%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{7}{September 27, 1996}{Ron Rivest}{George M. Candea} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


\section{News Update}

An article in the New York Times was talking about different types of
cash cards that contain encryption circuits. These cards are quite
vulnerable. Some of the possible attacks, quite non-mathematical in
nature, are:

\begin{itemize}
\item
	One could measure the time it takes for certain computations
	to be made with the key that is encoded on the card. Based on
	these time differentials, details of the key can be guessed.
\item
	The card can be placed under certain hostile environmental
	conditions, such as excessive radiation or high voltages, which
	will cause the circuits to have different characteristics. They
	will output ``garbage'', which can be used along with 
	mathematical models to figure out the secret key.
\item
	Chips can be etched and their circuitry can be extracted and
	analyzed. After that, it can be replicated, generating multiple
	copies of the same cash card.

\end{itemize}

\section{Stream Ciphers -- RC4}

RC4 (meaning ``Ron's Code 4'') is a variable-size stream cipher. The
algorithm works in Output Feedback (OFB) mode -- the keystream is
independent of the plaintext. It has a 8 * 8 S-box: $S_0, S_1, ...,
S_{255}$.  The entries are a permutation of the numbers 0 through 255,
and the permutation is a function of the variable-length key. It has
two counters, $i$ and $j$, initialized to zero.

To generate a random byte, do the following:
\begin{verbatim}
		i = (i + 1) mod 256
		j = (j + Si) mod 256
	swap (Si, Sj)
	t = (Si + Sj) mod 256
	K = St
\end{verbatim}

The byte (key) K is XORed with the plaintext to produce ciphertext or
XORed with the ciphertext to produce plaintext. Encryption with RC4 is
fast -- about 10 times faster than DES.

Initializing the S-box is also easy. First, fill it linearly: $S_0=0,
S_1=1, ..., S_{255}=255$. Then fill another 256-byte array with the key,
repeating the key as necessary to fill the entire array: $K_0, K_1,
..., K_{255}$. Set the index j to zero. Then:
\begin{verbatim}
	for i = 0 to 255
	   j = (j + Si + Ki) mod 256
	   swap (Si, Sj)
\end{verbatim}

RC4 guarantess a pseudo-random key (pad), which is what characterizes
stream ciphers. According to RSA Data Security, Inc. the algorithm is
immune to differential and linear cryptanalysis and is highly
non-linear. RC4 can be in about $256! * 256^2 = 2^{1700}$ possible
states. The S-box slowly evolves with use: $i$ ensures that every
element changes and $j$ ensures that the elements change randomly.
		
RC4 is exportable as long as its key is shorter or equal to 40 bits.
But given this restriction, it becomes vulnerable to brute force attacks.
RC4 is currently being used in commercial products such as Lotus Notes,
Apple's AOCE, and Oracle Secure SQL. It is also part of the Cellular
Digital Packet Data specification.

So we've seen 2 major categories of ciphers so far:
\begin{itemize}
\item
	Block ciphers (DES, RC5)
\item
	Stream ciphers (CBC, RC4)

\end{itemize}

Now on to new stuff: message digests and message authentication codes.

\section{Message digests}

\subsection{What is a message digest?}

Message digests are also known as ``cryptographic hash
functions''. Their main purpose is to produce a hash of a message,
i.e.  to map arbitrarily long messages $M$ to a short "fingerprint"
$H(M)$ such that $H(M)$ is unique to the message $M$.  Since $H$ is a
``fixed function'', we don't need any key to produce the value of
$H(M)$, we can make $H$ be extremely fast in the actual
implementation.

Function $H$ has the following two properties:

\begin{itemize}
\item 
	The hash value has a fixed length (e.g. 128 or 160 bits).
\item 
	It is collision-resistant: it is computationally infeasible
	to find two messages $M$ and $M'$ such that $H(M) = H(M')$.

\end{itemize}

One use of message digests would be to detect virus infections in
filesystems. We can store $H(file1), H(file2), ...$ and periodically
recompute the hashes and compare them to what we have stored. Any
modification should be immediately detected due to the second property
above.

\subsection{An example: MD5}

MD5 was originally designed and optimized for 32-bit processors.  It
uses four 32-bit registers ($A$,$B$,$C$,$D$), each one initialized
with some magic constants.  The return value of this digest function
will be the hash value $H(M)$ that satisfies the required properties
of a correct hash functions.

To prepare the message $M$ for MD5, we append a single 1 to $M$ and
then concatenate enough 0's until the message is 64 bits shy of being
a multiple of 512 bits long.

Now we append a 64-bit representation of the message length to the end
of the message.  We process each 512-bit (16-word) segment as follows:

\begin{enumerate}
\item 
	save A, B, C, D (as $A_A, B_B, C_C, D_D$)
\item 
	go through four rounds of updating A, B, C, D
\item 
	add $A_A$ back to $A$, $B_B$ to $B$, $C_C$ to $C$, and $D_D$
	to $D$

\end{enumerate}

Each round processes 16 words and updates each register 4
times. A typical update would be: 

\[ A = B + ((A + F(B,C,D) + X[k] + T[i]) < \! < \! < s) \] 

where 

\begin{itemize} 
\item 
	$A$ $<\!<\!<$ $s$ means $a$ left-rotated by $s$ bits 
\item 
	$F(B,C,D) = (B \wedge C) \oplus ((\neg B) \wedge D)$ 
\item 
	$X[k] = $ a message word 
\item 
	$T[i] = $ a magic constant 

\end{itemize}

There exist stronger message digests, such as SHA (Secure Hash
Algorithm), which have more rounds and longer outputs. They are also
more complicated and slower (SHA does about 0.2 Mbytes/sec on a
SPARCstation).
	      
\section{Message Authentication Codes (MAC)}

\subsection{What is a MAC?}

Good secrecy does not imply authenticity, and thus not good security
either. The only indication of a sender's authenticity is the
intelligibility of the received message. This is no guarantee,
however.

An example where authentication is particularly important is in bank
transactions. If an intruder knows the approximate format of a bank
transaction, they can alter bits to record that a user has deposited or
withdrawn \$10,000 instead of \$1,000. The bank needs a way to
authenticate an ATM machine.

We cannot simply append an encrypted string to the message because
this does not authenticate the front part of the message.  Instead, we
can use one-time keys for authentication by creating a MAC -- a
function of the key and of the message.

If we want to send a message $M$ and prove we are who we claim to be,
we can send $M$ with a ${\sc MAC}(M,K')$ appendend to it. $K'$ is the
shared key for authentication and $K$ is the key we use for
encryption. The receiver of the message now computes the MAC with $M$
and $K'$. If the received MAC equals the computed MAC, the message is
authentic.

The MAC function needs to have some special properties in order to be
secure. In particular we want an adversary to be unable to compute
MAC's of messages in a reasonable amount of time without knowing the
key $K'$.

\subsection{An example: CBC-MAC}

The simplest way to make a key-dependent one-way hash function is to
encrypt the message with a block algorithm in CBC mode. The hash is
the last encrypted block, encrypted once more in CBC mode. The CBC-MAC
method is part of many ANSI standards, however it can be easily
broken.  

\subsection{Another example: HMAC}

This method has been proposed for ``authenticated IP'' in an upcoming
Internet standard. It essentially works this way:

\begin{itemize}
\item
	$HMAC_k(M) = H_{K_1} ( H_{K_2} (M) )$
\item
	$K = (K_1, K_2)$
\item
	$H_k(M) =$ MD5 with $IV = k$

\end{itemize}

\section{An Application of Secret Key Cryptography: Pay-TV}

Most of today's Pay-TV programming is distributed in the following
way: The studio produces a TV program which is encrypted with a program
key and is transmitted over the satellite to a local cable company.
The cable company distributes the signal over the wires to the
individual customers and it is also responsible for providing the program
keys to its customers subscribed to a particular program.  Every
customer has a decoder box with the secret key known only to the box
and to the cable company.  In order to distribute a program key, the
cable company encrypts the program with the secret key of a customer
decoder box and sends it to the decoder box over a separate control
channel.  The decoder box decrypts the message using its secret key,
and extracts the program key.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}



