Cryptography: Symmetric Encryption

Cryptographic Tools

• The chapter provides an overview of cryptographic tools, including encryption, authentication, digital signatures, and random number generation.

Confidentiality with Symmetric Encryption

• Symmetric encryption is a universal technique for maintaining confidentiality of transmitted or stored data.
• Symmetric encryption is also referred to as conventional or single-key encryption.
• Secure use requires a strong encryption algorithm and securely obtained and maintained secret keys by both sender and receiver.
• A simplified model involves plaintext input, an encryption algorithm using a secret key, a transmitted ciphertext, a decryption algorithm using the same secret key, and plaintext output.

Attacking Symmetric Encryption

• Cryptanalytic attacks rely on the algorithm's nature and plaintext characteristics to deduce specific plaintexts or keys.
• Success in cryptanalysis compromises all future and past messages encrypted with that key.
• Brute-force attacks involve testing all possible keys until an intelligible translation is obtained.
• On average, half of all possible keys must be tried for success.

DES, Triple DES, and AES

• DES has a plaintext block size of 64 bits, a ciphertext block size of 64 bits, and a key size of 56 bits.
• Triple DES has a plaintext block size of 64 bits, a ciphertext block size of 64 bits, and a key size of 112 or 168 bits.
• AES has a plaintext block size of 128 bits, a ciphertext block size of 128 bits, and a key size of 128, 192, or 256 bits.

Data Encryption Standard (DES)

• DES is the most widely used encryption scheme which is also known as Data Encryption Algorithm (DEA) and is defined in FIPS PUB 46.
• It uses a 64-bit plaintext block with a 56-bit key to produce a 64-bit ciphertext block.
• Concerns about algorithm strength exist as the use of a 56-bit key was broken by the Electronic Frontier Foundation (EFF) in July 1998.

Triple DES (3DES)

• The basic DES algorithm repeats three times using either two or three unique keys.
• In 1985 Triple DES was first standardized for use in financial applications in ANSI standard X9.17.
• Attractions include a 168-bit key length, which resists brute-force attacks, and the same underlying encryption algorithm as DES.
• Drawbacks of using Triple DES is that the algorithm is sluggish in software and uses a 64-bit block size.

Advanced Encryption Standard (AES)

• AES became necessary as a replacement for 3DES.
• In 1997, NIST called for proposals for a new AES and Rijndael was selected in November 2001.
• The goals of AES include having better security, improved efficiency and being a symmetric block cipher
• AES utilizes 128 bit data and 128/192/256 bit key and has now been published as FIPS 197.

Practical Security Issues

• Symmetric encryption is typically applied to data units larger than a single 64-bit or 128-bit block.
• Electronic codebook (ECB) mode is the simplest approach to encrypting multiple blocks. Each block of plaintext is encrypted using the same key, and cryptanalysts might exploit regularities in the plaintext.
• New techniques were developed to increase the security of symmetric block encryption for large sequences.
• These techniques overcome the weaknesses of ECB.

Block and Stream Ciphers

• Block ciphers process input in blocks of elements at a time, producing an output block for each input block, and can reuse keys, which makes them more common.
• Stream ciphers process input elements continuously, producing one element at a time.

Public Key Encryption

• Public-key encryption was publicly proposed by Diffie and Hellman in 1976.
• Public-key encryption is based on mathematical functions and is asymmetric, using two separate keys: a public key for others to use and a private key.
• Public-key encryption requires an accepted protocol for distribution.

Public Key Encryption Details

• Plaintext is the readable message or data that is fed into the algorithm as input.
• The Encryption algorithm performs transformations on the plaintext.
• Public and private key are a pair of keys, one for encryption, one for decryption.
• Ciphertext is the scrambled message produced as output.
• The Decryption Key produces the original plaintext.

Public-Key Cryptography

• A user encrypts data using their own private key.
• Anyone with the corresponding public key can decrypt the message.

Applications for Public-Key Cryptosystems

• RSA can be used for Digital Signatures, Symmetric Key Distribution and Encryption of Secret Keys.
• Diffie-Hellman can be used Symmetric Key Distribution.
• DSS may be used for Digital Signatures
• Elliptic Curve may be used for Digital Signatures, Symmetric Key Distribution and Encryption of Secret Keys

Requirements for Public-Key Cryptosystems

• It must be computationally easy to create key pairs.
• It must be useful if either key can be used for each role.
• It must be computationally easy for a sender, knowing the public key, to encrypt messages.
• It must be computationally infeasible for an opponent to determine the private key from the public key.
• It must be computationally easy for a receiver, knowing the private key, to decrypt the ciphertext.
• It must be computationally infeasible for an opponent to recover the original message.

Asymmetric Encryption Algorithms

• RSA, developed in 1977, is the most widely accepted approach to public-key encryption, in which the plaintext and ciphertext are integers between 0 and n-1.
• Diffie-Hellman key exchange algorithm enables two users to securely reach an agreement about a shared secret that can be used as a secret key, but it is limited to the exchange of the keys.
• Digital Signature Standard (DSS) provides only a digital signature function using SHA-1 and cannot be used for encryption or key exchange.
• Elliptic curve cryptography (ECC) has security like RSA, but with much smaller keys.

Message Authentication

• Message authentication protects against active attacks.

Secure Hash Functions

• Secure Hash Functions provide an alternative to the message authentication code.

Hash Function Requirements

• Hash functions must be applicable to a block of data of any size.
• Hash functions must produce a fixed-length output.
• H(x) should be relatively easy to compute for any given x.
• It must be computationally infeasible to find x such that H(x) = h, and y ≠ x such that H(y) = H(x).
• It must be computationally infeasible to find any pair (x,y) such that H(x) = H(y).

Security of Hash Functions

• Two approaches used to attack a secure hash function are cryptanalysis and brute-force attacks.
• SHA is the most widely used hash algorithm.
• Additional secure hash function applications include password storage and intrusion detection..

Digital Signatures

• Digital Signatures are used for authenticating the source and data integrity.
• Digital Signatures are created by encrypting the hash code with the private key.
• Digital Signatures do not provide confidentiality. Therefore, even in the case of complete encryption, the message is safe from alteration but not eavesdropping.

Digital Envelopes

• Protects a message without needing a pre-existing shared secret key.
• Functions similarly to a sealed envelope that contains an unsigned letter

Random Numbers

• Random numbers are for generating keys for public-key algorithms and stream keys for symmetric stream ciphers.
• Random numbers are used for generating symmetric keys for use as a temporary session key or in creating a digital envelope.

Random Number Requirements

• Randomness, including uniform distribution and independence, and unpredictability are requirements of Random numbers.

Random versus Pseudorandom

• Cryptographic applications often use algorithmic techniques for generating random numbers.
• Pseudorandom numbers are sequences produced that satisfy statistical randomness tests but are likely to be predictable.
• True random number generators (TRNG) use a nondeterministic source to produce randomness, often measuring unpredictable natural processes (e.g., radiation, gas discharge, leaky capacitors).

Practical Application: Encryption of Stored Data

• It is more common to encrypt transmitted data than it is for stored data.
• Approaches to encrypting stored data include using a commercially available encryption, back-end appliance, library-based tape encryption and background laptop/PC data encryption