Cryptography Flashcards
1
Q
Kerchoffs’ Principle
A
if:
* the encryption algorithm was well designed
* the N bit long keys are kept secret
* the algorithm is executed by a trusted party
then:
the only possible attack us the brute force attack which requires a number of trials equal to T = 2^{Bit}
2
Q
Symmetric cryptography: formulas, characteristics, related problems
A
- a.k.a secret key crypto
- K1 = K2
- C = enc(K, P)
- P = enc^-1(K, C)
- low computational load -> used for data encryption
- problem: how to share the secret key among sender and receiver
3
Q
Symmetric cryptography for blocks: algorithms list
A
DES, 3-DES, IDEA, AES
4
Q
DES and variants
A
Symmetric cryptography for blocks
- Data Encryption Standard
- it requires: XOR, shift, permutation -> designed to be efficient in hardware
DES
* key length: 56 + 8
* block length: 64
* time T
3-DES
* key length: 112 + 16 or 168 + 24 -> 112 bit strength
* block length: 64
* time 3T
* it is DES applied three times using 2 or 3 keys of 56 bit
* usually applied in the EDE mode: encryption with K1, decryption with K2, encryption with K3 or K1
* if 2 keys: if the attacker has 2^59B of memory available the strength is of 56 bit, otherwise it is of 112 bit
* if 3 keys: if the attacker has 2^59B of memory available the strength is of 112 bit, otherwise it is of 168 bit
5
Q
IDEA
A
Symmetric cryptography for blocks, famous for PGP
6
Q
AES
A
Symmetric cryptography for blocks
- Advanced Encryption Standard
- key length: 128 - 192- 256
- block length: 128
7
Q
Important things about the XOR operation
A
- it is the inverse of itself
- it is the confusion operator because P(0) = P(1) = 50%
- primitive function available on all CPU
8
Q
Why 2DES is not used?
A
Double application of encryption algorithms s subject to a known-plaintext attack named MITM which permits to decrypt data with at most 2^{N+1} attempts if the key is N bit long. This means that only the encryption time is doubled while the effective key length increases by just one bit
Demonstration
9
Q
How can we apply a block algorithm?
A
There are different application modes:
* if data to encrypt > algorithm block size: ECB, CBC
* otherwise: padding, CTR, CTS (not sure CTS is a mode)
These are not algorithms but modes of application!!!!
10
Q
ECB: extended name, formula, characteristics and problems
A
- Electronic Code Block
- D > B
- C_i = enc(K, P_i) where P_i’s length is the block size length
- P_i = enc^-1(K, C_i)
Advantages
* no propagation of errors: an error in transmission causes an error in the decryption of a single block without propagating to the other blocks;
* CPU parallelization: it is possible to work on several blocks at the same time.
Disadvantages
* swapping attacks: encryption does not depend on the position of the block) it is possible to swap two blocks, or move any block, without this being discovered;
* known-plaintext attacks: identical blocks are encrypted in the same way; an attacker can build a database containing the encryption outputs with all the possible keys of a recurring block (eg header of a Word document), and then find the key by comparing each block of ciphertext for the recurring block (pattern).
11
Q
CBC: extended name, formula, characteristics and problems
A
- Cypher Block Chaining
- D > B
- C_i = enc(K, P_i XOR C_{i-1})
- C_0 = IV, random value that has to be known by the receiver -> there are two opposite approaches: IV in clear, IV encrypted
- P_i = enc^-1(K, C_i) XOR C_{i-1} -> XOR is the inverse of itself
characteristics:
- it tries to solve ECB’s problems
- no undetected swapping permitted
- one error in transmission generates an error at the decryption of two block
12
Q
Padding: characteristics and problems
A
Bits are added to the last block (derived from the division) till the block length is reached
Characteristics:
* some offer minimal integrity control
* if data length is minor then the ad hoc techniques are preferred such as CTR
* EVEN IF THE PLAINTEXT IS AN EXACT MULTIPLE OF THE BLOCK PADDING MUST BE ADDED TO AVOID ERROR IN THE INTERPRETAZION OF THE LAST BLOCK -> 1≤ L ≤ B -> the biggest padding has to be done when no padding is needed
* attacks also depend from the padding type chosen
Problems:
* the sent/stored data are bigger than the original ones -> a solution could be using CTS
* which value have the padding bits? There are different padding TECHNIQUES
13
Q
CTR: extended name, formula, characteristics and problems
A
- Counter Mode
- D < B -> data are small themselves so they are made of N bits -> variable length, a group
characteristics/formula:
- a nonce, a counter and a function are required
- at the sender and at the receiver there is a synchronized register in which a computation f(nonce, counter) is performed. the result is the key and the leftmost bits are taken
- the key is XORed with the plaintext
- no error propagation
- direct access to each block
Example: if we assume that f is the concatenation…
at the sender:
for (x = 0; x < data_size; x++) {
ctext[x] = ptext[x]
XOR
MSB( enc(K, nonce || x) )
}
If CTR is byte-oriented it can be considered a stream algorithm
14
Q
CTS: extended name, formula, characteristics and problems
A
Cyphertext Stealing
- it is a technique used when we cannot have encrypted data bigger than the original data or when we cannot use padding
- very important for storage encryption
- the computation time slightly increases
Execution:
- the last block is filled with bytes taken from the second to last block -> the second to last block becomes a partial one
- blocks are encrypted
- the last block and the second to last block positions are exchanged
15
Q
Which padding techniques are there?
A
- … 0x00 0x00 0x00 -> if the message length is known
- original DES -> one 1 followed by many 0, …1000000
- one byte with value 128 followed by null bytes, … 0x80 0x00 0x00
- techniques depending explicitly from the data length (L):
- Schneier: … 0x00 0x00 0xL
- SSL/TLS: … 0xL 0xL 0xL
- SSH2: random bytes, … r r 0xL -> equal data give different cypher texts
- IPsec/ESP: progressive number, … 0xL-2 0xL-1 0xL
- bytes with value L-1: … 0xL-1 0xL-1 0xL-1
16
Q
CTS - example with CBC
A
slide
17
Q
Symmetric Stream Encryption Algorithms: characteristics, problems, difference between an ideal and a real algorithm, main algorithm list
A
They work on a data stream without requiring the split in block, typically they work on a bit or on a byte at a time
- ideal algorithm: one-time pad, that means that a key as long as the message is required
- real algorithms: they use a key that is generated by pseudo-random key generators that are synchronized at the sender and at the receiver. The generators use a shared seed to generate the key. This seed is the main secret shared between sender and receiver.
characteristics and problems:
- very fast
- operations are not complex
- subject to cancellation attack and others
Algorithms: RC4 (old), Salsa20, ChaCha20
18
Q
Salsa20 and ChaCha20
A
Symmetric Stream Encryption Algorithms
ChaCha20 is an improvement of Salsa20: more diffusion of bits, faster on some architectures
They are both based on:
- key: 128 or 256
- + nonce + counter
- base operation: ARX (Add, Rotate, XOR). Rotate is not available on all CPUs so if you do not have it by default and you have to implement it it will be slower
Salsa20:
- base function: f(key256, Nonce64, Counter64) = 512-bit kystream block
- O(1) decryption of any block at random
- Salsa20 perfora 20 mixing rounds of the input
ChaCha20:
- 96 bit nonce
- 32 bit block counter -> limit of 2^32 = 256GB 64 bit block
- used by Google and OpenSSH
19
Q
Minimum secure key length for symmetric and asymmetric algorithms
A
symm: 256 to have high security, ok 128
asymm (FFC, IFC): 4096 (2048)
asymm (ECC): 512 (256)
20
Q
Key distribution for symmetric cryptography
A
- OOB
- by means of key exchange algorithms
21
Q
Asymmetric cryptography: characteristics, main algorithms
A
- a.k.a public key crypto
- two different keys, they form a key-pair and they are dependent one from the other -> SK + PK
- one of the keys is used for encryption, the other one for decryption -> they are keys with inverse functionality
- high computational load
- used to encrypt little data such as keys to distribute or to create digital signatures
- main algorithms: DH, RSA, DSA
- encryption with SK -> digital signature
- encryption with PK -> confidentiality
22
Q
Digital Signature: how is it reached and which security properties does it have
A
It is reached via asymmetric encryption by using the private key to encrypt the data. Usually the encryption is done on the data summary and not directly on data.
PROVIDES DATA AUTHENTICATION AND INTEGRITY + NON-REPUDIATION
23
Q
DSA
A
Digital Signature Algorithm (public key algorithm)
- The security challenge is the discrete logarithm problem, where the attacker sees the result of exponentiation but does not know the base.
- DSA is used exclusively for digital signatures. It employs a one-way lossy compression function, meaning the original plaintext cannot be recovered from the signature
24
Q
RSA
A
Rivest - Shamir - Adleman public key algorithm
- Its security is based on the mathematical difficulty of factorizing large numbers, specifically the product of two large prime numbers -> There is no known polynomial-time solution for factorizing very large numbers,
- can be used for both digital signatures and encryption (confidentiality)
25
Key distribution for asymmetric cryptography: concept and problem
- the private key should never be disclosed
- the public one should be distributed as widely as possible
Problem: who guarantees the binding between the public key and the identity that owns it?
solutions:
1. OOB
2. the public key is distributed by means of a public-key certificate
26
DH
**KEY AGREEMENT ALGORITHM**
- first public-key algorithm invented
- A and B choose / agree two public integers p (prime, large) and g (generator) such that:
1 < g < p (typically g=2, 3, or 5)
- length of DH key = number of bits of p
- A arbitrarily chooses an integer x>0 and computes: X=g^x mod p
- B arbitrarily chooses an integer y>0 and computes: Y=g^y mod p
- A and B exchange (publish) X and Y
- A computes K_A =Y^x mod p
- B computes K_B =X^y mod p
- result: K_A = K_B = g^{xy} mod p
characteristics and problems:
- resistant to the sniffing attack: if the attacker sniffs A and B he cannot get to know the key because he also needs x and y
- if the attacker can manipulate the data then it is possible to make a man-in-the-middle attack; in this case it requires pre-authentication. One common approach is the use of digital certificates for DH keys. MQV (Menezes-Qu-Vanstone) is an extension of the Diffie-Hellman protocol that incorporates authentication directly into the exchange process, enhancing its security against MITM attacks.
27
DH MITM attack
28
Elliptic Curve Cryptography: characteristics and modified algorithms
Instead of using modular arithmetic, the operations are executed on the surface of a 2D (elliptic) curve.
in this way the problem of discrete logarithm on such a curve is more complex than the problem in modular arithmetic and this leads to use shorter keys (about 1/10).
- digital signature = ECDSA
- key agreement = ECDH
- authenticated key agreement = ECMQV
- key distribution = ECIES (EC Integrated Encryption Scheme)
29
Main concept of integrity
If someone intercepts an encrypted communication he cannot read it but he can modify it -> INTEGRITY IS ABOUT DETECTION
30
Message digest: what is it, which characteristics must it have
A message digest is a **fixed-length “summary”** of the message to be protected (of any length)
It must be:
* fast to compute
* impossible or very difficult to invert
* difficult to create “collisions”
The digest is often used to avoid performing operations on the whole message, especially when the message is very large (e.g. because public-key cryptography is very slow)
Digest can be calculated in many ways, but usually via a CRYPTOGRAPHIC hash function
31
How does a cryptographic hash function work in general?
- split the message M in N blocks M_1 ...M_N
- iteratively apply a base function (f)
V_k =f(V_{k-1}, M_k) with V_0 =IV and h=V_N
THE DIGEST IS THE RESULT OF THE LAST ITERATION
32
Cryptographic hash algorithms
**name block digest definition notes**
**MD2** 8 bit 128 bit RFC-1319 obsolete
**MD4** 512 bit 128 bit RFC-1320 obsolete
**MD5** 512 bit 128 bit RFC-1321 obsolete
**RIPEMD-160** 512 bit 160 bit ISO/IEC 10118-3 old + rare
**SHA-1** 512 bit 160 bit FIPS 180-1 sufficient
**SHA-224** 512 bit 224 bit FIPS 180-2, FIPS 180-3 good
**SHA-256** 512 bit 256 bit FIPS 180-2, FIPS 180-3 good
**SHA-384** 512 bit 384 bit FIPS 180-2, FIPS 180-3 good
**SHA-512** 512 bit 512 bit FIPS 180-2, FIPS 180-3 good
**SHA-3** 1152-576 224-512 FIPS 202, FIPS 180-4 excellent
33
What is aliasing and how is it related to the digest length?
- md1 = h(m1)
- md2 = h(m2)
if m1 ≠ m2 then we’d like to have md1 ≠ md2 to avoid aliasing
If the algorithm is well designed and generates a digest of N bits, then the probability of aliasing is:
P_A = 1 / (2^N_bit)
Thus, digests with many bits are required (because statistical events are involved)
34
The birthday attack
This is related to the message digest.
A N-bit digest algorithm is insecure when more than 2**(N/2) digests are generated because the probability to have two messages with the same digest is P_A ~ 50%
35
When do we have a balanced crypto system?
A cryptosystem is “balanced” when the encryption and digest algorithms have the same resistance:
- SHA-256 and SHA-512 have been designed for use respectively with AES-128 and AES-256
- note: SHA-1 (i.e. SHA-160) matched Skipjack-80
36
KDF (Key Derivation Function)
A cryptographic key must be random (each bit has 50% probability to be 0 or 1) but users typically insert passwords (or better passphrases) guessable and not random.
To solve this problem we can use a key derivation function:
- K = KDF(P, S, I) where
- P = password or passphrase
- S = salt (to make K difficult to guess given P)
- I = number of iterations of the base function (to slow down the computation and make life complex for attackers)
There are some KDF based upon cryptographic hash functions.
An example is PBKDF2: it uses SHA-1, |S| > 64, I ≥ 1000
Another examples is HKDF, based on HMAC
37
PBKDF2. Can it be attacked?
PBKDF2 can be attacked because the number of iterations may be large but this requires only a lot of computation but not a lot of RAM
38
Password Hashing Competition (PHC)
PBKDF2 can be attacked because C may be large but this requires only a lot of computation but not a lot of RAM.
Hence it can be attacked by ASIC or GPU -> we need to increase the RAM needed for the attack -> public competition launched in 2013
The winner was Argon2
39
MAC, MIC, MID
**They are codes**
- to guarantee the integrity of messages, a code is added to the message: MIC (Message Integrity Code)
- often integrity is not useful without authentication, thus the code (ensuring both security properties) is named: MAC (Message Authentication Code)
- to avoid replay attacks, a unique identifier can be added to the message: MID (Message IDentifier)
40
How does Authentication by means of keyed-digest work?
Data are sent along with a digest calculated not only on data themselves but also on a shared secret key.
- (sender) d = digest( K, M )
- (transmission) M || d
- (receiver) d' = digest( K, M )
- (verification) if ( d == d' ) then OK else ALARM!
Only who knows the key can compare the transmitted digest with the digest calculated on the received data.
Advantages:
- only one operation (digest)
- few additional data
- authentication + integrity
41
Which properties does a keyed-digest give?
authentication + integrity
42
HMAC: characteristic, pros and cons
HMAC is a keyed digest that is BASED ON a base hash function.
HMAC provides: integrity through digest and DATA authentication (but not of the sender since anyone could have sent that hash)
base hash function H:
- B byte block
- L byte output, with B > L
definitions:
- ipad = 0x36 repeated B times
- opad = 0x5C repeated B times
- if |K|>B then K'=H(K) else K'=K
- if |K'|
43
CBC-MAC: how does it work, problems
It is a MAC (keyed digest) variant which exploits a block-oriented symmetric encryption algorithm, in CBC mode with NULL IV, taking as MAC the last encrypted block
- message M split in N blocks M_1 ...M_N
- iterations:
V0 = 0
for (k=1...N) do Vk = enc (K, M_k XOR V_{k-1} )
- cbc-mac = VN
DES-based CBC-MAC was the Data Authentication Algorithm (standard FIPS 113, ANSI X9.17)
It is secure **only for fixed-length messages**, for other cases use CMAC or OMAC
Possible attack against variable-length messages:
t = E-cbc-mac( K, M )
and
t' = E-cbc-mac( K, M' )
then I can create M'' with t'' = E-cbc-mac( K, M'' )' ... without knowing K (!!!)
Proof:
- if I create M'' = M||(M'1 xort)||M'2 ||...||M'N
then I get t'' = E-cbc-mac( K, M'' ) = t' because xor-ing the first block of M' with t will actually delete its contribution
44
Integrity and confidentiality: how to combine?
hypothesis:
- secrecy = symmetric encryption with K1
- integrity = keyed-digest (MAC) with K2
**authenticate-and-encrypt (A&E)**
- enc(K1,p) || mac(K2 ,p)
- must always decrypt before checking integrity (possible DoS attack)
- may leak info about the plaintext
- used by SSH
- insecure unless performed in a single step
**authenticate-then-encrypt (AtE)**
- enc(K1 ,p||mac(K2 ,p))
- must always decrypt before checking integrity (possible DoS attack)
- used by SSL and TLS
- secure only with CBC or stream encryption
**encrypt-then-authenticate (EtA)**
- enc(K1,p)||mac(K2 ,enc(K1,p))
- can avoid decryption if MAC is wrong
- used by IPsec
- the most secure of the three ... but beware of implementation errors -> always include IV and algorithms in the MAC computation
**The best one is Authenticated Encryption**
**The normal encryption modes are subject to chosen-ciphertext attacks when used on-line**:
- the attacker modifies a ciphertext
- then observes if the receiver signals an error or not (e.g. padding oracle or decryption oracle attack)
45
AE: general characteristics and pros, reason why
It is a single operation for confidentiality and authentication/integrity -> same data for the two properties
Advantages:
* it just needs one key and one algorithm
* better speed
* less error likelihood in combining the two functions
**Why?
The normal encryption modes are subject to chosen-ciphertext attacks when used on-line**:
* the attacker modifies a ciphertext
* then observes if the receiver signals an error or not (e.g. padding oracle or decryption oracle attack)
So we need to verify the integrity of the ciphertext before decrypting it
46
IGE
**Infinite Garble Extension** is a less common **mode of application** **that operates as** **Authenticated Encryption** and that provides **confidentiality, authN and integrity in one step.**
It is similar to CBC but an error in one block influences **ALL** the following blocks. Good because we can just look at the last block to see if everything is ok. The last block is called tag.
TODO
47
Authenticated Encryption with Associated Data (AEAD)
**AD is a way to use AE.**
The header of the message is called associated data.
* confidentiality: just for the payload
* authN: for both the payload and the header
AEAD is based on a nonce and on a key.
The result is a message with the following fields:
header - nonce - payload - tag
48
Which are some of the standard algorithms for Authenticated Encryption?
GCM
CCM
OCB 2.0
EAX
49
GCM
GCM defined for algorithms with **128-bit block**
**(C, T) = algo_GCM_enc(K, IV, P, A):**
* IV size [ 1 ... 264 bits ] (96 bits is most efficient)
* P size [0...239 –256bits]
* A (associated authenticated data) size [ 0 ... 264 bits ]
* C has the same size as P
* T is the authentication tag with size [ 0 ... 128 bits ]
-> for encryption, GCM generates ciphertext + authentication tag
**P = algo_GCM_dec(K, IV, C, A, T)**
* P is the original plaintext (if authentication is OK) or a special value FAIL if the authentication check failed
-> for decryption, first computes authentication tag and only if it matches the one in input then the ciphertext is decrypted
Features:
* on-line single-pass AEAD
* parallelizable
* used by TLS, present in openssl
50
CCM
CCM = Counter-mode with CBC-MAC. CCM is defined for algorithms with 128-bit block
1. first an authentication tag of (plaintext + associated data) is
computed by CBC-MAC
2. then the plaintext and the tag are (separately) encrypted in CTR mode
Features:
- off-line double-pass,
- the slowest one -> note: double-pass is 2x slower than one-pass (in software)
51
Comparison of AE algorithms: GCM, CCM, OCB 2.0, EAX
**GCM**:
the most popular, on-line single-pass AEAD, parallelizable, used by TLS, present in openssl
* for encryption, generates ciphertext + authentication tag
* for decryption, first computes authentication tag and only if it
matches the one in input then the ciphertext is decrypted
* fast on Intel architecture (~4 cycle/byte) using AES-NI for encryption and PCLMULQDQ for the tag
**OCB 2.0**:
the fastest one, on-line single-pass AEAD, GPL patented so scarcely used, now free but for military uses
**EAX**:
on-line double-pass AEAD, slow but small (uses just the encryption block) so very good for constrained systems
**CCM**: off-line double-pass, the slowest one
*note: double-pass is 2x slower than one-pass (in software)*
52
NIST lightweight crypto (LWC)
Competition launched for AEAD lightweight algorithms. The winner was ASCON: usable for encryption, AEAD, hashing
53
ASCON
NOT to replace AES or SHA3, just for lightweight env
See page 87 of 02_crypto_v3
54
Authentication by digest and asymmetric encryption
It means that also a digest (encrypted with the private key of the sender -> digital signature) is sent along with the data.
1. (signer S) H = enc( S.SK, hash( M ) )
2. (transmission) M || H
3. (verifier V) X = dec( S.PK, H )
4. (verification) if ( X == hash( M ) ) then OK else ALARM!
Those who know the public key can compare the transmitted digest with the digest calculated on the received data
**DIGITAL SIGNATURE !!!**
55
How does digital signature work? How is it created and verificated?
1. (signer S) H = enc( S.SK, hash( M ) )
2. (transmission) M || H
3. (verifier V) X = dec( S.PK, H )
4. (verification) if ( X == hash( M ) ) then OK else ALARM!
56
How can we get to have Authentication and integrity?
By means of a shared secret:
- useful only for the receiver
- cannot be used as a proof without disclosing the secret key
- not useful for non repudiation
By means of asymmetric encryption:
- being slow it is applied to the digest only
- can be used as a formal proof
- can be used for non repudiation
- = digital signature
57
Digital vs. handwritten signature
- digital signature = authentication + integrity
- handwritten signature = authentication
- thus the digital signature is better, because it is tightly bound to the data
- note: each user does not have a digital signature but a private key, which can be used to generate an infinite number of digital signatures (one for each different document)
58
What is a public key certificate?
It is a data structure used to securely bind a public key to some attributes.
Typically it binds a key to an identity but other associations are possible too (e.g. IP address)
It is digitally signed by the issuer: the Certification Authority (CA), has a limited lifetime and can be revoked on request both by the user and the issuer
59
Formats for public key certificates (list)
X.509:
- v1, v2 (ISO)
- v3 (ISO + IETF)
non X.509:
- PGP
- SPKI (IETF)
PKCS#6:
- RSA, partly compatible with X.509
- obsolete
60
Structure of a X.509 certificate
* version
* serial number
* signature algorithm: used by the CA to sign the certificate
* issuer: the entity that emitted the certificate
* validity
* subject: the identity associated to the public key specified in the certificate
* subject Public Key Info: information about the public key
* CA digital signature
61
PKI (Public-Key Infrastructure)
It is the infrastructure, technical and administrative, put in place for the creation, distribution and revocation of public key certificates
it becomes necessary to have an infrastructure (hierarchical?) for certification and distribution of public- key certificates
62
Certificate revocation and how to check if a certificate is revoked
Any certificate can be revoked before its expiration date:
- on request by the owner (subject)
- autonomously by the creator (issuer)
When a signature is verified, the receiver must check that the certificate was valid at signature time
-> this kind of check is the responsibility of the receiver (relying party, RP)
A certificate revocation can be checked via:
CRL (Certificate Revocation List)
- list of revoked certificates
- signed by the CA or by a delegated party
- certificate validity since it was issued
OCSP (On-line Certificate Status Protocol)
- response containing information about the certificate status
- signed by the server
- certificate validity at the current time
63
Structure of a X.509 CRL
* version
* signature algorithm
* issuer
* thisUpdate: time of the signature of this certificate. The check has to be done against this time
* list of pairs (certificate - revocationDate)
* CA digital signature
64
Cryptographic performance: what does it depend on?
Cryptographic performance does not depend on RAM but on CPU (architecture and instruction set) and cache size
It is not a problem on clients (except when not very powerful, e.g. IoT, or they are overloaded by local applications) but it can become a problem on the servers and/or on the network nodes (e.g. router): a possible solution is to use cryptographic accelerators (HSM, Hardware Security Module). There are special-purpose accelerators tied to a protocol (e.g. TLS, IPsec) or generic ones (e.g. AES, RSA)
65
CNSA (2018)
Commercial National Security Algorithm Suite
It includes the following algorithms:
- (symmetric encryption) AES-256, (flow) mode CTR (low bandwidth) or GCM (high bandwidth)
- (hash) SHA-384
- (key agreement) ECDH e ECMQV
- (digital signature) ECDSA
- EC on the curve P-384
For legacy systems:
- (key agreement) DH-3072
- (key exchange, digital signature) RSA-3072
- new quantum-resistant algorithms expected by 2022
66
Can you say which one between authentication and integrity was attacked?
NO! You cannot separate them.
67
Describe the authentication and integrity properties of HMAC with respect to the electronic signature.
**HMAC** guarantees:
- integrity through digest
- data authentication (but** not of the sender** since anyone could have sent that hash)
The **digital signature** in addition provides **authentication of the sender** because the hash is encrypted using his private key, and there is an X.509 certificate that certifies his identity
68
What is integrity? Mention some possible attacks related to it
Integrity is defined as the **property that indicates whether a data has undergone manipulation**; some possible attacks on the integrity of a message or packet are those of the MITM type, which can modify packets in the connection
69
Calculate how much data must be saved on disk to decrypt and authenticate a 1kB large file with SHA-1 digest and 1024-bit RSA key.
We have:
- 20B (160 bits) for the SHA-1 digest
- 1kb for plaintext
- and Assuming AES-128-CTS encryption (therefore no padding): we have: 128B (1024 bit) AES symmetric key encrypted with the sender's Kpri and 128B (1024 bit) Kpub of the sender
= 1300 B total
70
Explain DSA, RC-4, RIPEMD, RSA?
- DSA: is an asymmetric cryptography algorithm that does exponential on one side and logarithm on the other; it is used only for digital signature (therefore no encryption), since the function it uses if applied on plaintext would cause data loss
- RC-4: stream-type symmetric encryption algorithm, which is applied to a continuous bit stream: the basic operation is that source and destination agree on a seed used to encrypt and decrypt
- RIPEMD: cryptographic hash algorithm; considered excellent but hardly used
- RSA: is an asymmetric block cipher algorithm that generates its KEYS using two exponents; the choice of these exponents is fundamental for the quality of the final result (in particular, the product of the two exponents must be less than the size of the block to be encrypted)
71
Difference between stream and block algorithms
Block algorithms encrypt the main file by dividing it into blocks and encrypting each in a more or less separate way with the key according to the chosen algorithm; stream algorithms apply to a continuous bit stream: **the basic operation is that source and destination agree on a seed used to encrypt and decrypt**.
Stream algorithms tend to be faster than block algorithms since they perform a simple XOR, but require constant synchronization between sender and receiver (this does not make them good for internet transmissions); by comparison, the block algorithms are significantly slower given the various operations that must be performed to match the data to the size of the blocks (such as padding), but yes, they are very suitable for the transmission of internet packets
72
Why are stream algorithms faster?
Stream algorithms tend to be faster than block algorithms since they perform a simple XOR, but they require constant synchronization between sender and receiver (this does not make them good for internet transmissions), as well as the fact that block algorithms are significantly slower given the various operations that must be performed to match the data to the block sizes (such as padding)
73
A 28-byte message is encrypted with DES-CBC: how many bytes will be sent in total?
DES has 64bit blocks (8 bytes), so 28 <32/8 = 4 8 byte blocks plus one block of the
same size for the IV, in total (4 + 1) * 8 = 40byte
74
A company must exchange files with another but they can only use a key of 12 characters max; indicate how the system is to be implemented (NOTE: they also wanted to talk about kdf in the solution)
I create a key with K = pbkdf (pwd, sale, itc), and use IPsec in tunnel mode on corporate gateways to have data integrity and sender authentication; assuming that the files to be exchanged are particularly sensitive, we recommend the use of the VPN-B cyphersuite to also have confidentiality on the data
75
If I have to encrypt an 84-byte file in DES-CBC mode, how many bytes will I send over the network?
3DES has 64bit blocks (8 bytes), so 84 <88/8 = 11 blocks of 8 bytes plus one block of the same size for the IV, in total (11 + 1) * 8 = 96 bytes
76
Having a 1500 byte file, if I encrypt it with 3DES-CBC how big will the final file be?
3DES has 64bit blocks (8 bytes), so 1500 # 8 = 4 bytes in the last block which need
8-4 = 4 bytes of padding to fill it, so in total the file will be 1500 + 4 = 1504byte
77
CBC vs CTR: how they work, advantages and disadvantages
parallelization!!!
CBC is a block cipher algorithm that encrypts each block n after the first by XORing it with the result of step n-1 (for the first step, instead, an initialization vector IV is used, which in transmission can be sent hidden or even in clear)
Advantages and disadvantages:
+ No swapping attacks
+ No known plain text attacks
- Propagation of errors in case of loss and error in transmission of a block - No CPU parallelization
CTR is a method for transmitting files smaller than a block size: data is divided into groups, and each group is mixed with a nonce + counter which is incremented for each group (the nonce must be identical to the destination)
The main disadvantage is that clearing a block causes the counter to be desynchronized
78
Two users wish to exchange a series of ASCII (.TXT) documents over the network. Suggest what operations should be performed on these documents before transmitting them to resist attacks on the (insecure) network. Please note that the documents do not contain confidential information. Note: Do not use complex protocols or data formats. Express the solution by formula (using appropriate terms, such as aes (k, d) rather than enc (k, d))
n = nonce + counter
k = DH
digest = hmac_sha256 (k, P || n)
c = P || digest || n
79
User A wants to send a secret and authenticated message to users B and C, all three have a pair of RSA keys each. Describe the format of the data block to send the message with the required security properties.
You have to encrypt with the public keys of B and C and sign with your private and distribute the public key of A, then:
- C receives: AES_128 (Kpub_c, M) || HMAC-SHA256 (AES_128 (Kpub_c, M), Kpri_a) || Kpub_a
- B receives: AES_128 (Kpub_b, M) || HMAC-SHA256 (AES_128 (Kpub_b, M),
Kpri_a) || Kpub_a
80
Talk about the keyed digest mechanism (what it is, when and how to use it, advantages and disadvantages).
In a solution of this type, a digest calculated not only on the data, but also on a secret (key) is sent and only those who know K can calculate the digest on the received data and compare it with the transmitted digest. This solution is widely used in the network environment.
Security Properties:
+ integrity: if the plaintext data are modified, the kdR keyed-digest calculated on the received data will be different from the received kdF keyed-digest;
+ authentication: only those who know the secret key can have generated a keyed- digest corresponding to the data;
- confidentiality: the data are sent in clear text;
- non-repudiation: it is not possible to determine which peer generated the data.
Advantages and disadvantages:
+ amount of data transmitted: the keyed-digest is very small compared to the data;
+ computation time: hash algorithms are quick to execute;
+ **implementation: a single hash algorithm is sufficient to ensure both confidentiality and authentication.**
- partial integrity: collisions can occur, since it is theoretically
impossible to identify all possible changes
81
Talk about the keyed-digest and digital signature, what are their properties, advantages and disadvantages?
**Keyed-digest**: a digest calculated not only on the data, but also on a secret (key) is sent and only those who know K can calculate the digest on the data received and compare them with the digest transmitted. This solution is widely used in the network environment.
Security Properties:
+ integrity: if the plaintext data is modified, the kdR keyed-digest calculated on the received data will be different from the received kdF keyed-digest;
+ authentication: only those who know the secret key can have generated a keyed- digest corresponding to the data;
- confidentiality: the data are sent in clear text;
- non-repudiation: it is not possible to determine which peer generated the data. Advantages and disadvantages:
+ amount of data transmitted: the keyed-digest is very small compared to the data;
+ computation time: hash algorithms are quick to execute;
+ implementation: a single hash algorithm is sufficient to ensure both confidentiality and authentication.
- **partial integrity**: collisions may occur, since it is theoretically impossible to identify all possible changes
**Digital signature**: a digest is calculated with a cryptographic algorithm and associated with a data object so that any recipient of the data can use the signature to verify the origin and integrity of the data
Security Properties:
+ integrity: if the plaintext data are modified, the MDR digest calculated on the received data will be different from the received and decrypted MDF digest;
+ authentication: only those who know the private key can have generated a digital signature corresponding to the data;
- confidentiality: the data are sent in clear text;
+ non-repudiation: the sender cannot deny having signed the data, as long as his public key is provided by a public key certificate.
Advantages and disadvantages:
+ **little additional data**
- **inapplicable to a real time data flow**
82
Why is the SHA-1 algorithm deprecated? Suggest a viable alternative and motivate why this is better than SHA-1.
SHA-1 was an overall good algorithm, but also extremely attached. In fact, a group of Chinese researchers managed to find collisions with only 2 ^ 69 calculations. SHA-2 was later popularized. As a quick fix after the SHA-1 attack, the SHA-2 family was created by lengthening the digest, similar to what happened between DES and 3DES.
83
Sort the following algorithms from fastest to slowest: SHA, AES_ECB, AES_CBC, RC4
SHA, RC4, AES_ECB, AES_CBC
84
Given the following encryption algorithms, sort them from slowest to fastest: AES, DES, RC4, 3DES.
3DES, DES, AES, RC4
85
Describe elliptic curve cryptography.
Elliptic Curve Cryptography (ECC) **uses two-dimensional elliptic curve arithmetic**, instead of one-dimensional modular arithmetic.
From a conceptual point of view, instead of using numbers (which are points on a straight line) we take the Cartesian space, and the values that are valid are only the points that satisfy the equation of an elliptic curve.
The discrete logarithm problem on a curve is more complex to solve for bad guys than the discrete logarithm problem in modular arithmetic, so the keys for ECC can be shorter (about 1/10) for a comparable level of security , reducing the storage requirements on embedded devices.
Some examples of use are the ECDSA (Elliptic Curve DSA) for digital signature, and
the ECDH (Elliptic Curve DH) for the key agreement.
86
Say the two main advantages of ECC-based algorithms
The **problem of the discrete logarithm on a curve** is more complex to solve for bad guys than the problem of the discrete logarithm in modular arithmetic, therefore:
1) The keys for the ECC can be shorter (about 1/10) for a comparable level of security
2) For the good ones all the algorithms require **only two elementary operations** that
give as result of the points
87
Describe the CBC-MAC keyed-digest algorithm.
The MAC consists of the last block of ciphertext **resulting from the application of a symmetric block cipher algorithm in CBC mode, with null initialization vector IV **(confidentiality is not necessary): **all** ciphertext blocks are **thrown away except the last one**, which is taken as MAC) the recipient can encrypt the received data with the same encryption algorithm and compare the last resulting ciphertext block with the received ciphertext block.
88
On embedded systems, ECDSA is often preferred over RSA: why?
Because the keys to the ECC can be shorter (about 1/10) for a comparable level of
security, reducing the storage requirements on embedded devices.
89
What is the main advantage of the CTR encryption mode?
The ability to parallelize the CPU in the calculation, as any group can be encrypted
without having to encrypt the previous groups (random access).
90
Indicate which integrity attack is possible if data D is protected with a MAC calculated as follows (k is the key and h is the hash function): MAC = h (k || D).
If you concatenate another block in the queue, the digest will be different and the coupon will not notice it, so the digest will be changed in some way without knowing the shared key.
91
Advantages and disadvantages of encryption made with enc (enc (p, k1), k2) with k1 and k2 different keys but of equal length
A double application of encryption algorithms is generally never used, which is why it is avoided, as it would not significantly increase the level of security. Furthermore, the double application of encryption algorithms is subject to a known-plaintext attack, called meet-in-the-middle, which allows data to be decrypted with at most 2^{N + 1} attempts (for N-bit keys) . In short, it doubles the computation time but the key length increases by just one bit.
92
Which of the following techniques - digital signature, symmetric encryption, keyed-digest - would be preferred to protect the integrity of a 1 Gbps packet stream? Justify the choice.
Keyed-digest because it is the fastest technique, hash fast and uses only one operation. Signing cannot be done on a data stream. Encryption is slow
93
Which technique is best used to protect data transmitted over the network from replay attacks? Symmetric encryption, asymmetric encryption, keyed-digest, more? To justify.
We are talking about replay attacks only, so it is sufficient to guarantee Integrity with a keyed digest based on a symmetric key (agreed at the beginning of the session or better generated pseudo-randomly from a shared secret):
d = kd (K || n || M || K) sending M || n || d
In KD I put K at the extremes in order to avoid prefix and postfix attacks
94
Two users must exchange non-confidential ASCII format (txt) text files. How do they ensure they are not changed during transit? Explain which security functions to use and state the formula that produces the transmitted document X against the original document. Use meaningful nouns (e.g. aes (K, D) with respect to enc (K, D).
k = DH, key gen-in-law
d = HMAC_SHA256 (k, M), create message digest for integrity and authentication X = M || d, send message + digest
95
How can two guys who share a password send a file
Through symmetric key algorithms, using the password as the key
96
Having to encrypt a 12-character password with 2 bytes of salt with AES, is it better to use ECB, CBC or CTR?
AES has 128bit block, 12 ascii characters then 8bit each is 96bit plus 16bit salt is 112bit, so less than block which would lead me to use CTR
97
Digital signature with SHA256 digest, RSA-2048 private key on a 10MB file. What is the size of the signature?
Since an RSA-2048 private key is used the signature size will be 2048bit
98
A 10MB document must be signed with SHA-1 digest and RSA key. How big exactly is the document signature?
It depends on the size of the RSA key. Assuming it is 2048 bits, the signature will also be 2048 bits long
99
What algorithms can be used to communicate a certain secret key to a counterparty?
Those with an asymmetric key (such as RSA), since no secret must be sent to make
them work
100
Explain what the CTS operating mode is, what is the main idea on which its implementation is based and why it is becoming increasingly important
CTS is a technique that allows you to use block algorithms without padding. The bytes of the previous block are added to the last block, removing them from the penultimate block. To avoid standard padding, a part of the ciphertext already encrypted is used as padding. That is, for large files, it is not dramatic, as it only affects the last two blocks. It is useful when you cannot / want to increase the size of the data after encryption.
101
Explain the term security through obscurity. Explain why some say it's good and others don't.
Attempting to maintain or increase the security of a system by keeping the design or construction of a security mechanism secret. Some do not consider it a good defense
method because in an open system it is easier to find and announce possible
vulnerabilities.
102
Explain authenticated encryption.
Authenticated encryption (AE) algorithms combine encryption and
keyed-digest in a single operation:
+ confidentiality and authentication (and integrity) with a single algorithm and a single key;
+ higher speed;
+ lower risk of implementation errors.
AE is becoming an increasingly growing need at the application level (eg. For e- mail messages).
AE algorithms can be:
* AEAD or not: some authenticated data can be left unencrypted;
* single-pass or double-pass: a double-pass algorithm needs to store the results of the first pass for further calculations) it is at least twice slower than a one-pass algorithm if implemented in software;
* on-line or off-line: the data can be taken as it arrives from the wire or all must first be saved.
Normal encryption schemes are prone to chosen-ciphertext (oracle) attacks when used online:
1. the attacker modifies a ciphertext;
2. the attacker observes whether the receiver reports an error or not.
103
Describe DH, his problems and solutions to them.
Diffie-Hellman (DH) was the first algorithm to use the concept of publishing something (the numbers p and g), and therefore in this sense it is often referred to as the first public key algorithm invented.
DH is not a method to distribute the key, but to agree on the key:
1. sender X and receiver X choose or agree on two public integers, a generator g (typically 2, 3 or 5) and a prime number p (large), such that p> g> 1
2. X arbitrarily chooses an integer x> 0 (large), and computes A = gx mod p
3. Y arbitrarily chooses an integer y> 0 (large), and computes B = gy mod p
4. X sends (publishes) the calculated value A to Y; 5. Y sends (publishes) the calculated value B to X; 6. X receives B, and calculates KA = Bx mod p
7. Y receives A, and calculates KB = Ay mod p
8. for the property of powers, the values KA and KB, calculated independently from X and Y, are equal and constitute the secret key KAB:
KA= (gy) x mod p,
KB = (gx) y mod p
→ KA = KB = gxy mod p = KAB
The main problem of this algorithm lies in the key agreement phase: however, in the event that the attacker is able to manipulate the data in transit, he can then sniff the traffic between the parties to manipulate them. This operation is completely transparent to the sender and the receiver: they have no way of knowing that beyond the protected channel there is no counterpart but there is the attacker, the keys they believe they have agreed are different, and data was manipulated. It is therefore **necessary to protect the exchanged keys through a pre-authentication process** using:
* **certificates for DH keys**;
* **Authenticated Variant Protocols of DH**
104
RSA, RC4, SHA-1,. . . : who is the intruder and why?
sha1 because it is a digest algorithm while the others are encryption
105
Briefly explain the type of symmetric and asymmetric encryption, indicating the advantages and disadvantages of each type.
(Professor's answer)
1) symmetric: C = enc (K, P), P = dec (K, C); advantages: fast, simple key generation disadvantages: key distribution
2) asymmetrical:
disadvantages: slow, key generation, key distribution
