Introduction to Cryptography PDF

Introduction to Cryptography More next semester Industrial Networks I CWE091-5 Keith Smyth  Introduction to Cryptography Simple definition: The art and science of protecting data. WhatIs.com: Cryptography...

Introduction to Cryptography More next semester Industrial Networks I CWE091-5 Keith Smyth  Introduction to Cryptography Simple definition: The art and science of protecting data. WhatIs.com: Cryptography is a method of storing and transmitting data in a particular form so that only those for whom it is intended can read and process it. Wikipedia: Cryptography is the practice and study of techniques for secure communication in the presence of third parties (called adversaries). More generally, it is about constructing and analysing protocols that block adversaries. Various aspects in information security such as data confidentiality, data integrity, authentication, and non-repudiation are central to modern cryptography. Modern cryptography exists at the intersection of the disciplines of mathematics, computer science, and electrical engineering. Applications of cryptography include ATM cards, computer passwords, and electronic commerce.  Goals of Cryptography Confidentiality – Keeping secret data secret from unauthorised access. Integrity. – Proving the data was not changed in any unauthorised way. Non repudiation. – Proving the data was created or modified by an individual. Authentication – is the process of determining whether someone or something is, in fact, who or what it says it is.  Two kinds of Cryptography Symmetric Asymmetric 1) Alice and Bob agree on a 1) Alice and Bob agree on a cryptosystem public-key cryptosystem 2) Alice and Bob agree on a key 2) Bob sends Alice his public 3) Alice takes her plaintext key message and encrypts it 3) Alice encrypts her message using the encryption using Bob’s public key and algorithm and the key. This sends it to Bob creates a ciphertext message 4) Bob decrypts Alice’s 4) Alice sends the ciphertext message using his private message to Bob key 5) Bob decrypts the ciphertext message with the same algorithm and key and reads it Symmetric Cryptography  Symmetric Key Algorithms Data Encryption Standard (DES) Triple DES (3DES) [3 keys or just 2 keys] Blowfish & Twofish (no Patents - public domain) IDEA RC4, RC5 and RC6 Advanced Encryption Standard (AES) Asymmetric Cryptography Two related but different keys. Encrypt with one key – decrypt with the other key. Key distribution challenge is resolved. Inefficient for large blocks of data. Slow.  Problems Symmetric Asymmetric Keys must be distributed in slow (~1000 times slower secret. than the symmetric). If a key is compromised, vulnerable to chosen- Eve (eavesdropper) can plaintext attacks.  decrypt any message in either direction.  pretend to be one of the parties. Does not scale well. A network requires a great number of keys.  Public-key algorithms Are not a substitute for symmetric algorithms Are generally not used to encrypt messages, they are used to encrypt keys (session keys used with symmetric algorithms to secure message traffic)  Asymmetric Key Algorithms Rivest Shamir Adleman (RSA) PGP (pretty Good Privacy) – Commercial software (owned by Symantec) Open Standard – PGP (RFC 4880) – Implemented as software: Gnu Private Guard (GPG) Lixux, Windows, Mac OS Very compatible with commercial PGP Elliptic Curve Cryptosystem (ECC)  Hybrid Cryptosystems 1) Bob sends Alice his public key. 2) Alice generates a random session key, K, encrypts it using Bob’s public key, and sends it to Bob. EB(K) 3) Bob decrypts Alice’s message using his private key to recover the session key. DB(EB(K)) = K 4) Both of them encrypt their communications using the same session key.  Hash Functions Compute a small value (hash) based on a large amount of data. Any other data produces a different hash. Used to protect the integrity of the data.  Hash Functions Protect the integrity of the data. Produces a ‘digest’ (fingerprint) Some popular Hash Algorithms – Message Digest (MD) (By Ronald Rivest) MD2, MD4 & MD5 Can have collisions – Secure Hash Algorithm (SHA) (By NSA) SHA, SHA1, SHA2 (SHA256, SHA-384, SHA-512) – HAVAL  Hash Functions SHA 256 My name is Keith Smyth My name is Keith Smyth My name is Keith Smyth! My name is keith smyth MD5 keith Keith  Digital Certificates Electronic document that contains information. Some of this information is: – Who issued the certificate. – Whom the certificate is issued to. – Valid until. – Public key. – Algorithms and key sizes used – Digital signature. (also contains information to verify integrity of the data).  https://www.theregister.co.uk/2017/02/23/google_ first_sha1_collision / Feb 2017 'First ever' SHA-1 hash collision calculated. All it took were five clever brains... and 6,610 years of processor time Google researchers and academics have today demonstrated it is possible – following years of number crunching – to produce two different documents that have the same SHA-1 hash signature. This proves what we've long suspected: that SHA-1 is weak and cant be trusted. Now researchers at CWI Amsterdam and bods at Google have managed to alter a PDF without changing its SHA-1 hash value. That makes it a lot easier to pass off the meddled-with version as the legit copy. You could alter the contents of, say, a contract, and make its hash match that of the original. Now you can trick someone into thinking the tampered copy is the original. The hashes are completely the same.