1

CHAPTER TWO

Cryptography Computer
Network and its Applications

SEID M.
 2

INFORMATION SECURITY
• protecting information and information systems from
unauthorized access, use, disclosure, disruption,
modification, perusal, inspection, recording or
destruction.
• The terms information security, computer security and
information assurance are frequently used
interchangeably.
• are interrelated often and share the common goals
of protecting the confidentiality, integrity and
availability of information.,
=> there are some subtle differences between them.
 3

INFORMATION SECURITY
 Information security is concerned with the
confidentiality, integrity and availability of data
regardless of the form the data may take:
electronic, print, or other forms.
 Computer security can focus on ensuring the
availability and correct operation of a computer
system without concern for the information stored
or processed by the computer.
 Information assurance focuses on the reasons for
assurance that information is protected, and is
thus reasoning about information security.
 4

Basic of Cryptography:
• Cryptography is the science of using mathematics to encrypt and
decrypt data.
• Cryptography enables you to store sensitive information or
transmit it across insecure networks (like the Internet)
• so that it cannot be read by anyone except the intended
recipient.
• While cryptography is the science of securing data, cryptanalysis
is the science of analyzing and breaking secure communication.
• Cryptanalysts are also called attackers.
• When Julius Caesar sent messages to his generals, he didn't trust
his messengers. So he replaced every A in his messages with a D,
every B with an E, and so on through the alphabet. Only
• someone who knew the “shift by 3”rule could decipher his
messages.
 5

Cryptography and Encryption Techniques

• Cryptography has five ingredients
• Plaintext: the original message that is fed into the algorithm as input

• Encryption algorithm: performs various substitutions and transformations on the

plaintext

• Secret Key: is also input to the algorithm; the exact substitutions and
transformations performed by the algorithm depend on the key

• Cipher text: the scrambled (unreadable) message produced as output of the

encryption algorithm. It depends on the plaintext and the secret key; for a given
message, two different keys will produce two different cipher texts

• Decryption algorithm: the encryption algorithm run in reverse. It takes the cipher text
and the same secret key (in symmetric key cryptography) and produces the original
plaintext
 6

Symmetric Cryptography

• Simplified Symmetric Encryption Model

• The need for cryptography

• If you have the best firewall, very tight security policies, hardened operating

systems, virus scanners, intrusion detection software, antispyware, and every

other computer security angle covered but send your data in raw, plain text, then
you simply are not secure
 7

Symmetric Cryptography
• The same key is used to encrypt and decrypt a message
C = EK(P)
P = DK(C) ⇒ P = DK[EK(P)]
• Has been used for centuries in a variety of forms
• The key has to be kept secret
• The key has to be communicated using a secure channel;
Properties of an Encryption Function
• It is computationally infeasible to find the key K when given
the plaintext P and the associated ciphertext C [EK(P)]
• It should also be computationally infeasible to find another key
K’ such that EK(P) = EK’(P); Uniqueness
 8

DES - A Popular Example of Symmetric Cryptosystem

• In 1973, the NBS (National Bureau of Standards, now called NIST- National
Institute of Standards and Technology) published a request for an
encryption algorithm that would meet the following criteria:
• have a high security level
• be easily understood
• not depend on the algorithm's confidentiality
• be adaptable and economical
• be efficient
• In late 1974, IBM proposed "Lucifer", which was then modified by NSA
(National Security Agency), in 1976 to become the DES (Data Encryption
Standard)
• DES was then approved by NBS in 1978 and was standardized by ANSI
under the name of ANSI X3.92, also known as DEA (Data Encryption
Algorithm)
 9

DES - A Popular Example of Symmetric Cryptosystem

• DES utilizes block cipher, which means that during the encryption
process, the plaintext is broken into fixed length blocks of 64 bits
 A block cipher processes the input one block of elements at a time,
producing an output block for each input block; larger block sizes
mean greater security but reduced encryption/ decryption speed;
a block size of 128 bits is a reasonable tradeoff and is nearly
universal among recent block cipher designs
 A stream cipher processes the input elements continuously,
producing output one element at a time, as it goes along
• The key in DES is 56 bits; 8-bit out of the total 64-bit block key is used
for parity check (for example, if odd parity is used, each byte has an
odd number of bits)
• 56-bit key gives 256 (≅ 7.2*1016) possible key variations
 10

DES - A Popular Example of Symmetric Cryptosystem

• DES algorithm involves carrying out combinations, substitutions

and permutations between the text to be encrypted and the key,
while making sure the operations can be performed in both
directions (for decryption)
• The combination of substitutions and permutations is called a
product cipher
• DES was best suited for implementation in hardware, probably to
discourage implementations in software, which tend to be slow by
comparison during that time
• Modern computers are so fast that satisfactory software
implémentations for DES are possible
• DES is the most widely used symmetric algorithm despite claims
whether 56 bits is long enough to guarantee security
 DES - A Popular Example of Symmetric Cryptosystem11
DES Encryption:
• Data is divided into 64-bit blocks; the key is 56 bits, round key is 48 bit, number
of rounds 16 rounds.
• The processing has three phases
• Phase 1
• The 64-bit plaintext passes through an initial permutation (IP) that rearranges
the bits to produce the permuted input; no elements are added or deleted or
replaced, rather the order in which the elements appear in the sequence is
changed
• Phase 2
• The 64 bits are then divided into two 32-bit halves called LPT and RPT. The
encryption then proceeds through 16 rounds of the same function, each using
the L and R parts, and a sub key
• In each round, the new L part is simply a copy of the incoming R part
• The R and sub keys are processed in the so called f-function, and exclusive-or
of the output of the f-function with the existing L part to create the new R part
 12

DES - A Popular Example of Symmetric

Cryptosystem

• Phase 3

• The pre-output is passed through a permutation

that is the inverse of the initial permutation

(IP-1), to produce the 64-bit ciphertext
DES - A Popular Example of Symmetric Cryptosystem 13
 14

DES - A Popular Example of Symmetric Cryptosystem

 15

DES - A Popular Example of Symmetric Cryptosystem

• DES – Permutation: The initial permutation and its inverse are
defined by tables; in all tables, the numbers are the bit
positions
 16

DES - A Popular Example of Symmetric Cryptosystem

• Generating Sub keys

• Initially, the key is passed through a permutation function

• Then, for each of the sixteen rounds, a subkey (Ki ) is

produced by the combination of a left circular shift and a

permutation
• The permutation function is the same for each round, but a

different subkey is produced because of the repeated shifts

of the key bits
 17

DES - A Popular Example of Symmetric Cryptosystem

• To generate the subkeys, we start with the 56-bit key (64 bits -

with parity bits); the bits of the key are numbered from 1 through
64; every eighth bit

• These are permuted and divided into two halves called C and D
(Permutation Choice 1)
• For each round, C and D are each shifted left circularly one or two
bits (the number of bits depending on the round)
• The 48-bit subkey is then selected from the current C and D bits
using Permutation Choice 2 is ignored
 18

DES - A Popular Example of Symmetric Cryptosystem

 19

DES - A Popular Example of Symmetric Cryptosystem

• PC-1: Permutation Choice 1

• Extracts and permutes only 56-bit of the original 64-bit key (excluding

parity bits 8,16, 24, 32, 40, 48, 56, 64)

 20

DES - A Popular Example of Symmetric Cryptosystem

• PC-2: Permutation Choice 2

• Selects or extracts the 48-bit subkey for each round from the 56-

bit key-schedule => 6*8=48 bit

 21

DES - A Popular Example of Symmetric Cryptosystem

• Decryption is identical to encryption, except that the subkeys are
used in the opposite order. That is, subkey 16 is used in round 1,
subkey 15 is used in round 2, etc., ending with subkey 1 being used
in round 16
• The Avalanche Effect
• A desirable property of any encryption algorithm is that a small
change in either the plaintext or the key should produce a
significant change in the ciphertext
• In particular, a change in one bit of the plaintext or one bit of the
key should produce a change in many bits of the ciphertext.
This is referred to as the avalanche effect
• If the change were small, this might provide a way to reduce the
size of the plaintext or key space to be searched leading to brute-
force attack
 22

DES - Attack
• Types of attacks (cracking) in all types of encryption

• The attacker has only the ciphertext and his/her goal is to

find the corresponding plaintext

• The attacker has the ciphertext and the corresponding

plaintext and his/her goal is to find the key

• In both cases the attacker may or may not know the

algorithm
• A good cryptosystem protects against all types of attacks
 23

DES - Attack
• The security of encryption depends on the secrecy of the key, not the

secrecy of the algorithm (Security through obscurity is not a good

strategy)
• Keeping the algorithm secret means to invent, test, and install a new

one when the old is discovered which is very difficult

• Keep only the key secret; so that it can be changed as often as needed

• The two types of attacks on an encryption algorithm are

• Cryptanalysis: based on properties of the encryption algorithm

• Brute-force: which involves trying all possible keys; This is the most

basic method of attack for any cypher

 24

DES - Attack
• An encryption scheme is said to be computationally secure if either of the
following two criteria are met
• The cost of breaking the cipher exceeds the value of the encrypted
information
• The time required to break the cipher exceeds the useful lifetime of the
information Unfortunately, it is very difficult to estimate the amount of effort
required to cryptanalyze ciphertext successfully
• The following is the average time required for exhaustive key search
(brute-force attack) for various key sizes
 25

DES - Attack
•The length of the key determines the number of
possible keys, and hence the feasibility of the
approach (with a key length of 56 bits, there are
256 possible keys, which is approximately 7.2x1016
keys. Thus, a brute-force attack appears
impractical
 26

DES - Variants
• Triple DES (3DES)
• Provides enhanced security by executing the core algorithm three times
and the key length becomes 56*3 = 168-bits
• With triple length key of three 56-bit keys K1, K2, K3 encryption follows
an encrypt-decrypt-encrypt (EDE) sequence
• Encrypt with K1
• Decrypt with K2
• Encrypt with K3
• Decryption requires that the keys be applied in reverse order
• Decrypt with K3
• Encrypt with K2
• Decrypt with K1
 27

Other Symmetric Encryption Methods

• Blowfish
• Is a symmetric block cipher
• It uses a variable-length key ranging from 32 to 448 bits
• This flexibility in key size allows to use it in various situations
• It was designed in 1993 by Bruce Schneier
• It has been analyzed extensively by the cryptography community and has
gained wide acceptance
• It is also a non-commercial (i.e., free of charge) product, thus making it
attractive to budget-conscious organizations
• RC4
• Is a symmetric stream cipher developed by Ron Rivest
• The RC is an acronym for Ron’s Cipher
• There are other RC versions such as RC5 and RC6
 28

Message Authentication
• Message Authentication is concerned with:

• Protecting the integrity of a message

• Validating identity of originator

• Non-repudiation of origin (dispute resolution)

• Three alternative functions are used

• Message encryption

• Message authentication code (MAC)

• Hash function
 29

Message Encryption

• Message encryption by it self also provides a

measure of authentication
• If symmetric encryption is used then:

• Receiver knows sender must have created it

• Since only sender and receiver know the key

used
 30

Message Encryption
• If public-key encryption is used:

• Encryption provides no confidence of sender

• Since anyone potentially knows public-key

• However if:

• Sender signs message using their private-key

• Then encrypts with recipients public key

• Have both confidentiality and authentication

 31

Message Encryption
 32

Message Authentication Code (MAC)

• Generated by an algorithm that creates a small fixed-size block

• depending on both message and some key

• Appended to message as a signature

• Receiver performs same computation on message and checks it

matches the MAC

• Provides assurance that message is unaltered and comes from

sender
 33

Message Authentication Code (MAC)

 34

Message Authentication Code (MAC)

• Can also use encryption for Confidentiality

• Generally use separate keys for each

• Can compute MAC either before or after encryption

• Why use a MAC?

• Sometimes only authentication is needed

• Sometimes need authentication to persist longer than the encryption

• Note that a MAC is not a digital signature- the same key is

shared between the two parties.

 35

Hash Functions
36
37
38
39
 40

Requirements for Hash Functions

1. Can be applied to any sized message M

2. Produces fixed-length output h

3. Is easy to compute h=H(M) for any message M

• Strong collision resistance

 41

Digital Signature
• Confidentiality ensures that messages cannot be intercepted and read by
eavesdroppers, i.e., encryption protects against passive attack
• A different requirement is to protect against active attack (falsification
of data and transactions). Protection against such attacks is known as
message authentication
• A message, file, document, or other collection of data is said to be
authentic when it is genuine(not altered) and comes from its alleged source
• A digital signature is not used to ensure the confidentiality of a
message, but rather to guarantee who sent the message, i.e.,
authentication (nonrepudiation); it proves who the sender is
• Non-repudation can be source repudiation(denial of transmission of
message by source) or destination repudiation(denial of receipt of message
by destination)
 42

Digital Signature
• Digital signature is also used for Data Integrity; it ensures that messages
are protected against modification
• Note: authentication may mean both non-repudation and data integrity and
sometimes only data integrity
• Digital Signature for Assurance
• Consider the situation where Bob has just sold Alice something for
500 Birr through a deal that is made by e-mail
• Alice sends an e-mail accepting to pay 500 Birr
• Two issues need to be taken care of in addition to authentication
• Alice needs to be assured that Bob will not modify the amount and
show that Alice promised to pay more than 500 Birr
• Bob needs to be assured that Alice will not deny that she sends the
message, i.e., source repudiation
 43

Digital Signature
• If Alice signs the message digitally, the two issues will be solved so
that her signature is uniquely tied to its content
• Bob’s change will be noticed and Alice also cannot deny
There are several ways to place digital signatures:
• One popular way is to use public-key cryptosystem such as RSA,
i.e., message encryption by itself can provide measure of
authentication.
 44

Digital Signature

• Digital signature reverses the asymmetric encryption process

Notation:

• Alice encrypts the message using her private key

• C = E(KA-, M)
• Sends the encrypted message to Bob
• Bob then decrypts the signature using Alice’s public key
• M = D(KA+, C)
• If successful, he ensures that it comes from Alice
• If Bob can decrypt it with Alice’s public key, the message must have been
encrypted by Alice; No one else has Alice’s private key, and therefore no
one else could have created a ciphertext that could be decrypted with
Alice’s public key
 45

Digital Signature
• Therefore, the entire encrypted message serves as a

digital signature
• In addition, it is impossible to alter the message without

access to Alice’s private key, so the message is

authenticated both in terms of source and in terms of data
integrity
• But anyone can decrypt the message using Alice’s public

key if it is not important that the message be kept secret

 46

Digital Signature

• To combine both confidentiality and authentication

• Alice has to first encrypt the message using her private key

• Then encrypt the message with Bob’s public key

• Sends the encrypted message to Bob

• Bob decrypts the message using his private key

• Bob then decrypts the message using Alice’s public key

 47

Digital Signature

• Disadvantage: The public-key algorithm must be applied four times

rather than two in each communication which has an impact on

efficiency
 48

?
END OF CHAPTER TWO PART ONE

Next: Part Two