Cryptology CS588: Principles and Applications
Menu
Course Introduction
Why you should or shouldnt take this course Course Logistics: details on Syllabus
Lecture 1: Introduction
With a magnetic card and his dog Buddy's name as a password, President Clinton e-signed a bill Friday that will make electronic signatures as real as those on paper. FoxNews, 30 June 2000
CS588: Cryptology University of Virginia Computer Science
Introduction to Cryptology
Terminology A simple substitution cipher Brief history of 4000 years of Cryptology Send registration email by noon Friday.
David Evans
http://www.cs.virginia.edu/~evans
29 Aug 2001
University of Virginia CS 588
2
Resources
David Evans (call me Dave), [e-mail]
Office Hours (236A): Tuesdays, 10:30-11:30am; Weds after class Research: code safety, static analysis, programming and reasoning about swarms
Why you should take this course? Reason #1: Fate of Humanity
Cryptology plays a central role in human history. More than anything else, survival of humanity depends on computer security.
3 29 Aug 2001 University of Virginia CS 588 4
TAs:
Danny Loffredo, [e-mail] CS Reading Room: Tuesdays, 3:30-4:30 Anthony Wood, [e-mail] TBA
Web: http://www.cs.virginia.edu/cs588
29 Aug 2001 University of Virginia CS 588
1
Why you should take this course? Reason #2: Intellectual
Cryptology is about making and solving puzzles. Purest form of intellectual endeavor.
Why you should take this course? Reason #3: Be like Tom
Mr. Jefferson would have wanted you to.
29 Aug 2001
University of Virginia CS 588
5
29 Aug 2001
University of Virginia CS 588
6
Bad reasons to take this class
You want to write the ultimate destructive virus. You want to break into (UVAs | the CIAs | your banks) computer systems.
How to get an A in CS551
Problem Sets (40-50%) 4 throughout term (1st is due 10 Sept) Project (30-50%) Teams of 1 4 Can involve design/implementation Can involve survey/analysis Exams (30-50%) Midterm, Final Class Contribution (0-10%)
29 Aug 2001
University of Virginia CS 588
7
29 Aug 2001
University of Virginia CS 588
8
2
Easy ways to get an A in CS551
Break into my grades file (on my home computer) and change your grade to Haha
Physical attacks on my house, car or office are NOT eligible! (And NOT encouraged!) Dont try to break into UVAs grade records:
Too easy (probably only worth a B, or C- for social engineering attack) Honor code violation
Bonus Points / Demerits
(100 points = 1 problem set)
+100 Posting in RISKS +(varies) Solving a challenge problem -100 -200 -1000 -100000
29 Aug 2001
Discover a security flaw important enough to get reported in the New York Times Factor RSA-300 =
2769315567803442139028689061647233092237608363983953254005036722809375824714 9473946190060218756255124317186573105075074546238828817121274630072161346956 4396741836389979086904304472476001839015983033451909174663464663867829125664 459895575157178816900228792711267471958357574416714366499722090015674047 29 Aug 2001 University of Virginia CS 588 9
Send me a virus Get arrested for computer attack Get convicted for computer attack I get arrested for something you do
University of Virginia CS 588 10
Challenge Problems
Open until solved or last day of class Usually only first satisfactory answer gets bonus
Better, later answer might still get bonus
Decrypting the Honor Code
Learn from your fellow students they are your best resource! Write down who you discussed assignments with, all external sources you used Dont use answers from last years class Be honest you know what cheating is and isnt Dont pledge your assignments, but let me know if you plan to cheat
29 Aug 2001 University of Virginia CS 588 12
Solve in groups, each member gets
n / n * value (e.g., 2 people = 2 / 2 = 0.7) First challenge problem starts tomorrow: Jefferson wheel cryptogram (see course web page)
29 Aug 2001 University of Virginia CS 588 11
3
What is cryptology?
Logistics Questions?
Greek: krypto = hide Cryptology science of hiding
= cryptography + cryptanalysis + steganography
Cryptography secret writing Cryptanalysis analyzing (breaking) secrets
Cryptanalysis is what attacker does Decipher or Decryption is what legitimate receiver does
Kryptonite breaking ciphers all night?
29 Aug 2001 University of Virginia CS 588 13 29 Aug 2001 University of Virginia CS 588 14
Cryptology and Security
Cryptology is a branch of mathematics. Security is about people.
Alice
Terminology
Insecure Channel Plaintext Encrypt Ciphertext Decrypt Plaintext
Eve C = E(P) P = D(C) E must be invertible
University of Virginia CS 588
Bob
29 Aug 2001
University of Virginia CS 588
15
29 Aug 2001
16
4
Kerckhoffs Principle
Cryptography always involves:
Transformation Secret
Alice and Bob
Plaintext Encrypt KE Alice Ciphertext Decrypt KD Plaintext
Security should depend only on the key Dont assume enemy wont know algorithm
Can capture machines, disassemble programs, etc. Too expensive to invent new algorithm if it might have been compromised
Security through obscurity isnt
Look at history of examples Better to have scrutiny by open experts
The enemy knows the system being used. Claude Shannon 29 Aug 2001 University of Virginia CS 588 17
Bob C = E(KE, P) = EKE (P) P = D(KD, C) = D KD (C) If KE = KD it is symmetric encryption If KE KD it is asymmetric encryption
University of Virginia CS 588 18
29 Aug 2001
Substitution Cipher
C = EK(p) Ci = K[pi] Key is alphabet mapping:
a J, b L, ...
Monoalphabetic Cipher
XBW HGQW XS ACFPSUWG FWPGWXF CF AWWKZV CDQGJCDWA CD BHYJD DJXHGW; WUWD XBW ZWJFX PHGCSHF YCDA CF GSHFWA LV XBW KGSYCFW SI FBJGCDQ RDSOZWAQW OCXBBWZA IGSY SXBWGF.
Suppose attacker knows algorithm but not key, how many keys to try? 26!
If every person on earth tried one per second, it would take 5B years.
29 Aug 2001 University of Virginia CS 588 19
29 Aug 2001
University of Virginia CS 588
20
5
Frequency Analysis
XBW HGQW XS ACFPSUWG FWPGWXF CF AWWKZV CDQGJCDWA CD BHYJD DJXHGW; WUWD XBW ZWJFX PHGCSHF YCDA CF GSHFWA LV XBW KGSYCFW SI FBJGCDQ RDSOZWAQW OCXBBWZA IGSY SXBWGF. W: 20 C: 11 F: 11 G: 11
29 Aug 2001
Pattern Analysis
XBe HGQe XS ACFPSUeG FePGeXF CF AeeKZV CDQGJCDeA BHYJD CD DJXHGe; eUeD XBe ZeJFX PHGCSHF YCDA CF GSHFeA LV XBe KGSYCFe SI FBJGCDQ RDSOZeAQe OCXBBeZA IGSY SXBeGF. XBe = the Most common trigrams in English: the = 6.4% and = 3.4%
21 29 Aug 2001 University of Virginia CS 588 22
Normal English: e 12% t 9% a 8%
University of Virginia CS 588
Guessing
the HGQe tS ACFPSUeG FePGetF CF AeeKZV CDQGJCDeA CD hHYJD DJtHGe; eUeD the ZeJFt PHGCSHF YCDA CF GSHFeA LV the KGSYCFe SI FhJGCDQ RDSOZeAQe OCthheZA IGSY StheGF.
Guessing
the HGQe to ACFPoUeG FePGetF CF AeeKZV CDQGJCDeA CD hHYJD DJtHGe; eUeD the ZeJFt PHGCoHF YCDA CF GoHFeA LV the KGoYCFe oI FhJGCDQ RDoOZeAQe OCthheZA IGoY otheGF. otheGF = others
S = o
29 Aug 2001
University of Virginia CS 588
23
29 Aug 2001
University of Virginia CS 588
24
6
Guessing
the HrQe to ACsPoUer sePrets Cs AeeKZV CDQrJCDeA CD hHYJD DJtHre; eUeD the ZeJst PHrCoHs YCDA Cs roHseA LV the KroYCse oI shJrCDQ RDoOZeAQe OCthheZA IroY others. sePrets = secrets
Guessing
the HrQe to ACscoUer secrets Cs AeeKZV CDQrJCDeA CD hHYJD DJtHre; eUeD the ZeJst cHrCoHs YCDA Cs roHseA LV the KroYCse oI shJrCDQ RDoOZeAQe OCthheZA IroY others. ACscoUer = discover
29 Aug 2001
University of Virginia CS 588
25
29 Aug 2001
University of Virginia CS 588
26
Guessing
the HrQe to discover secrets is deeKZV iDQrJiDed iD hHYJD DJtHre; eveD the ZeJst cHrioHs YiDd is roHsed LV the KroYise oI shJriDQ RDoOZedQe OithheZd IroY others.
Monoalphabetic Cipher
The urge to discover secrets is deeply ingrained in human nature; even the least curious mind is roused by the promise of sharing knowledge withheld from others. - John Chadwick, The Decipherment of Linear B
27 29 Aug 2001 University of Virginia CS 588 28
29 Aug 2001
University of Virginia CS 588
7
Why was it so easy?
Doesnt hide statistical properties of plaintext Doesnt hide relationships in plaintext (EE cannot match dg) English (and all natural languages) are very redundant: about 1.3 bits of information per letter
Compress English with gzip about 1:6
29 Aug 2001 University of Virginia CS 588 29
How to make it harder?
Cosmetic Hide statistical properties:
Encrypt e with 12 different symbols, t with 9 different symbols, etc. Add nulls, remove spaces
Polyalphbetic cipher
Use different substitutions
Transposition
Scramble order of letters
29 Aug 2001 University of Virginia CS 588 30
Types of Attacks
Ciphertext-only - How much Ciphertext? Known Plaintext - often Guessed Plaintext Chosen Plaintext (get ciphertext)
Not as uncommon as it sounds!
Really Brief History First 4000 years
Vigenre
Chosen Ciphertext (get plaintext) Not recommended in CS588 Dumpster Diving Social Engineering Rubber-hose cryptanalysis
Cryptanalyst uses threats, blackmail, torture, bribery to get the key.
Babbage breaks Vigenre; Kasiski (1863) publishes
Cryptographers
monoalphabetics Alberti first polyalphabetic cipher
Cryptanalysts
al-Kindi - frequency analysis 3000BC 900 1460 1854
29 Aug 2001
University of Virginia CS 588
31
29 Aug 2001
University of Virginia CS 588
32
8
Really Brief History - last 100 years
Mauborgne one-time pad Quantum Crypto ? Linear, Differential Cryptanalysis Feistel block cipher, DES Enigma adds rotors, stops repeated key Turings loop attacks, Colossus Public-Key 1978
Themes
Arms race between cryptographers and cryptanalysts
But, often disconnect between two (e.g., Mary Queen of Scots uses monoalphabetic cipher long after known breakable)
Cryptanalysts
Rejewski repeated message-key attack
Motivated by war (more recently: commerce) Driven by advances in technology, mathematics Multi-disciplinary field
Linguists, classicists, mathematicians, computer scientists, physicists
Mechanical ciphers - Enigma
Cryptographers
1854
1918
1939
1945
1973
1895 Invention of Radio
29 Aug 2001 University of Virginia CS 588 33
Secrecy often means advances rediscovered and miscredited
29 Aug 2001 University of Virginia CS 588 34
Security vs. Pragmatics
Trade-off between security and effort
one-time pad: perfect security, but requires distribution and secrecy of long key DES: short key, fast algorithm, but breakable quantum cryptography: perfect security, guaranteed secrecy of key, slow, requires expensive hardware
Perfectly Secure Cipher: One-Time Pad
Mauborgne/Vernam [1917] XOR ():
0 0 a a a 0 = 0 1 0 = 1 1 = 1 1 1 = 0 a=0 0=a b b=a
Dont spend $10M to protect $1M. Dont protect $1B with encryption that can be broken for $1M.
29 Aug 2001 University of Virginia CS 588 35
E(P, K) = P K D(C, K) = C K = (P K) K = P
29 Aug 2001 University of Virginia CS 588 36
9
Why perfectly secure?
For any given ciphertext, all plaintexts are equally possible. Ciphertext: 0100111110101 Key1: 1100000100110 Plaintext1: 1000111010011 = CS Key2: 1100010100110 Plaintext2: 1000101010011 = BS More formal proof next time
29 Aug 2001 University of Virginia CS 588 37
Go to the beach?
Cannot reuse K
What if receiver has
C1 = P1 K and C2 = P2 K
C1 C2 = P1 K P 2 K = P1 P 2
Need to generate truly random bit sequence as long as all messages Need to securely distribute key
29 Aug 2001 University of Virginia CS 588 38
One-Time Pads in Practice
Lorenz Machine Nazi high command in WWII
Pad generated by 12 rotors Receiver and sender set up rotors in same positions One operator retransmitted a message (but abbreviated message header the second time!) Enough for Bletchley Park to figure out key and structure of machine that generated it! But still had to try all configurations
29 Aug 2001 University of Virginia CS 588 39
Colossus First Programmable Computer
Bletchley Park, 1944 Read ciphertext and Lorenz wheel patterns from tapes Tried each alignment, calculated correlation with German Decoded messages (63M letters by 10 Colossus machines) that enabled Allies to know German troop locations to plan D-Day Destroyed in 1960, kept secret until 1970s
29 Aug 2001 University of Virginia CS 588 40
10
Charge
Send me your registration survey by noon tomorrow Start thinking about projects and teams Subscribe to comp.risks and Cryptogram (instructions on manifest) Next time:
Proving Ciphers are Perfect (in Theory) Information Theory
29 Aug 2001 University of Virginia CS 588 41
11