<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{6}{September 24, 1996}{Ron Rivest}{Darrin Jewell} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Attacks on block ciphers}

Computational security is based on the computational difficulty of
breaking an encryption. It is based on a key that is not consumed each
time a message is encrypted or decrypted.

When designing a computational cipher, give the adversary a lot more
power than may be true in practice.  Make worst case assumptions.  We
would like to be able to state proofs about the computation required
to break a cipher.  Most of the study of algorithms has focused on
proving worst case computation time, when we should be more worried
about average case computation time.  Ideally, we would like to be
able to prove lower bounds on computation, but this is still a
difficult open problem.  People have been working on this for
decades.

Many of these systems are a classic form of the P=NP problem.  If it
is ever shown that P does equal NP, then ciphers based on
computational difficulty will fall apart.  Compare this to information
theoretic systems which do not have this problem.  We continue
on the assumption that P is not equal to NP\@.

Unfortunately, since we cannot prove lower bounds on computational
difficulty, we live with security based on trial by fire.  After
a cipher algorithm has been tested for a while without failing,
we begin to place some trust in it.  Sometimes we are surprised.

{\bf Chosen plaintext attack:}
The cipher encryption algorithm
is openly available to the attacker.  The encryption key,
which is unknown to the attacker, represents the only
changeable portion of the encryption algorithm.  The attacker
has the ability to choose messages to encrypt and
get the resulting ciphertext.

\subsection{Brute Force}
Attacker must try all $2^{56}$ possible keys to match a given
message-ciphertext pair.

How expensive (in time and money) is this?

In 1977, Diffie and Hellman postulated that they could build a machine
for \$20 million dollars which could find the key in 10 hours. They
extrapolated that in 1987, they could build a similar machine for
\$200,000.

More recently, a VLSI designer named Wiener designed a chip which could
do 5,000,000 encryptions/second for \$10.50/chip. He designed a machine
which uses 5760 chips in parallel to break the DES key in 1.5 days. With
\$1 million dollars, he could build a machine which could break the key 
in 3 hours.
%% [This was from last year's notes, and so is not really true now. -darrin]
%%The paper describing this design is available from the 
%%class Web page. 

\subsection{Differential Attack}
A more clever (non-brute) method of breaking the DES key requires Alice
to encrypt whatever the adversary wants (chosen plaintext). This method
may not be realistic in most cases. It reduces the number of keys to
$2^{47}$ by accumulating statistical evidence about the key.  This
method to break the DES key was known when it was designed, so the 
S--boxes are designed to be amazingly resilient under this form of attack.

\subsection{Linear Attack}
The linear method of breaking the DES encryption scheme relies on
forming a linear approximation to the encryption key. It also gathers
statistical evidence about the key from observation (as opposed to
requiring encryption of chosen plaintexts), but only needs to search
$2^{43}$ randomly generated keys. This method has actually been used.

The time to break encryption keys continues to decrease as processing
speed increases. Approximately every 18 months, processing time doubles
in speed. There have been about 13 doublings since 1977. To stay at the
same level of security as 1977, DES needs to have 70 bits, and the
number of bits must be able to increase as computing power grows.
Unfortunately, the DES 56 bit key is of fixed length.

\section{Design of encryption and decryption boxes}

An encryption/decryption algorithm is a one-to-one and unto mapping.
(For any key, there is only one remapping of the output to the input)
Imagine DES implementation which is a box with lots of memory
for a table lookup.  This would require $2^{126}$ bits of storage.
($2^{56}$ keys * $2^{64}$ bits/message * $2^{6}$)
We would like to design a box which is indistinguishable from a
random table.  This gives us a definition of an optimal algorithm.

\subsection{New Encryption Methods}

Professor Rivest has recently designed another encryption method
called RC5.  This stands for Ron's Code 5.  (RC1 and RC3 have been
trashed, although RC2 and RC4 appear to be standing so far.)

First, there is a separate extension that expands the key to
have as many words as rounds.  Then, letting

$A,B$ = halves of message\\
$S[1\ldots{}]$ = key information

it does the following operation 16 times: (rounds)
\[ A \leftarrow ((A \oplus B) \ll  B) + S[i] \]
\[ Swap A,B\]
where $\ll X$  is bit rotation by X bits. This rotation is dependent on
the lower 5 bits of the data.  Note that on older machines, the time to
left shift may be proportional to the value being left shifted by.
This could leave RC5 vulnerable to a timing attack.  However, most
modern computers do this operation in a single cycle.

The output is then $A,B$.

RC5 has the advantage that it is fast and easily parameterizable.
It can use variable sized keys and a variable number of iterations.
So far, it has held up against both linear and differential
attack.
%%A paper describing RC5 in more details is
%%available from the class Web page.

\subsection{Strengthening DES} 

{\bf Double DES:}
The Double DES encryption method cascades two DES boxes with different
keys.  One might think that this method is equivalent to using DES with
a 112 bit key, but this is not true. It can be attacked with the ``Meet in
the Middle'' attack which requires $O(2^{56})$ keys to be searched. 
%See Figure \ref{fig:meet}.

%\begin{figure}[h]
%\begin{center}
%\mbox{\psfig{figure=notes-4-fig-3.ps}}
%\caption{Double DES Meet in the Middle Attack}
%\label{fig:meet}
%\end{center}
%\end{figure}

\medskip
{\bf Triple DES:}
Let $DES_K(M)$ denote the DES--encryption
of message $M$ with key $K$. Let $DES^{-1}_K(M)$ denote the 
DES--decryption of message $M$ with key $K$.

Triple DES uses two keys $K_1$ and $K_2$ and encrypts a message 
$M$ as follows: 
\[ C = DES_{K_1}(DES^{-1}_{K_2}(DES_{K_1}(M))) \]

This method has an effective key of 90 bits.

An observation about this method is that if $K_1 = K_2$, we can get single
DES, so Triple DES is backwards compatible. This is why the middle 
encryption uses DES in decryption mode.

\section{Modes of operation of block ciphers}
We've covered how to encrypt a 64-bit code block with DES,
but we haven't discuss how to effectively use the algorithm to encrypt 
messages which don't happen to be 64 bits long.  To make DES work for
arbitrarily long messages and to prevent some of the security breaches present
in the most straightforward implementation of DES, other modes of operations 
have been invented.  The most popular ones are Electronic Code Book (ECB), 
Cipher Block Chaining (CBC), and Output Feedback Mode (OFM).  In the following
sections we discuss each of them in turn.
\subsection{Electronic Code Book (ECB)}

%\vspace{2.5in}
% @@ possibly a simple figure showing ECB
%Figure 1:  Electronic Code Book Mode

This is the most straightforward way of using DES\@.
To encrypt the message we divide the plaintext message into 8-byte blocks,
encrypt every block separately, and concatenate the resulting blocks.  If we
encrypt two identical blocks of ciphertext, the resulting ciphertext blocks
will be identical as well.  Therefore, we give an eavesdropper some information
about the encrypted data, and depending on the context, that information might
be sufficient to compromise the secrecy.

\subsection{Cipher Block Chaining (CBC)}

%\vspace{2.5in}
% @@ possibly a simple figure showing CBC
%Figure 2:  Cipher Block Chaining Mode 

CBC method avoids some of the possible problems encountered with the ECB
method.  CBC method produces different ciphertext blocks even if the plaintext
blocks are identical.  The input to a single DES
encryption module is not just the block of a plaintext, but it is also the XOR
of the plaintext block and the ciphertext produced in the calculation of the
previous plaintext block.  Since the first encryption module does not have a
predecessor, a random number known as the Initialization Vector (IV) is fed
into the first XOR.

In addition to using CBC method for data encryption, CBC can be used in the
calculation of a message authentication code (MAC).  For example, we can use
last $S$ bits of CBC encryption of a message $M$ under a key $K$ as the 
$MAC(M,K)$ of length $S$.  To make this method work, we need to also prepend 
the length of the
message to the message before we produce the MAC.  As we will see in the 
homework, if the length is appended or is missing altogether, the MAC is not
secure.

\subsection{Ouput Feedback Mode (OFM) / Counter Mode}

Ouput feedback mode acts like a pseudorandom number generator.  A message is
encrypted by XOR-ing the message with the output stream of the OFM module.  To
create a stream of pseudorandom bits, a 64-bit Initialization Vector $X$ is
encrypted under key $K$ creating $Y_{0}$. 
If we are encrypting $b$ bits of the message 
at the time (usually 8 bits) the left-most $b$ bits of $Y_0$
are used to XOR the $b$ bits of plaintext and then appended to the IV vector.
The IV vector is then shifted $b$ bits to the left and the whole process
is repeated to encrypt the next $b$ bits. So $Y_1$ is created and so on ...

%\vspace{2.5in}
% @@ possibly a simple figure showing counting mode
%Figure 3: Output Feedback Mode 

\subsection{Error Propagation}

When using ECB method for data encryption, if we make an error during 
transmission of a block, only the ciphertext and its corresponding decrypted
plaintext will be corrupted.  All other blocks will not be affected.  

If an error is made while transmitting a block encrypted using
the cipher block chaining method, some limited error propagation will occur.
If you look back at Figure 2, you will notice that every ciphertext block 
$C_{i}$  is involved in decryption of two message blocks $M_{i}$ and $M_{i+1}$.
Therefore, the decryption of a single corrupted ciphertext block will produce
two incorrect plaintext blocks.  

The output feedback mode has
1-to-1 error propagation property similar to electronic code book.  A single
corrupted ciphertext block will produce a single incorrect plaintext block.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
</pre></body></html>