Computer Security Chapter 2: Cryptographic Tools

Study Notes

Provides confidentiality for transmitted or stored data, also known as conventional encryption or single-key encryption.
Requires a strong encryption algorithm and secure sharing of a secret key between sender and receiver.

Brute-Force Attacks:
- Involves trying all possible keys on ciphertext to find intelligible plaintext.
- On average, half of all possible keys must be tried for success.
Cryptanalytic Attacks:
- Exploits algorithm characteristics and knowledge of plaintext attributes to deduce plaintext or key.
- Success compromises all messages encrypted with that key.

Data Encryption Standard (DES):
- A 64-bit block size with a 56-bit key, produces a 64-bit ciphertext block.
- Considered insecure due to key length and has been extensively studied.
Triple DES:
- Enhances DES by applying the algorithm three times with either two or three keys.
- Key length of 168-bits increases security against brute-force attacks but is slower in software.
Advanced Encryption Standard (AES):
- Developed as a replacement for 3DES, using 128-bit data blocks with key sizes of 128, 192, or 256 bits.
- Selected Rijndael as the standard for its superior efficiency and security.

Symmetric encryption commonly applied to larger data sets rather than single blocks.
Electronic Codebook (ECB) Mode: Simplest form of block encryption but can expose regularities in plaintext, risking cryptanalysis.

Block Ciphers:
- Process input in fixed-size blocks, providing an output block for each input.
- More common in applications.
Stream Ciphers:
- Encrypt data continuously, outputting one element at a time, generally faster and more efficient.

Protects against alterations and verifies the authenticity and sequence of received messages.
Can occur without confidentiality; combining both is recommended for stronger security.

Proposed by Diffie and Hellman, operating on the basis of asymmetric keys (public and private).
Public key encryption allows anyone with the public key to decrypt messages.

RSA: Widely used algorithm for encryption and digital signatures.
Diffie-Hellman: Primarily for key distribution, not suitable for direct encryption or signatures.
DSS (Digital Signature Standard): Allows for signatures but not encryption of data.
Elliptic Curve: Supports signatures and encryption key distribution.

Easy key pair creation and utilization for encryption/decryption.
Computationally difficult for adversaries to derive private keys from public keys or recover original messages without the private key.

RSA (Rivest, Shamir, Adleman):
- Developed in 1977, the most accepted public-key encryption method, works with integers for plaintext and ciphertext.### Diffie-Hellman Key Exchange
Enables secure agreement on a shared secret key for symmetric encryption between two users.
Primarily focused on key exchange without providing encryption capabilities.

Digital Signature Standard (DSS)
- Provides functionalities for digital signatures using SHA-1.
- Not suitable for encryption or key exchange.
Elliptic Curve Cryptography (ECC)
- Delivers security comparable to RSA but requires significantly smaller keys.

Defined by NIST FIPS 186-4 as a cryptographic transformation mechanism that verifies:
- Origin authentication.
- Data integrity.
- Signatory non-repudiation.
Functions as a data-dependent bit pattern generated from a data block.

FIPS 186-4 specifies three algorithms:
- Digital Signature Algorithm (DSA).
- RSA Digital Signature Algorithm.
- Elliptic Curve Digital Signature Algorithm (ECDSA).

Random Number Requirements
- Must exhibit uniform distribution for statistical fairness.
- Should be unpredictable to prevent future number prediction.
- Independence is key; no single number should be inferred from others.
Pseudorandom Number Generation
- Often utilizes algorithmic methods, producing non-statistically random sequences.
- Pseudorandom numbers may pass randomness tests but remain predictable.
True Random Number Generator (TRNG)
- Draws from nondeterministic sources, such as physical phenomena (e.g., radiation).
- Often included in modern processors for enhanced randomness.

Commonly encrypts transmitted data, while encryption for stored data is less prevalent.
Historical data can be recoverable until disk sectors are reused, even after erasure.
Various approaches exist for encrypting stored data:
- Commercial encryption solutions.
- Back-end appliances.
- Library-based tape encryption.
- Background encryption for laptops/PCs.

Confidentiality and Symmetric Encryption
- Includes symmetric block encryption algorithms and stream ciphers.
Message Authentication and Hash Functions
- Discusses authentication using symmetric encryption and secure hash functions.
Public-Key Encryption
- Covers structure, applications, and requirements of public-key cryptography and asymmetric encryption algorithms.
Key Management
- Involves digital signatures, public-key certificates, and symmetric key exchanges using public-key encryption.
Random and Pseudorandom Numbers
- Highlights the importance of random number use in cryptographic applications.
Practical Application of Encryption
- Focuses on the encryption of stored data and the mechanisms to protect it effectively.