6.857 Computer and Network Security Fall Term, 1996

Lecture 6 : September 27, 1996

Lecturer: Ron Rivest Scribe: George M. Candea

1 Stream Ciphers – RC4

RC4 (meaning “Ron’s Code 4”) is a variable-size stream cipher. The algorithm works in Output Feedback (OFB) mode – the keystream is independent of the plaintext. It has a 8 * 8 S-box: S_{0}, S_{1}, ..., S_{255}. The entries are a permutation of the numbers 0 through 255, and the permutation is a function of the variable-length key. It has two counters, i and j, initialized to zero.

To generate a random byte, do the following:

i = (i + 1) mod 256
j = (j + Si) mod 256
swap (Si, Sj)
t = (Si + Sj) mod 256
K = St

The byte (key) K is XORed with the plaintext to produce ciphertext or XORed with the ciphertext to produce plaintext. Encryption with RC4 is fast – about 10 times faster than DES.

Initializing the S-box is also easy. First, fill it linearly: S_{0} = 0, S_{1} = 1, ..., S_{255} = 255. Then fill another 256-byte array with the key, repeating the key as necessary to fill the entire array: K_{0}, K_{1}, ..., K_{255}. Set the index j to zero. Then:

for i = 0 to 255
   j = (j + Si + Ki) mod 256
   swap (Si, Sj)

RC4 guarantess a pseudo-random key (pad), which is what characterizes stream ciphers. According to RSA Data Security, Inc. the algorithm is immune to differential and linear cryptanalysis and is highly non-linear. RC4 can be in about 256! ∗ 256^{2} = 2^{1700} possible states. The S-box slowly evolves with use: i ensures that every element changes and j ensures that the elements change randomly.

RC4 is exportable as long as its key is shorter or equal to 40 bits. But given this restriction, it becomes vulnerable to brute force attacks. RC4 is currently being used in commercial products such as Lotus Notes, Apple’s AOCE, and Oracle Secure SQL. It is also part of the Cellular Digital Packet Data specification.

So we’ve seen 2 major categories of ciphers so far:

• Block ciphers (DES, RC5)

• Stream ciphers (CBC, RC4)

Now on to new stuff: message digests and message authentication codes.

2 Message digests

2.1 What is a message digest?

When messages get very long, encrypting them to use as a digital signature with algorithms such as RSA can be very expensive. We’d like to sign our messages with something much shorter, a “fingerprint” of the message, also called a “message digest.”

To create the fingerprint, we use a function (fingerprint function, MD-function, cryptographic hash function, etc.) that compresses messages of arbitrary length into a preset set. This function, h(x), normally produces a fingerprint either 128 or 160 bits long. This shorter value is much easier to sign than the full message. Our goal is that:

• The function h is efficient

• The length of h(x) is short

• The function h(x) is secure (i.e. it has strong collision-resistance, defined below)

2.2 Hashing Security

The security of hash functions is measured by the existence of collisions. A collision is when two different messages produce the same hash. (i.e. h(m_{1}) = h(m_{2})) Here are some terms used in describing the security hash functions:

Strong Collision-Resistance: It is infeasible for an attacker to find x and x′ forming a collision. (i.e. h(x) = h(x′))

Weak Collision-Resistance: Given an x and h(x), it is infeasible to find x′ such that h(x) = h(x′). This implies that given h(x), it is infeasible to find any x′ such that h(x) = h(x′). (i.e. That h is a one-way function.)

2.3 An example: MD5

MD5 was originally designed and optimized for 32-bit processors. It uses four 32-bit registers (A,B,C,D), each one initialized with some magic constants. The return value of this digest function will be the hash value H(M) that satisfies the required properties of a correct hash functions.

To prepare the message M for MD5, we append a single 1 to M and then concatenate enough 0’s until the message is 64 bits shy of being a multiple of 512 bits long.

Now we append a 64-bit representation of the message length to the end of the message. We process each 512-bit (16-word) segment as follows:

1. save A, B, C, D (as A_{A}, B_{B}, C_{C}, D_{D})

2. go through four rounds of updating A, B, C, D

3. add A_{A} back to A, B_{B} to B, C_{C} to C, and D_{D} to D

Each round processes 16 words and updates each register 4 times. A typical update would be:

A = B + ((A + F (B, C, D) + X[k] + T [i]) <<< s)

where

• A <<< s means a left-rotated by s bits • F (B, C, D) = (B ∧ C) ⊕ ((¬B) ∧ D)

• X[k] = a message word

• T [i] = a magic constant

2.4 Secure Hash Algoritm (SHA)

SHA is a hash function developed by the US government. It’s similar to MD5, but uses five 32-bit words and five rounds per message block to produce a 160-bit hash, using linear transformations of the message in each block.

2.5 Birthday Attacks

A birthday attack on a hash function attempts to use the birthday paradox to find collisions in a hash function. (i.e. creating random messages, taking their hash value, and checking if that hash value has been encountered before.) For MD5, as an example, an attacker could expect to find collisions after trying 2^{64} messages. Given today’s computing power, this is a difficult, but not impossible problem. Hence the move to stronger hashing algorithms, like SHA.

2.6 CvHP

Yet another hash function is CvHP. It’s full name is the Chaum-vanHeijst-Pfitzmann hash function. First, we need to choose prime numbers p and q such that p = 2q + 1. Next, we need an α and a β that are both an element of order q (i.e. α^{q} ≡ 1(modp)) and that α ≠ β. For security, it must be difficult to compute log_{α} β.

The hash function splits the message into two parts m_{1} and m_{2}. h(m_{1}, m_{2}) = α^{m_{1}} ∗ β^{m_{2}}(modp). It is necessary that 1 ≤ |m_{1}|, |m_{2}| ≤ q.

The heart of CvHP is that it’s infeasible to find α and β. As an example, let’s say that we have a collision:

α^{m_{1}} ∗ β^{m_{2}} = α^{m_{3}} ∗ β^{m_{4}}(modp))

We can transform this to be

α^{m_{1}−m_{3}} = β^{m_{4}−m_{2}}(modp)

If we set r = m_{1} − m_{3} and s = m_{4} − m_{2}, we get

α^{r} = β^{s}(modp)

If then we choose t such that t = s^{−1}(modq), we can use

α^{rt} = β^{st}(modp)

to get α^{rt} = β(modp). Since we said it’s difficult to compute log_{α}β, an attacker cannot get past this stage.

3 Applications of One-way Hash Functions

• Virus Checking – virus modifies file contents

– producer makes checksum c = h(F) where F is the original file content and h is a weakly collision-free one-way hash function

– c is distributed to users via secure channels (e.g. floppy disk, CD)

– users compare c with h(F′), where F′ is the suspected copy of the file • Software/Public Key Distribution

– objective: get the “true” copy of software or public key

– same idea as virus checking

– obtain a hash value of the software/public key via a secure channel and

compare it to the hash value of user’s copy.

• Swapping to insecure storage

– keep a table of hash values of the pages before swapping them out to an insecure storage

– check the hash value of the page when retrieved back next time • Secure Reference or Pointer

– used as web page reference

– URLs are hashed

• Time stamp

– files or documents are hashed and then time-stamped by some timestamping services

• One-time Password (S-Key)

– pick a seed x_{0} to create a chain of hash values: x_{0} ⟶^{h(x_{0})} x_{1} ⟶^{h(x_{1})} x_{2} ⋯ ⟶^{h(x_{n})} x_{n}

– originally system stores x_{n}, user enters password x_{n−1}

– system verifies h(x_{n−1}) =^{?} x_{n}

– adversaries cannot find x_{n−1} even if knowing x_{n}, since h is weakly collisionfree

– system then stores h_{n−1}, next time user enters h_{n−2} as password

4 Randomized Hash Functions

Sometimes we are concerned about whether h(x) reveals any information of x for a one-way hash function h. For example, in a multi-user system, users’ passwords are usually hashed by a certain hash function and stored in a password file. Is it totally safe then?

Adversaries may get their way to the password file and read the list of the hashed passwords. It is common (though strongly discouraged) that English words are used as passwords. As a result, adversaries can create a table of hash values for all the dictionary words in advance and look up the hashed passwords in the table. This is known as the dictionary attack.

Also, if two people have the same password, the adversary knows that, since the hash function is deterministic.

As a solution, we introduce random factors. To do this, every time a user password is created, a random number r (called a salt) is picked and hashed with the password. The random number r is kept for verification. Now the adversary only sees a “random” number. e.g. h(x) = (r, MD5(r, x)) or h(x) = (r, r^{MD5(x)})

In this case, the adversary needs to generate a separate dictionary hash table for each random number (i.e. user password). Same passwords are very unlikely to give the same hash values because of the salt.

4.1 Application: Auction & Commitment

Imagine we are designing a computer system for secure auction. The auction works this way:

1. bidders submit “sealed” bids

2. auction over

3. bidders “open” bids, auctioneer announces the winning bid

All bidders do not want the auctioneer and other people know what their bids are. On the other hand, the auctioneer needs to prevent the bidders from changing their bids once they have submitted. Such a scenario is called commitment.

To keep confidentiality, bidders need to somehow encrypt their bids before submitting to the auctioneer and keep the key until the auction is over. To avoid changing bids, the auctioneer has to prevent the bidders from changing their keys because changing the keys essentially changes the bids as well.

One solution may come. The auctioneer chooses a public, randomized, weakly collision-free, one-way hash function h. And each bidder picks a random salt r for himself and makes his bid b. Bidders submit h(r, b) to the auctioneer. At the end, bidders open their bids by disclosing r and b.

In this way, the auctioneer cannot get any information of the bids because the submitted hash values are randomized. On the other hand, bidders cannot change their bids because it is hard to compute another pair (r′, b′) such that h(r′, b′) = h(r, b).

One example of the hash functions that can be used is the randomized CvHP. The auctioneer picks p, α and β and bidders choose their own random salt r and their bids b. Bidders submit α^{r}β^{b} modulo p to the auctioneer. At the end of the auction, the bidders disclose r and b and the auctioneer verifies that α^{r}β^{b} modulo p is the submitted value.

5 Message Authentication Codes (MAC)

5.1 What is a MAC?

Good secrecy does not imply authenticity, and thus not good security either. The only indication of a sender’s authenticity is the intelligibility of the received message. This is no guarantee, however.

An example where authentication is particularly important is in bank transactions. If an intruder knows the approximate format of a bank transaction, they can alter bits to record that a user has deposited or withdrawn $10,000 instead of $1,000. The bank needs a way to authenticate an ATM machine.

We cannot simply append an encrypted string to the message because this does not authenticate the front part of the message. Instead, we can use one-time keys for authentication by creating a MAC – a function of the key and of the message.

If we want to send a message M and prove we are who we claim to be, we can send M with a MAC(M, K′) appendend to it. K′ is the shared key for authentication and K is the key we use for encryption. The receiver of the message now computes the MAC with M and K′. If the received MAC equals the computed MAC, the message is authentic.

The MAC function needs to have some special properties in order to be secure. In particular we want an adversary to be unable to compute MAC’s of messages in a reasonable amount of time without knowing the key K′.

5.2 An example: CBC-MAC

The simplest way to make a key-dependent one-way hash function is to encrypt the message with a block algorithm in CBC mode. The hash is the last encrypted block, encrypted once more in CBC mode. The CBC-MAC method is part of many ANSI standards, however it can be easily broken.

5.3 Another example: HMAC

This method has been proposed for “authenticated IP” in an upcoming Internet standard. It essentially works this way:

• HMAC_{k}(M) = H_{K_{1}}(H_{K_{2}}(M))

• K = (K_{1}, K_{2})

• H_{k}(M) = MD5 with IV = k

6 Pay-TV and Related Applications

One area in which stream ciphers may be used is for Pay-TV. The programs being distributed can be encrypted so that only certain viewers may watch a particular program or channel. In order to do this, the client must have a unique key which is shared with the TV center. Program keys can be changed dynamically through a secure channel between the client and the center.

For instance, if Alice wants to watch pay-per-view, she can send a message to the center through the secure channel requesting the key. The center then responds with the key for the PPV channel encrypted and MAC’d with Alice’s set- top box key. (For services such as HBO, a longer term group key may be used.)

Software distribution via CD can also be key encrypted. Each program on the CD can have a separate key, and the user can purchase the key for a particular desired program. A problem with this distribution method is that the CD does not have a unique key, and the keys could be posted on the internet.

7 Key Distribution Center

One problem with maintaining security is the creation and distribution of keys. One way of handling this is through a Key Distribution Center (KDC). In order for this to work, the KDC must be a trusted entity, and be accessible by all parties. Examples of how the KDC works can be illustrated through the users Alice(A) and Bob(B). Alice shares Ka with KDC and Bob shares Kb with the KDC.

Methodologies of communication: 1) Have KDC encrypt/decrypt messages to and from Alice and Bob. KDC is the intermediary.

m1 A− > KDC : ”Hi, Bob...”[Ka]

m2 KDC− > Bob : ”Hi, Bob..”[Kb] The message is encrypted and MACed by Alice with her key [Ka], the message is sent to the KDC, who decrypts the message.

2) Have KDC help Alice and Bob establis a common key Kab.

m1 A− > KDC : ”IwanttotalktoBob”[KA] m2 KDC− > Bob : ”Alicewantstotalkprivatelytoyou, usekeyKab = 029”[KB] m3 KDC− > Alice : ”UsekeyKab = 029totalktoBob”[Ka] m4 A− > B : ”Hi”[Kab]

Variations:

• Alice making up the key.

• Alice could be sent m3, who forwards it to Bob

• IDs could be sent in clear so that Bob could know which key to use

• If there are multiple keys/sender, the keys may need IDs

• Keys could be made up by Alice, Bob, the KDC or a combination

• Expiration. How long should Bob keep ’Kab’.

One way of handling the expiration problem would be:

m1 A− > KDC : A, keyID, A, B, ”request”, newkeyid, newkey, timeoutKa m2 KDC− > A : C, keyID, C, A, ”reply”, newkeyid, newkey, timeoutKa m3 KDC− > B : C, keyID, C, B, ”newkey”, newkeyid, newkey, timeoutKb m4 A− > B : A, newKeyID, ”Hi”newkey

where Key denotes an encrypted MACed message. The KDC can be used for establishing keys with other KDCs. The KDCs establish contact with each other, and key transactions are handled at a higher level. Problems with the KDC method is that the KDC must be trusted completely, must be available, and that there are no digital signatures.