefﬁcient) scheme

One-time MAC

MAC Ver

(37)

Shared secret key: 2n random 

strings (each k-bit long) (rⁱ0,rⁱ1)i=1..n

r r r

One-time MAC

MAC Ver

(38)

r r r

One-time MAC

010

MAC Ver

(39)

Signature for m1...mn be (rⁱmi)i=1..n

r r r

One-time MAC

r¹0 r²1 r³0

010

MAC Ver

(40)

Negligible probability that Eve can produce  a signature on m’≠m

r r r

One-time MAC

r¹0 r²1 r³0

010

MAC Ver

(41)

Doesn’t require any computational restrictions on adversary!

r r r

One-time MAC

r¹0 r²1 r³0

010

MAC Ver

(42)

Doesn’t require any computational restrictions on adversary!

More efﬁcient one-time MACs exist (later)

r r r

One-time MAC

r¹0 r²1 r³0

010

MAC Ver

(43)

(Multi-msg) MAC from PRF

When Each Message is a Single Block

(44)

(Multi-msg) MAC from PRF

PRF is a MAC!

When Each Message is a Single Block

(45)

(Multi-msg) MAC from PRF

PRF is a MAC!

MACK(M) := FK(M) where F is a PRF

When Each Message is a Single Block

(46)

(Multi-msg) MAC from PRF

PRF is a MAC!

MACK(M) := FK(M) where F is a PRF

When Each Message is a Single Block

FK

M FK(M)

(47)

(Multi-msg) MAC from PRF

PRF is a MAC!

MACK(M) := FK(M) where F is a PRF VerK(M,S) := 1 iff S=FK(M)

When Each Message is a Single Block

FK

M FK(M)

(48)

(Multi-msg) MAC from PRF

PRF is a MAC!

Output length of FK should be big enough

When Each Message is a Single Block

FK

M FK(M)

(49)

(Multi-msg) MAC from PRF

PRF is a MAC!

If an adversary forges MAC with probability εMAC, then can break PRF with advantage O(εMAC — 2^-m(k)) (m(k) being the output length of the PRF) [How?]

When Each Message is a Single Block

FK

M FK(M)

(50)

(Multi-msg) MAC from PRF

PRF is a MAC!

When Each Message is a Single Block

FK

M FK(M)

Advantage in

breaking a PRF F: diff in prob a test has of

outputting 1, when given F vs. truly

random R

(51)

(Multi-msg) MAC from PRF

PRF is a MAC!

If random function R used as MAC, then probability of forgery, εMAC* = 2^-m(k)

When Each Message is a Single Block

FK

M FK(M)

Advantage in

breaking a PRF F: diff in prob a test has of

outputting 1, when given F vs. truly

random R

(52)

MAC for

Multiple-Block Messages

(53)

MAC for Multiple-Block Messages

What if message is longer than one block?

(54)

MAC for Multiple-Block Messages

MAC’ing each block separately is not secure (unlike in the case of CPA secure encryption)

(55)

MAC for Multiple-Block Messages

Eve can rearrange the blocks/drop some blocks

(56)

MAC for Multiple-Block Messages

Eve can rearrange the blocks/drop some blocks Could use a PRF that takes longer inputs

(57)

MAC for Multiple-Block Messages

Eve can rearrange the blocks/drop some blocks Could use a PRF that takes longer inputs

Can we use a PRF with a ﬁxed block-length (i.e., a block cipher)?

(58)

MAC for

Multiple-Block Messages

(59)

MAC for Multiple-Block Messages

A simple solution: “tie the blocks together”

(60)

MAC for Multiple-Block Messages

Add to each block a random string r (same r for all blocks), total number of blocks, and a sequence number

(61)

MAC for Multiple-Block Messages

Bi = (r, t, i, Mi)

(62)

MAC for Multiple-Block Messages

Bi = (r, t, i, Mi)

MAC(M) = (r, (MAC(Bi))i=1..t)

(63)

MAC for Multiple-Block Messages

Bi = (r, t, i, Mi)

r prevents mixing blocks from two messages, t prevents dropping blocks and i prevents rearranging

(64)

MAC for Multiple-Block Messages

Bi = (r, t, i, Mi)

r prevents mixing blocks from two messages, t prevents dropping blocks and i prevents rearranging

Inefﬁcient! Tag length increases with message length

(65)

CBC-MAC

(66)

CBC-MAC

PRF domain extension: Chaining the blocks

(67)

CBC-MAC

m1 m2 mt

FK FK FK

⊕ ⊕

T

...

(68)

CBC-MAC

cf. CBC mode for encryption (which is not a MAC!)

m1 m2 mt

FK FK FK

⊕ ⊕

T

...

(69)

CBC-MAC

t-block messages, a single block tag

m1 m2 mt

FK FK FK

⊕ ⊕

T

...

(70)

CBC-MAC

t-block messages, a single block tag Can be shown to be secure

m1 m2 mt

FK FK FK

⊕ ⊕

T

...

(71)

CBC-MAC

If restricted to t-block messages (i.e., same length)

m1 m2 mt

FK FK FK

⊕ ⊕

T

...

(72)

CBC-MAC

If restricted to t-block messages (i.e., same length) Else attacks possible (by extending a previously

signed message)

m1 m2 mt

FK FK FK

⊕ ⊕

T

...

(73)

Patching CBC-MAC

(74)

Patching CBC-MAC

Patching CBC MAC to handle message of any (polynomial) length but still producing a single block tag (secure if block-cipher is):

(75)

Patching CBC-MAC

Derive K as FK’(t), where t is the number of blocks

(76)

Patching CBC-MAC

Derive K as FK’(t), where t is the number of blocks Use ﬁrst block to specify number of blocks

(77)

Patching CBC-MAC

Important that ﬁrst block is used: if last block, message extension attacks still possible

(78)

Patching CBC-MAC

EMAC: Output not the last tag T, but FK’(T), where K’ is an independent key (after padding the message to an integral number of blocks). No need to know message length a priori.

(79)

Patching CBC-MAC

CMAC: XOR last block with another key (derived from the original key using the block-cipher). Avoids padding when message is integral number of blocks.

(80)

Patching CBC-MAC

CMAC: XOR last block with another key (derived from the original key using the block-cipher). Avoids padding when message is integral number of blocks. NIST Recommendation. 2005

(81)

Patching CBC-MAC

CMAC: XOR last block with another key (derived from the original key using the block-cipher). Avoids padding when message is integral number of blocks.

Later: Hash-based HMAC used in TLS and IPSec

NIST Recommendation. 2005 IETF Standard. 1997

(82)

SKE in Practice

(83)

Stream Ciphers

(84)

Stream Ciphers

Used for one-time encryption

(85)

Stream Ciphers

Used for one-time encryption RC4, eSTREAM portfolio, ...

(86)

Stream Ciphers

In practice, stream ciphers take a key and an “IV” (for initialization vector) as inputs

(87)

Stream Ciphers

Also used to

denote the random nonce chosen for encryption using a block-cipher

(88)

Stream Ciphers

Heuristic goal: behave somewhat like a PRF (instead of a PRG) so that it can be used for multi-message encryption

Also used to

(89)

Stream Ciphers

Heuristic goal: behave somewhat like a PRF (instead of a PRG) so that it can be used for multi-message encryption But often breaks if used this way

Also used to

(90)

Stream Ciphers

Heuristic goal: behave somewhat like a PRF (instead of a PRG) so that it can be used for multi-message encryption But often breaks if used this way

NIST Standard: For multi-message encryption, use a block- cipher in CTR mode

Also used to

(91)

Block Ciphers

(92)

Block Ciphers

DES, 3DES, Blowﬁsh, AES, ...

(93)

Block Ciphers

Heuristic constructions

(94)

Block Ciphers

Permutations that can be inverted with the key

(95)

Block Ciphers

Permutations that can be inverted with the key Speed (hardware/software) is of the essence

(96)

Block Ciphers

Permutations that can be inverted with the key Speed (hardware/software) is of the essence But should withstand known attacks

(97)

Block Ciphers

Permutations that can be inverted with the key Speed (hardware/software) is of the essence But should withstand known attacks

As a PRP (or at least, against key recovery)

(98)

Feistel Network

(99)

Feistel Network

Building a permutation from a (block) function

(100)

Feistel Network

Building a permutation from a (block) function Let f: {0,1}^m → {0,1}^m be an arbitrary function

(101)

Feistel Network

f

1

＋

Ff: {0,1}^2m→{0,1}^2mdeﬁned as Ff(x,y) = ( y, x⊕f(y) )

(102)

Feistel Network

f

1

＋

Ff: {0,1}^2m→{0,1}^2mdeﬁned as Ff(x,y) = ( y, x⊕f(y) ) Ff is a permutation (Why?)

(103)

Feistel Network

f

1

＋

Can invert (How?)

(104)

Feistel Network

f

1

＋

Can invert (How?)

Given functions f1,...,ft can build a t-layer Feistel network Ff1...ft

(105)

f

2

＋

Feistel Network

f

1

＋

Can invert (How?)

1

(106)

f

2

＋

Feistel Network

f

1

＋

Can invert (How?)

Still a permutation from {0,1}^2m to {0,1}^2m

1

(107)

f

2

＋

Feistel Network

f

1

＋

Can invert (How?)

Luby-Rackoff: A 3-layer Feistel network, in which 3 PRFs with independent seeds are the 3 round

functions, is a PRP. A 4-layer Feistel gives a strong PRP

1

(108)

f

2

＋

Feistel Network

f

1

＋

Can invert (How?)

Luby-Rackoff: A 3-layer Feistel network, in which 3 PRFs with independent seeds are the 3 round

functions, is a PRP. A 4-layer Feistel gives a strong PRP

Fewer layers do not sufﬁce! [Exercise]

1

(109)

DES Block Cipher

(110)

DES Block Cipher

Data Encryption Standard (DES), Triple-DES, DES-X

NIST Standard. 1976

(111)

DES Block Cipher

DES uses a 16-layer Feistel network (and a few other steps)

NIST Standard. 1976

(112)

DES Block Cipher

DES uses a 16-layer Feistel network (and a few other steps) The round functions are not PRFs, but ad hoc

NIST Standard. 1976

(113)

DES Block Cipher

“Confuse and diffuse”

NIST Standard. 1976

(114)

DES Block Cipher

Deﬁned for ﬁxed key/block lengths (56 bits and 64 bits);

key is used to generate subkeys for round functions

NIST Standard. 1976

(115)

DES Block Cipher

key is used to generate subkeys for round functions DES’s key length too short

NIST Standard. 1976

(116)

DES Block Cipher

Can now mount brute force key-recovery attacks (e.g. using $10K hardware, running for under a week, in 2006; now, in under a

day)

NIST Standard. 1976

(117)

DES Block Cipher

day)

DES-X: extra keys to pad input and output

NIST Standard. 1976

(118)

DES Block Cipher

day)

DES-X: extra keys to pad input and output

Triple DES: 3 successive applications of DES (or DES^-1) with 3 keys

NIST Standard. 1976

(119)

AES Block Cipher

(120)

AES Block Cipher

Advanced Encryption Standard (AES)

NIST Standard. 2001

(121)

AES Block Cipher

AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits)

NIST Standard. 2001

(122)

AES Block Cipher

AES-128, AES-192, AES-256 (3 key sizes; block size = 128 bits) Very efﬁcient in software implementations (unlike DES)

NIST Standard. 2001

(123)

AES Block Cipher

Uses “Substitute-and-Permute” instead of Feistel networks

NIST Standard. 2001

(124)

AES Block Cipher

Uses “Substitute-and-Permute” instead of Feistel networks Has some algebraic structure

NIST Standard. 2001

(125)

AES Block Cipher

Operations in a vector space over the ﬁeld GF(2⁸)

NIST Standard. 2001

(126)

AES Block Cipher

Operations in a vector space over the ﬁeld GF(2⁸) The algebraic structure may lead to “attacks”?

NIST Standard. 2001

(127)

AES Block Cipher

Some implementations may lead to side-channel attacks (e.g.

cache-timing attacks)

NIST Standard. 2001

(128)

AES Block Cipher

Some implementations may lead to side-channel attacks (e.g.

cache-timing attacks)

No “simple” hardness assumption known to imply any sort of security for AES

NIST Standard. 2001

(129)

By Jeff Moser (http://www.moserware.com/2009/09/stick-ﬁgure-guide-to-advanced.html)

(130)

Cryptanalysis

(131)

Cryptanalysis

Attacking stream ciphers and block ciphers

(132)

Cryptanalysis

Attacking stream ciphers and block ciphers Typically for key recovery

(133)

Cryptanalysis

Brute force cryptanalysis, using specialized hardware

(134)

Cryptanalysis

Brute force cryptanalysis, using specialized hardware e.g. Attack on DES in 1998

(135)

Cryptanalysis

Several other analytical techniques to speed up attacks

(136)

Cryptanalysis

Sometimes “theoretical”: on weakened (“reduced round”) constructions, showing improvement over brute-force attack

(137)

Cryptanalysis

Sometimes “theoretical”: on weakened (“reduced round”) constructions, showing improvement over brute-force attack Meet-in-the-middle, linear cryptanalysis, differential

cryptanalysis, impossible differential cryptanalysis,

boomerang attack, integral cryptanalysis, cube attack, ...

(138)

Authenticated Encryption

(139)

Authenticated Encryption

Doing encryption + authentication better

(140)

Authenticated Encryption

Doing encryption + authentication better Generic composition: encrypt, then MAC

(141)

Authenticated Encryption

Doing encryption + authentication better Generic composition: encrypt, then MAC Needs two keys and two passes

(142)

Authenticated Encryption

AE aims to do this more efﬁciently

(143)

Authenticated Encryption

Several constructions based on block-ciphers (modes of operation) provably secure modeling block-cipher as PRP

(144)

Authenticated Encryption

One pass: IAPM, OCB, ... [patented]

(145)

Authenticated Encryption

Two pass: CCM, GCM, SIV, ... [included in NIST standards]

(146)

Authenticated Encryption

Two pass: CCM, GCM, SIV, ... [included in NIST standards]

AE with Associated Data: Allows unencrypted (but

authenticated) parts of the plaintext, for headers etc.

(147)

SKE today

(148)

SKE today

SKE in IPsec, TLS etc. mainly based on AES block-ciphers

(149)

SKE today

SKE in IPsec, TLS etc. mainly based on AES block-ciphers AES-128, AES-192, AES-256

(150)

SKE today

Recommended: AES Counter-mode + CMAC (or HMAC)

(151)

SKE today

Recommended: AES Counter-mode + CMAC (or HMAC) Gives CCA security, and provides authentication

(152)

SKE today

Older components/modes still in use

(153)

SKE today

Supported by many standards for legacy purposes

(154)

SKE today

Supported by many standards for legacy purposes In many applications (sometimes with modiﬁcations)

(155)

SKE today

Supported by many standards for legacy purposes In many applications (sometimes with modiﬁcations)

e.g. RC4 in BitTorrent, Skype, PDF