Cryptography - 4.pptx 1st compli. B
- 1. Cryptography An Introduction Continued… Shon Harris CISSP, 5th Edition
- 2. 3.7 Symmetric Algorithms Block and Stream Ciphers The two main types of symmetric algorithms are block ciphers, which work on blocks of bits, and stream ciphers, which work on one bit at a time.
- 3. 3.7.1 Block Ciphers • When a block cipher is used for encryption and decryption purposes, the message is divided into blocks of bits • These blocks are then put through mathematical functions, one block at a time Suppose you need to encrypt a message you are sending to your friend and you are using a block cipher that uses 64 bits. Your message of 640 bits is chopped up into 10 individual blocks of 64 bits.
- 4. Each block is put through a succession of mathematical formulas, and what you end up with is 10 blocks of encrypted text You send this encrypted message to your friend. He has to have the same block cipher and key, and those 10 ciphertext blocks go back through the algorithm in the reverse sequence and end up in your plaintext message.
- 6. A strong cipher contains the right level of two main attributes: confusion and diffusion. Confusion is commonly carried out through substitution, while diffusion is carried out by using transposition.
- 7. The randomness of the key values and the complexity of the mathematical functions dictate the level of confusion and diffusion involved. For a cipher to be considered strong, it must contain both of these attributes, to ensure that reverse-engineering is basically impossible.
- 8. Confusion and Diffusion Example Suppose I have 500 wooden blocks with individual letters written on them. I line them all up to spell out a paragraph (plaintext). Then I substitute 300 of them with another set of 300 blocks (confusion through substitution). Then I scramble all of these blocks up (diffusion through transposition) and leave them in a pile. For you to figure out my original message, you would have to substitute the correct blocks and then put them back in the right order.
- 9. Confusion • Confusion pertains to making the relationship between the key and resulting ciphertext as complex as possible so the key cannot be uncovered from the ciphertext • Each ciphertext value should depend upon several parts of the key, but this mapping between the key values and the ciphertext values should seem completely random to the observer.
- 10. Diffusion • Diffusion (transposition) means that a single plaintext bit has influence over several of the ciphertext bits • Changing a plaintext value should change many ciphertext values, not just one In fact, in a strong block cipher, if one plaintext bit is changed, it will change every ciphertext bit with the probability of 50 percent. This means that if one plaintext bit changes, then about half of the ciphertext bits will change.
- 11. Example Of A Block Cipher • Block ciphers use diffusion and confusion in their methods. The Figure shows a conceptual example of a simplistic block cipher. • It has four block inputs, and each block is made up of four bits •The block algorithm has two layers of four-bit substitution boxes called S-boxes. •Each S-box contains a lookup table used by the algorithm as instructions on how the bits should be encrypted
- 12. A message is divided into blocks of bits, and substitution and transposition functions are performed on those blocks
- 13. S-Boxes • The Figure shows that the key dictates what S- boxes are to be used when scrambling the original message from readable plaintext to encrypted non-readable cipher text • Each S-box contains the different substitution methods that can be performed on each block. This example is simplistic—most block ciphers work with blocks of 32, 64, or 128 bits in size, and many more S-boxes are usually involved
- 14. 3.7.2 Stream Ciphers • As stated earlier, a block cipher performs mathematical functions on blocks of bits. • A stream cipher, on the other hand, does not divide a message into blocks • Instead, a stream cipher treats the message as a stream of bits and performs mathematical functions on each bit individually.
- 15. • When using a stream cipher, a plaintext bit will be transformed into a different ciphertext bit each time it is encrypted • Stream ciphers use keystream generators, which produce a stream of bits that is XORed with the plaintext bits to produce ciphertext, as shown in the Figure
- 16. With stream ciphers, the bits generated by the keystream generator are XORed with the bits of the plaintext message. Stream Cipher Diagram
- 17. Similarity With One-time Pad This process is very similar to the one-time pad explained earlier. The individual bits in the one-time pad are used to encrypt the individual bits of the message through the XOR function, and in a stream algorithm the individual bits created by the keystream generator are used to encrypt the bits of the message through XOR also.
- 18. Function Of Key In Stream Ciphers If the cryptosystem were only dependent upon the symmetric stream algorithm, an attacker could get a copy of the plaintext and the resulting ciphertext, XOR them together, and find the keystream to use in decrypting other messages. So the smart people decided to stick a key into the mix.
- 19. In block ciphers, it is the key that determines what functions are applied to the plaintext and in what order. The key provides the randomness of the encryption process. As stated earlier, most encryption algorithms are public, so people know how they work. The secret ingredient is the key. In stream ciphers, the key also provides randomness, so that the stream of bits that is XORed to the plaintext is as random as possible.
- 20. Both the sending and receiving ends must have the same key to generate the same keystream for proper encryption and decryption purposes. Function Of Key In Stream Ciphers
- 21. Initialization Vectors • Initialization vectors (IVs) are random values that are used with algorithms to ensure patterns are not created during the encryption process. • They are used with keys and do not need to be encrypted when being sent to the destination.
- 22. Initialization Vectors If IVs are not used, then two identical plaintext values that are encrypted with the same key will create the same ciphertext. Providing attackers with these types of patterns can make their job easier in breaking the encryption method and uncovering the key.
- 23. “IV” Example For example, if we have the plaintext value of “See Spot run” two times within our message, we need to make sure that even though there is a pattern in the plaintext message, a pattern in the resulting ciphertext will not be created So the IV and key are both used by the algorithm to provide more randomness to the encryption process
- 24. Characteristics Of Strong Stream Ciphers • Long periods of no repeating patterns within keystream values – Bits generated by the keystream must be random • Statistically unpredictable keystream – The bits generated from the keystream generator cannot be predicted • A keystream not linearly related to the key – If someone figures out the keystream values, that does not mean she now knows the key value • Statistically unbiased keystream (as many 0’s as 1’s) – There should be no dominance in the number of 0’s or 1’s in the keystream
- 25. Stream & Block Cipher Implementation • Stream ciphers require a lot of randomness and encrypt individual bits at a time • This requires more processing power than block ciphers require, which is why stream ciphers are better suited to be implemented at the hardware level • Because block ciphers do not require as much processing power, they can be easily implemented at the software level
- 26. Stream Ciphers Vs. One-time Pads Stream ciphers were developed to provide the same type of protection one-time pads do, which is why they work in such a similar manner. In reality, stream ciphers cannot provide the level of protection one-time pads do, but because stream ciphers are implemented through software and automated means, they are much more practical.
- 27. 3.7.3 Hybrid Encryption Systems Up to this point, we have figured out that symmetric algorithms are fast but have some drawbacks (lack of scalability, difficult key management, and they provide only confidentiality). Asymmetric algorithms do not have these drawbacks but are very slow. We just can’t seem to win. So we turn to a hybrid system that uses symmetric and asymmetric encryption methods together.
- 28. PANKO 28 Public Key Keying for Symmetric Session Keys Party B 1. Creates Symmetric Session Key 3. Sends the Symmetric Session Key Encrypted for Confidentiality 5. Subsequent Encryption with Symmetric Session Key 2. Encrypts Session Key with Party B's Public Key 4. Decrypts Session Key with Party B's Private Key Party A
- 29. Public key cryptography uses two keys (public and private) generated by an asymmetric algorithm for protecting encryption keys and key distribution, and a secret key is generated by a symmetric algorithm and used for bulk encryption. Then there is a hybrid use of the two different algorithms: asymmetric and symmetric. Each algorithm has its pros and cons, so using them together can be the best of both worlds.