\documentstyle[12pt,twoside,alltt,psfig,DraTex,AlDraTex]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecture
%		date of the lecture
%		lecturer
%		scribe---that is you
%
\lecture{3}{September 9, 1997}{Ron Rivest}{Zia Ahmed} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favorite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-2-fig-1.ps}}
% \caption{Sending an encrypted message over the network.}
% \label{fig:1}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Unconditional Security}

This course is primarily about computer security, and involves only some
cryptography. Unconditional security methods, though excellent in
theory, are hard to implement or execute efficiently in practice.
Unconditional security implies that no assumptions are made about the
computing power and resources available to an adversary. This is often
overkill, since an adversary may well be limited by time (computing time)
or space (memory). However, a study of unconditional security methods
is definitely a prerequisite to the study of more practical and conventional
methods of network and computer security. Some methods are discussed below.

\subsection{One Time Pad (OTP)}
Our problem is to design a secure method to deliver a message M $\epsilon$ 
$(0,1)^{n}$
(an n bit string) from Alice (A) to Bob (B) {\em securely}. An
eavesdropper Eve (E), should not learn anything more about M.

\begin{figure}[h]
\begin{center}
\mbox{\psfig{angle=270,figure=notes-03-fig-1.eps,height=1.5in}}
\caption{Sending a message over the network.}
\label{fig:1}
\end{center}
\end{figure} 

{\bf IDEA:} Bob should have something or know something which distinguishes him
from Eve. In classical cryptography, this is called a {\em shared secret key} (K).
This key is known to both Alice and Bob, but not to Eve. The secret
key raises two problems:

\begin{description}

\item[Generation:] How is the key generated? (someone makes up K at random
or uses a convoluted deterministic generator).
\item[Distribution:] How is the key distributed to Alice and Bob without
Eve getting it? (the key is shipped to Alice and Bob on a disk or CD-ROM 
prior to the message being sent).

\end{description}

For the encryption and decryption operations, a {\em one time pad} is used (Vernam, 1913):

{\bf Example:} Let the message $M = 011010$. Let the key $K = 101100$ 
(generated at random, such that the length of the key equals the length of the message).

Now, the ciphertext, $C = M \oplus K = 1 1 0 1 1 0$, where $\oplus$ is the bit-wise
exclusive-or operator.

Decryption is trivial since $\oplus$ is associative, and each element is it's
own inverse.

So, $C \oplus K = (M \oplus K) \oplus K = M \oplus (K \oplus K) = M \oplus 0 = M$


\begin{theorem} $P(M=x|C=y) = P(M=x)$

\begin{proof}
Assume that M and C are n bits long.

Now, $P(M=x|C=y) = \frac{P(M=x \wedge C=y)}{P(C=y)}$

$P(M=x \wedge C=y) = P(M=x \wedge K=(x \oplus y))$

$= P(M=x).P(K=(x \oplus y))$ (K is independent of M)

$= P(M=x).2^{-n}$ (K is chosen uniformly from bit strings of length n)

Also, $P(C=y) = \sum_{x} P(M=x \wedge C=y)$

$= \sum_{x} P(M=x).2^{-n}$


$= \sum_{x} P(M=x)$ 

$= 2^{-n}$ (that is, each C is equally likely).

So, $P(M=x|C=y) = \frac{P(M=x).2^{-n}}{2^{-n}}$

$= P(M=x)$ \end{proof}
\end{theorem}

There are some problems with this approach. Note that each key can only
be used {\it once}; in the case where K is reused, security may be
compromised. As an example, suppose that $M_{1}$ and $M_{2}$ are encrypted
with the same key K to generate ciphertexts $C_{1}$ and $C_{2}$.

Now, $C_{1} = M_{1} \oplus K$ and $C_{2} = M_{2} \oplus K$.

$C_{1} \oplus C_{2} = (M_{1} \oplus K) \oplus (M_{2} \oplus K)$

$= M_{1} \oplus M_{2}$

Depending on the entropy of the message, an adversary can use this to
figure out both messages.

\begin{claim}
If the pad is never used again, the ciphertext does not increase
the adversary's knowledge about the message.
\end{claim}
Lucifer may know something beforehand, like that M is part of the
English language or one of 3 colors.  Indeed it is easy to prove that
given a ciphertext $C$, any message $M$ could have been sent using the
key $K=C \oplus M$.

\begin{figure}[b]
\Draw
\TreeSpace(S,60,40)
\TreeSpec()
	 ()(\Edge)
\LTree()($2/3$~~$M=0$#$1/3$~~$M=1$,2,//
	$1/2$~~$K=0$#$1/2$~~$K=1$,2, & $1/2$~~$K=0$#$1/2$~~$K=1$,2,//
	,0,$C=0$~~$1/3$ &,0,$C=1$~~$1/3$ &,0,$C=1$~~$1/6$ &,0,$C=0$~~$1/6$//)
\Move(-135,-40)
\DrawOval(80,25)
\EndDraw
\caption{Probability Tree for ciphertexts}
\end{figure}

Let's say the adversary knows the likelihood of certain messages:
$2/3$ Chance of $M=0$ and $1/3$ Chance of $M=1$. The unconditional
probability is $Pr(M=0)=2/3$

The conditional probability using the circled portion in figure 2 is
$Pr(M=0 | C=1)$.
\[ = \frac{Pr (M=0 \wedge C=1)}{Pr(C=1)} \]
\[ = \frac{1/3}{1/2}=2/3 \]

Since the conditional probability = the unconditional probability,
even knowing the possible forms of M does not produce any new information
to solve the problem.

Why is it important to only use the pad once?  If you let it
be a two time pad, and somehow Lucifer knows or guesses that
you are using the same pad, he can gain some knowledge.  If $M_1$
and $M_2$ are encrypted using the same pad $K$ to get $C_1$ and $C_2$ then 
Lucifer can compute 
\[ C_1 \oplus C_2 = (M_1 \oplus K) \oplus (M_2 \oplus K) = M_1 \oplus M_2 \]
This may not seem very important, but
statistical analysis shows that it can be very easy to get
the two original messages from this, due to the redundancy of
the English language.  One thing to note is that if $M_1$ and $M_2$ 
are compressed before the encryption, then it is
much harder to get the original messages from the XOR of the
two compressed messages.

If you are thinking that using a XOR pad more than once is not really a 
security risk, you may be interested in the story of project Venoma. 
During the cold war years apparently the Russians were reusing pads 
for their encrypted communications between embassies. The Western intelligence
agencies guessed that this was the case and started a massive effort 
for the decryption of the messages. By collecting a huge number of 
ciphertexts and looking for dependencies they were able to decrypt a
good portion of the messages. It is still not clear how it was possible 
for the Russians to make such an error. Project Venoma was recently 
declassified by the CIA. 

Another problem is that OTP is {\it malleable}; an adversary can change
C so that Bob's decrypted M is different from the message that Alice sent.
There's no way for Bob to check if Alice sent exactly the same message that
he received. Thus, OTP provides {\it privacy} but not {\it authentication}.

\subsection{Generating Random Bits}
As can be seen from the previous section, generating large sequences
of random bits is very important. Practical cryptography calls for
long keys, the generation of which may be non-trivial. Only recently,
a security bug in Netscape was found by graduate students at Berkeley;
apparently, the keys used by Netscape were not long enough, and their
source of ``randomness'' left much to be desired.

{\bf Sources of randomness:}
\begin{itemize}
\item Toss coins
\item Radioactive Decay
\item Typing speed of a user at a terminal 
\item Thermal noise
\item Lava lamps
\item Noisy diode
\item Background radiation
\item Hard disk speed variation
\item Other physical chaotic systems
\end{itemize}

These are excellent sources of randomness (some better than the others)
but they are difficult to realize in practice. An ordinary PC is not
supplied with a radioactive sample, nor equipped with a Geiger counter
to detect randomness at the quantum level.

It is also possible to remove bias from a raw sample. Suppose that
a random sample has a bias towards pairs of bits (ie. 11 and 00 occur
together more frequently than singly). A possible fix to this (as
proposed by von Neumann) is to generate two bits at a time; return
0 if 10 is detected, 1 is 01 is detected and redo the experiment
if 00 or 11 is detected. Thus, the natural bias in the sample is removed.

Other possible sources of (pseudo) randomness are deterministic sources;
the so-called  {\it pseudo-random number generators} (PRGs). A PRG generates
a long n-bit sequence from a short seed, which is typically provided by
the user or the system clock. The bit generation involves a long and convoluted
function; however, since an adversary may gain access to this function, the
use of a PRG is not entirely secure. Since the PRG uses a deterministic source,
the security proof of the earlier section is no longer applicable.

\subsection{Message Authentication Code (MAC)}
A key problem in network security is that of {\it authentication}; how
can Bob be sure that the message he has received was actually sent by
Alice, and if so, was not corrupted en route by Eve, the adversary?

The solution lies in the message authentication code (MAC). The MAC is
a function of the message M and the secret key K. Thus, the MAC $y = f(M,K)$.
The function $f$ is public. Alice appends the MAC y at the end of the 
message M. Bob, upon receiving the string $<M,y>$, uses his secret
key and the function $f$ to compute $f(M,K)$. If this is the same as
{\it y}, Bob concludes that the message is authentic. If on the other
hand Eve interferes and changes $M$ to $M^{'}$, Bob computes $f(M^{'},K)$
and on finding that this is different from {\it y}, concludes that the 
message has been corrupted by Eve. This is similar to a CRC with the
difference that the problem here is that of an actual adversary, and
not accidental corruption of the message. Depending on the implementation,
the MAC may or may not be encrypted; Alice may either send 
$<M \oplus K,y>$, or $<M,y> \oplus K$. Both methods have their pros
and cons.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
