%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{5}{September 18, 1997}{Ron Rivest}{Roberta Braum} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Topics Covered}

 
\begin{itemize}
\item CBC MAC
\item Stream Ciphers
\item Pay-TV and Related Applications
\item Key Distribution Centers
\end{itemize}

\section{Cipher Block Chaining Message Authentication Code (CBC-MAC)}

As discussed in the last lecture, the CBC method can be used for encrypting
data. The method also works fine for calculating MACs for fix length messages,
but may be insecure for messages of variable length.

For example:

$f(M1,k^)$ = MAC1

$f(M2,k^)$ = MAC2

This is breakable because you can find a way to encrypt the last block again.

$f(M1,k^)$ = MAC1

$f((MAC1 \oplus M2),k^)$ = MAC2

In order to fix this problem, the last block in the chain can be decrypted with
$ k^{'}$ and then encrypted with k.

\section{Stream Ciphers}

Stream ciphers are utilzed in high speed channels that need fast encryption.
  Many of these ciphers are Feedback Shift Registers (FSR), and incorporate
very fast pseudo random number generators. 
The cipher is linear if f is the $\oplus$ of the inputs.  This method can
 guarantee a long period of $2^{n}-1$ for an n-stage FSR.
The weakness of the linear case is that it is insecure once you have more than 
2n bits of data.

In order to improve on this method, it is useful to use non-linear feedback.  
This has a shorter period, though, as illustrated by the birthday paradox.  

Birthday Paradox
	Take elements at random from a set of size n, replacing each one 
afterwards.  After drawing around square root of n elements, you will have seen 
a repetition.  The period in this case is $2^{n/2}$.
  
Additionally, methods can be combined such as having three shift registers - A, 
B, and C.  Shift register A would be used to determine which of B or C the 
output would come from.  The message can also be decimated by running until you 
have encountered a 1, then outputting the next bit.

\subsection{RC4}
	RC4 is a variable-size stream cipher.  The algroithm utilizes the Ouput 
Feedback mode (OFB) and the key stream is independent of the plaintext.  It has 
an 8*8 S-box, which has 255 1-byte positions.  The entries are a permutation of 
the numbers 0 through 255, and the permutation is a function of the variable 
length key.  The algorithm has two counters i and j, which are initialized to 0.  
	The S-box is initialized by first filling up the S values such that S[0] = 
0, s[1] = 1...s[255] = 255.  Then fill another 256 byte array with the key, 
repeating the key as necessary to fill the entire array. 

j = 0

for i = 0 to 255

	j = (j + Si +Ki) mod 256

	swap (Si, Sj)

Once the table is created, random bytes can be created by:

i =( i+1) mod 256

j = (j+S[i]) mod 256

output S(S[i] +S[j])

swap(S[i], S[j])

Repeat

RC4 has similar error properites to a one-time pad.  The algorithm is immune to 
differenetial and linear cryptanalysis, and is highly non-linear.

\section{Pay-TV and Related Applications}
One area in which stream ciphers may be used is for Pay-TV.  The programs being 
distributed can be encrypted so that only certain viewers may watch a particular 
program or channel.  In order to do this, the client must have a unique key 
which is shared with the TV center.  Program keys can be changed dynamically 
through a secure channel between the client and the center. 
	
For instance, if Alice wants to watch pay-per-view, she can send a message to 
the center through the secure channel requesting the key.  The center then 
responds with the key for the PPV channel encrypted and MAC'd with Alice's set-
top box key.  (For services such as HBO, a longer term group key may be used.)
	
Software distribution via CD can also be key encrypted.  Each program on the CD 
can have a separate key, and the user can purchase the key for a particular 
desired program.  A problem with this distribution method is that the CD does 
not have a unique key, and the keys could be posted on the internet.

\section {Key Distribution Center}
One problem with maintaining security is the creation and distribution of keys.  
One way of handling this is through a Key Distribution Center (KDC).  In order 
for this to work, the KDC must be a trusted entity, and be accessible by all 
parties.  Examples of how the KDC works can be illustrated through the users 
Alice(A) and Bob(B).  Alice shares Ka with KDC and Bob shares Kb with the KDC.  

Methodologies of communication:
 1) Have KDC encrypt/decrypt messages to and from Alice and Bob.  KDC is the 
intermediary.
\begin{description}	
\item[m1] $A->KDC: "Hi, Bob..." [Ka]$
\item[m2]$KDC->Bob: "Hi, Bob.." [Kb]$
\end{description}

The message is encrypted and MACed by Alice with her key [Ka], the message is sent to the KDC, who decrypts the message.

2) Have KDC help Alice and Bob establis a common key Kab.
\begin{description}
\item[m1]	$A->KDC: "I want to talk to Bob" [KA]$
\item[m2]	$KDC->Bob: "Alice wants to talk privately to you, use key
			  Kab = 029" [KB]$

	\item[m3]$KDC->Alice: "Use key Kab=029 to talk to Bob"[Ka]$
\item[m4]	$A->B: "Hi"[Kab]$
\end{description}

Variations:
\begin {itemize}
\item 	Alice making up the key.
\item	Alice could be sent m3, who forwards it to Bob
\item	IDs could be sent in clear so that Bob could know which key to use
\item	If there are multiple keys/sender, the keys may need IDs
\item	 Keys could be made up by Alice, Bob, the KDC or a combination
\item	Expiration.  How long should Bob keep 'Kab'.
\end {itemize}
One way of handling the expiration problem would be:	
	\begin {description}
\item[m1] $A->KDC: A,keyID, {A,B, "request", newkeyid, newkey, timeout}Ka$
\item[m2]	$KDC->A: C,keyID, {C,A, "reply", newkeyid, newkey, timeout}Ka$
\item[m3]	$KDC->B: C,keyID, {C,B, "newkey", newkeyid, newkey,timeout}Kb$
\item[m4]	$A->B:A,newKeyID, {"Hi"}newkey$
\end{description}
where ${}$Key  denotes an encrypted MACed message.

The KDC can be used for establishing keys with other KDCs.  The KDCs establish 
contact with each other, and key transactions are handled at a higher level.

Problems with the KDC method is that the KDC must be trusted completely, must be 
available, and that there are no digital signatures.



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
