Key Exchange Protocol: P is at least 300 digits;

Xa and Xb at least 100 digits

Length of Encryption Keys: •Value of Encryption Algorithm = ability to resist attack

•Strength of Encryption Algorithm = Quality of algo + length of encryption key

•SSL encryption :

In mid 1990: 56bits

Now: min 128 bits(recommended) due to improving computing power

•No “magic” key length for all algos Protection of Encryption Keys: • Symmetric keys

– Must be restricted to as few people as possible

– Protected by a strong password, or encrypted again if needed

•Asymmetric keys

– Private key requires protection similar to symmetric key

– Public keys can be published, even on the Internet

Protecting Encryption Keys used by Applications: More difficult to protect keys that applications must be able to access directly

Countermeasures:

Separation of duties

Split custody

Use of a key encrypting key Cryptanalysis: Attacks on Cryptography Cryptanalysis is study of deciphering an encrypted message without access to the encryption key. Frequency analysis: This chart shows the frequency with which each letter in the English language is used.

Birthday attacks: Birthday paradox: In a group of 23 or more randomly choosen people, there is 50% probability that two of the people have same birthday.

Birthday attack on a hashing (message digest) algorithm.

Collision: Two messages are found to compute same hash value. Ciphertext only attack: Attacker has no knowledge of the contents of message.

Attacker must work from cipher text only.

Messages have fixed format headers.

Frequency analysis of the ciphertext. Chosen plaintext attack: Attacker is able to choose known plaintext message.

Encrpypt them with an unknown key.

Obtain ciphertext for those plaintext. Chosen ciphertext attack: Attacker gathers information about ciphertext.

Get it decrypted and obtain the plaintext.

Trail-and-error attack to deduce the key and/or decryption algorithm. Known plaintext attack: The attacker knows or can guess the plaintext for some parts of the ciphertext.

The task is to decrypt the rest of the ciphertext blocks using this information.

Man in the middle attack (MITM): A B Attacker Defence against MITM: Public key infrastructures

Latency examination

Digital signatures Replay Attack: Network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed.

Attacker intercepts and retransmits the data.

Masquerade attack. Defence against Replay Attack:

Session Tokens.

One-time passwords

Timestamping Side Channel Cryptanalysis: Information gained from the physical implementation of a cryptosystem.

General classes of side channel attack include:

Timing attack

Power monitoring attack

Electromagnetic attacks

Acoustic cryptanalysis

Cache attacks and related methods

Differential fault analysis Countermeasures:

Reduce the release of such information or access to those relationships.

Jam the emitted channel with noise

Power line conditioning and filtering can help deter power monitoring attacks, although such measures must be used cautiously since even very small correlations can remain and compromise security.

Physical enclosures can reduce the risk of surreptitious installation of microphones (to counter acoustic attacks) and other micro-monitoring devices (against CPU power draw or thermal imaging attacks). Key Management: Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between authorized parties. Need of Key management: The objective of key management is to maintain keying relationships and keying material in a manner that counters relevant threats.

To enhance the usability of cryptographic technology, provide scalability across cryptographic technologies, and support a global cryptographic key management infrastructure. Threats Compromise of confidentiality of secret keys

Compromise of authenticity of secret or public keys.

Unauthorized use of public or secret keys Key management life cycle activities: User Registration & Initialization Key Registration. Life Cycle of Encryption Keys Key Creation Key Protection & Custody Key Rotation Key destruction Key Escrow Key Backup & Update Archival Key De-Registration Key Recovery Message Digest A message Digest , or a hash is the result of a cryptographic operation on a message or a file.

Principles of message Digest :

•The original message is of variable-length.

•The message digest is of a fixed-length.

•One way hash function.

•Collision-free hash function.

•The algorithm is relatively simple, so when computerized it is not CPU-intensive.

•The calculated digest is smaller than the item it represents.

Message digests to guarantee that no one has tampered with a message during its transit over a network The most common message digest algorithms designed for 32-bit computer systems are MD4, MD5 and Secure Hash Algorithm.

SHA offers —increasing levels of security, and therefore CPU usage. Digital signature: A piece of data encrypted with a private key is called a digital signature.

A digital signature is a method used to verify the authenticity and integrity of a message or document.

Requires public key cryptography.

Verifies identity of signer Application of message digests or hash functions is digital signatures. Computing a digital signature for a long message is very time-consuming. So, instead of digitally signing the message, the message's hash is signed. Prevention of repudiation. Creating Digital Signature Verifying Digital Signature Digital Certificates A digital certificate is an item of information that binds the details of an individual or organization to their public key.

The most widely accepted format for digital certificates is the X.509 standard. Certificate Authorities CertificateAuthorities (CAs), are responsible for the issuing of digital certificates.

A CA is a commonly known trusted third party, responsible for verifying both the contents and ownership of a certificate Difference between Digital signatures and digital certificates: A digital certificate is an electronic "credit card" that establishes your credentials when doing business or other transactions on the Web. It is issued by a certification authority (CA).

It contains your name, a serial number, expiration dates, a copy of the certificate holder's public key (used for encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real.

Digital certificates are certificates issued by CA like VeriSign. Encryption Alternatives: Steganography.

Watermarking. Steganography Message can be hidden in image,sound files,video file or other human read medium.

The inclusion of the message will produce slight variations that may not be noticeable.

Many “stego” tools available are blindside, MP3Stego

Blindside is an application of steganography that allows one to conceal a file, or set of files within a standard computer image.

MP3Stego will hide information in MP3 files during the compression process.

It is considered as visible form of steganography.

It is the practice of inserting a mark, image or a message onto a file.

It is done as a means of claiming or asserting ownership of the file. Watermarking: Application of Cryptography SplashID is an iPhone application that stores important information on your iPhone.

The data is stored on an encrypted database that is password protected.

The data is encrypted using 256-bit blowfish encryption on both the handheld and the desktop. Types of Encryption: Information system utilize cryptography in two ways when storing data and when transmitting data.

Two types of encryption :

1. Block ciphers

2. Stream ciphers Block ciphers: Use a symmetric key to encrypt and decrypt the data.

Operate on fixed–length data called block and each block is encrypted separately. Typical uses for block ciphers

– - Files, e–mail messages, text communications, web, VPN

Well known encryption algorithms

– - DES, 3DES, AES, CAST, Twofish, Blowfish, Serpent Block ciphers (continued): Block ciphers (continued): Modes of operation:

Several modes of operation have been invented which allow block ciphers to provide confidentiality.

Mode: ECB, CBC, CFB, OFB, Counter etc.

Initialization Vector (IV):

Needed to encrypt the first block.

All modes except ECB require an initialization vector (IV).

In order to be secure, IV must be random and can never be reused. Electronic Code Book (ECB): The plaintext is broken into blocks, P1, P2, P3, ...

Each block is encrypted independently:

Ci = EK(Pi) Remarks on ECB Strength:

– - It’s simple.

Weakness:

– - If the same message (e.g., an SSN) is encrypted (withthe same key) and sent twice, their ciphertexts are the same.

Typical application: secure transmission of short pieces of information (e.g. a temporary encryption key) Cipher Block Chaining (CBC) – message is broken into blocks

– but these are linked together in the encryption operation

– each previous cipher blocks is chained with current plaintext block, hence name

– use Initial Vector (IV) to start process

Ci = DESK1(Pi XOR Ci-–1)

C–1 = IV Remarks on CBC Strengths:

– - The encryption of a block depends on the current and all blocks before it. So, repeated plaintext blocks are encrypted differently.

Weakness:

– - Initialization Vector (IV)must be known to both the sender & receiver

– - Each ciphertext block depends on all message blocks. Thus a change in the message affects all ciphertext blocks

Typical application: bulk data encryption, authentication Cipher FeedBack (CFB) – message is treated as a stream of bits

– added to the output of the block cipher

– result is feedback for next stage (hence name)

– standard allows any number of bit (1,8 or 64 or whatever) to be feedback denoted CFB–1, CFB–8, CFB–64 etc

– is most efficient to use all 64 bits (CFB–64)

Ci = Pi XOR DESK1 (Ci–1)

C–1 = IV Remark on CFB Strengths:

– - Appropriate when data arrives in bits/bytes.

Weakness:

– - A corrupted ciphertext segment during transmission will affect the current and next several plaintext segments.

Typical application: stream data encryption, authentication Output FeedBack (OFB) – message is treated as a stream of bits

– output of cipher is added to message

– output is then feedback (hence name)

– feedback is independent of message

– can be computed in advance

Ci = Pi XOR Oi

Oi = DESK1(Oi–1)

O–1 = IV Remark on OFB Strengths:

– - more resistant to transmission errors; a bit error in a ciphertext segment affects only the decryption of that segment.

Weakness:

– - Cannot recover from lost ciphertext segments; if a ciphertext segment is lost, all following segments will be decrypted incorrectly (if the receiver is not aware of the segment loss).

– - IV should be generated randomly each time and sent with the ciphertext.

Typical application: stream encryption over noisy channels Counter (CTR) – a “new” mode, though proposed early on

– similar to OFB but encrypts counter value rather than any feedback value

– must have a different key & counter value for every plaintext block (never reused)

Ci = Pi XOR Oi

Oi = DESK1 (i) Remark on CTR Strengths:

– - Needs only the encryption algorithm

– - Fast encryption/decryption; blocks can be processed (encrypted or decrypted) in parallel; good for high speed links

Weekness:

– - IV should not be reused.

Typical application: high–speed network encryptions. Stream Cipher Operates on continuous stream such as video or audio communication channel

Typically uses Exclusive–OR (XOR) operation that can be performed very quickly by a computer

Most common stream cipher algorithm is RC4.

process message bit by bit (as a stream)

have a pseudo random keystream

combined (XOR) with plaintext bit by bit

randomness of stream key completely destroys statistically properties in message

Ci = Mi XOR StreamKeyi

but must never reuse stream key otherwise can recover messages. Stream Cipher (Continued) Encryption: simple XOR with key: Decryption: simple XOR with the same key: Symmetric Key Cryptography Simplest and fastest type of encryption

Uses single common key to encrypt and decrypt the message.

Two parties must somehow exchange the key in secure manner .

aka Secret key Cryptography.

Speed is biggest advantage over asymmetric. Symmetric Key Cryptography (Continued) Encryption algorithms that use symmetric keys

– - DES, 3DES, AES, Twofish, Blowfish, IDEA, RC5 Asymmetric Key Cryptography A user has two keys: a public key and a private key.

A message can be encrypted with the public key and decrypted with private key to provide security.

A message can be encrypted with the private key and decrypted with the public key to provide signatures.

Public key can be made available easily to anybody and this avoids the problem of exchanging single key. Uses of public key cryptography Encrypt message to recipient

Sign message

Sign and encrypt message

Well known Asymmetric Key Encryption Algorithms are RSA, EI Gamal, and Elliptic Curve. Encrypt message to recipient Sign and encrypt message Uses for Cryptography File encryption:

PGP and GPG

WinZip (version 9 uses AES)

EFS (encrypting file system) for Windows Uses for Cryptography (continued): Encrypted volumes and disks:

Truecrypt for Windows, Mac, Unix

Bitlocker for Windows Vista

PGP Disk

SafeBoot Uses for Cryptography (continued): Uses for Cryptography (continued): Uses for Cryptography (continued): E-mail:

PGP / GPG – asymmetric key (public key crypto)

S/MIME (Secure / Multipurpose Internet Mail Extensions) – certificate based

PEM (Privacy Enhanced Mail) not widely used, requires a single global PKI (which was never implemented)

MOSS (MIME Object Security Services) not widely used Web browsing -– protects session contents from eavesdropping:

SSL / TLS (Secure Sockets Layer / Transport Layer Security)

-40-512 bit encryption with secure key exchange

Server authentication common, client authentication rare

Protecting network communications:

SSH:

Replacement for telnet, rsh, rlogin

Secure FTP

SSL:

Protects web browser traffic

IPsec:

Encrypts all packets between established pairs of hosts

Cryptography What is Cryptography ? Cryptography (from Greek kryptos means "hidden" and graphy "writing") is the practice and study of hiding information.

It conceals data to protect it against unauthorized access.

Substitution cipher first used by Caesar for battlefield communications. Modern Cryptography Cryptography is the science of information security.

In today's computer-centric world, cryptography has become mathematical with the ciphers involved drawing from computer science and number theory.

Uses of cryptography include mobile phones, passwords, SSL, smart cards and is heavily used by many web applications. Objectives Confidentiality: the information cannot be understood by anyone for whom it was unintended.

Integrity: the information cannot be altered in storage or transit between sender and intended receiver without the alteration being detected. Objectives (Continued) Non-repudiation: the creator/sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information

example: Financial or e-commerce applications

Authentication: the sender and receiver can confirm each other’s identity and the origin/destination of the information

example: SSL Encryption Terms and Operations Plaintext – an original message.

Ciphertext – an encrypted message.

Encryption – the process of transforming plaintext into ciphertext (also encipher).

Decryption – the process of transforming ciphertext into plaintext (also decipher).

Encryption key – the text value required to encrypt and decrypt data. Methods of Encryption Substitution

Transposition

Monoalphabetic

Polyalphabetic

Running-key

One time pads Substitution Cipher A substitution cipher is a method of encryption by which units of plaintext are substituted with ciphertext .

The receiver deciphers the text by performing an inverse substitution.

This table shows “VOYAGER” being encrypted with the Caesar substution cipher: Monoalphabetic Cipher A monoalphabetic cipher is a type of substitution cipher where one alphabetic character is substituted for another.

Substitution can be more random instead of just shift to the left or right.

Plaintext

“CAGED” Ciphertext

“RWPBT”

Subject to frequency analysis attack Polyalphabetic Cipher This cipher uses two or more substitution alphabets to encipher plaintext. Transposition Cipher The letters of the plaintext are shifted about to form the cryptogram.

Plaintext

“FOR EXAMPLE”

pick a number of rows,

and then write your text as a zig-zag across those rows

rail fence cipher reading the rows straight across, left to right

Ciphertext

“FXLOEAPERM”

Subject to Frequency Analysis Attack

Running Key Cipher Alphabetic characters are converted to numeric values

(A=0, B=1, C=2,…..,Z=25)

Modulo arithmetic is used to keep results in range 0-26

–Add 26 if results < 0; subtract 26 if results > 26 One-time Pad Works like running key cipher, except that key is length of plaintext,and is used only once

Also known as Vernam-cipher or the perfect cipher

Highly resistant to cryptanalysis Side Channel Cryptanalysis: Digital signature (continued): Thank You.... By:

Snehal Godse

Amol Pawar

Saurabh Thakur

Rashmi Wankhede Key Management:

### Present Remotely

Send the link below via email or IM

CopyPresent to your audience

Start remote presentation- Invited audience members
**will follow you**as you navigate and present - People invited to a presentation
**do not need a Prezi account** - This link expires
**10 minutes**after you close the presentation - A maximum of
**30 users**can follow your presentation - Learn more about this feature in our knowledge base article