Department of Computer Science Southern Illinois University Carbondale

Department of Computer Science Southern Illinois University Carbondale CS 591 – Wireless & Network Security Lecture 6: Security Basics-2 Dr. Kemal Akkaya E-mail: kemal@cs. siu. edu Kemal Akkaya Wireless & Network Security 1

Public-Key Encryption q A public-key encryption scheme works as follows: Ø Each user has a public key e and a private key d. Ø To send a message M to Bob, Alice obtains Bob’s public key e. Bob and encrypts M with e. Bob: C = Ee. Bob(M) Ø When Bob receives the ciphertext C, he decrypts it with his private key d. Bob: M = Dd. Bob(C) Ø The decryption algorithm Dd must be the reverse of the encryption algorithm Ee; i. e. , Dd(Ee(M)) = M for any message M. Ø It is computationally infeasible to determine the private key d given the knowledge of the public key e and the encryption and decryption algorithms. Kemal Akkaya Wireless & Network Security 2

Public-Key Encryption Kemal Akkaya Wireless & Network Security 3

RSA q The RSA cryptosystem was invented by Ron Rivest, Adi Shamir and Len Adleman at MIT in 1977. It is, to date, the first unbroken and most widely used public-key cryptosystem. q Rivest, Shamir and Adleman received the Turing Award 2002 for inventing RSA. Shamir, Rivest and Adleman in 1978 Shamir, Rivest and Adleman at Turing Award Lecture Kemal Akkaya Rivest, Shamir and Adleman at RSA 2003 Wireless & Network Security Adleman, Shamir, Rivest at CRYPTO '82 4

RSA q Key generation 1. 2. 3. 4. Choose two (large) distinct primes p and q at random. Compute the RSA modulus n = pq. Compute ø(n) = (p – 1)(q – 1). Select a random integer e (called the encryption exponent), 1 < e < ø(n), such that gcd(e, ø(n)) = 1. 5. Compute the unique integer d (called the decryption exponent), 1 < d < ø(n), such that ed mod ø(n) = 1. 6. The public key is (e, n); the private key is (d, n). q Encryption Ø Given: receiver’s public key (e, n), message M ε [0, n-1] Ø Encrypt: C = Me mod n q Decryption Ø Given: private key (d, n), ciphertext C Ø Decrypt: M = Cd mod n Kemal Akkaya Wireless & Network Security 5

RSA: Example q Key generation 1. 2. 3. 4. Choose p = 11 and q = 47. Compute the RSA modulus n = 11 × 47 = 517. Compute ø(n) = 10 × 46 = 460. Choose the encryption exponent e = 3. It is clear that gcd(e, ø(n)) = gcd(3, 460) = 1. 5. Compute the decryption exponent d = 307. 6. The public key is (3, 517); the private key is (307, 517). q Encryption Ø Given: public key (3, 517), message M = 26 Ø Encrypt: C = 263 mod 517 = 515 q Decryption Ø Given: private key (307, 517), ciphertext C = 515 Ø Decrypt: M = 515307 mod 517 = 26 Kemal Akkaya Wireless & Network Security 6

RSA q The security of RSA depends on the hardness of the integer factorization problem: given an integer x > 1, what is its prime factorization? Currently there is no known algorithm that can efficiently factor a number whose prime factors are all arbitrarily large. q If one can factor the RSA modulus n into p and q, then he can compute ø(n) = (p – 1)(q – 1) and thus he can determine the decryption exponent d from e and ø(n) efficiently using the Extended Euclidean Algorithm. q The RSA modulus n should be at least 1024 bits long to guard against today’s factoring attacks. Kemal Akkaya Wireless & Network Security 7

Symmetric-Key vs. Public-Key q In symmetric-key encryption, the sender has to establish a secret key with the receiver prior to encryption. However, in public-key encryption, the sender just needs to obtain an authentic copy of the receiver’s public key. q In a network of n users, a symmetric-key cryptosystem requires n(n-1)/2 secret keys, but a public-key cryptosystem requires only n public-private key pairs. q Public-key cryptography (digital signatures) provides non-repudiation while symmetric-key cryptography (MAC) does not. q Public-key cryptosystems are substantially slower than symmetric-key cryptosystems since the key sizes of public-key cryptosystems are typically much larger. Kemal Akkaya Wireless & Network Security 8

Digital Signatures q Encrypted messages that can be mathematically proven to be authentic q Created in response to rising need to verify information transferred using electronic systems q Asymmetric encryption processes used to create digital signatures q Digital Certificates Ø Electronic document containing key value and identifying information about entity that controls key Ø Digital signature attached to certificate’s container file to certify file is from entity it claims to be from Kemal Akkaya Wireless & Network Security 9 9

Digital Signatures q A digital signature scheme is composed of: Ø A public key e and a private key d for each user Ø A signing algorithm sigd that, with a message M and the signer’s private key d as input, produces the digital signature s = sigd(M) of M Ø A verification algorithm vere that, with a message M, a digital signature s and the signer’s public key e as input, returns true if and only if s is the digital signature of M signed by e’s owner; i. e. , q RSA digital signature scheme Ø (d, n) = signer’s private key, (e, n) = signer’s public key Ø Sign: s = [H(M)]d mod n Ø Verify: return true if and only if H(M) = se mod n q Hash-and-sign: if the message is long, it is common to sign the message digest instead of the message itself to save time. Kemal Akkaya Wireless & Network Security 10

Hash Functions q A hash function H: {0, 1}* {0, 1}n maps (condenses) a variable-length bitstring to a bitstring of a fixed length. q Given an input x ε {0, 1}*, the output h = H(x) is called the hash value or message digest of x, and x is called a preimage of h. q A cryptographic hash function exhibits the property of one-wayness: for any given value h ε {0, 1}n, it is computationally infeasible to find an input x ε {0, 1}* such that H(x) = h. q Cryptographic hash functions, such as MD 5 and SHA-1, are widely used in security applications; for example, they can be used to produce file checksums for integrity check. Kemal Akkaya Wireless & Network Security 11

Simple Hash Functions q A one-way or secure hash function used in message authentication, digital signatures q All hash functions process input a block at a time in an iterative fashion q One of simplest hash functions is the bit-bybit exclusive-OR (XOR) of each block Ci = bi 1 bi 2 . . . bim Ø effective data integrity check on random data Ø less effective on more predictable data Ø virtually useless for data security Kemal Akkaya Wireless & Network Security 12

SHA Secure Hash Functions q SHA originally developed by NIST/NSA in 1993 q Revised in 1995 as SHA-1 Ø US standard for use with DSA signature scheme Ø standard is FIPS 180 -1 1995, also Internet RFC 3174 Ø produces 160 -bit hash values q NIST issued revised FIPS 180 -2 in 2002 Ø adds 3 additional versions of SHA ü SHA-256, SHA-384, SHA-512 ü with 256/384/512 -bit hash values Ø same basic structure as SHA-1 but greater security q NIST intend to phase out SHA-1 use Kemal Akkaya Wireless & Network Security 13

SHA-512 Structure Kemal Akkaya Wireless & Network Security 14

SHA-512 Round Kemal Akkaya Wireless & Network Security 15

Other Secure Hash Functions q Most based on iterated hash function design Ø if compression function is collision resistant Ø so is resultant iterated hash function q MD 5 (RFC 1321) Ø was a widely used hash developed by Ron Rivest Ø produces 128 -bit hash, now too small Ø also have cryptanalytic concerns q Whirlpool Ø developed by Vincent Rijmen & Paulo Barreto Ø compression function is AES derived W block cipher Ø produces 512 -bit hash Kemal Akkaya Wireless & Network Security 16

Message Authentication Codes q Another main application of cryptographic hash functions is message authentication codes (MAC): Ø The sender shares a secret key Ka with the receiver for message authentication. Ø The sender computes the MAC of a message M as follows: MACKa(M) = H(M || Ka). The message-MAC pair is then transmitted to the receiver. Ø The receiver authenticates M by recalculating the MAC and comparing it with the received MAC. If the two MACs match, the receiver is assured that the message comes from the alleged sender and has not been altered during transmission. Ø Confidentiality can also be provided by encrypting the message. MAC pair with a separate shared secret key Ke: EKe(M || MACKa(M)). Kemal Akkaya Wireless & Network Security 17

HMAC q A MAC using a cryptographic hash Ø Due to speed and code availability q Must incorporate key into use of hash alg q HMAC (RFC 2104) widely supported Ø Used in IPsec, TLS & SET q HMAC treats hash as “black box” q HMAC proven secure if embedded hash function has reasonable cryptographic strength Kemal Akkaya Wireless & Network Security 18

HMAC Structure Kemal Akkaya Wireless & Network Security 19