Cryptanalysis. A walk through time. Arka Rai Choudhuri

Transcription

1 Cryptanalysis A walk through time Arka Rai Choudhuri arkarai.choudhuri@gmail.com

2

3 How many can you identify?

4 History (or how I will give you hope of becoming world famous and earning $70 million along the way)

5 Disclaimer Cryptography s butt

6 AOUSATUPRSVNEG SOURAV SEN GUPTA USVRAO ENS PUTGA Transposition Cipher

7 Caesar cipher Simple shifting of letters. Only 13 possible keys. Easy to break exhaustively.

8 Substitution Cipher Earliest mention in the Kama-sutra. 26! Number of keys. 88 bits of secrecy.

9 Arab Cryptanalysis Al-Kindi On Deciphering Cryptographic Messages 9 th century FREQUENY ANALYSIS

10 Structure of the English language Move to digrams and trigrams for better results.

11 Mary Queen of Scots (16 th Century) Assassinate

12 Solved by Elizabeth s cryptanalyst

13

14 Vigenère cipher (16 th century) Overcome the statistical weakness of ciphers? Polyalphabetic ciphers A letter in the cipher can represent multiple letters from the plain text Not broken till the 19 th century.

15 How do we figure out the length?

16 Use properties of the English language. 25 i=0 p i If p i follow the letter frequencies. Else, i=0

17 Increase the keyword length? Create a keyword that is as long as the message. Can t use the methods discussed previously. Are we done?

18

19

20 Failed because the key wasn t random enough?

21 What is random?

22 Why does it work? Generate all possible plaintexts from a given ciphertext. All the keys will look random.

23 Zodiac Late 60s in the US. Killer sent ciphers to solve.

24

25 I LIKE KILLING PEOPLE BECAUSE IT IS SO MUCH FUN IT IS MORE FUN THAN KILLING WILD GAME IN THE FORREST BECAUSE MAN IS THE MOST DANGEROUE ANAMAL OF ALL TO KILL SOMETHING GI..

26 But who is the zodiac? 340 character cipher. Unsolved to this day.

27

28 Beale cipher

29 3 cipher - Location - Contents - Names of treasure owners

30 3 cipher - Location - Contents - Names of treasure owners Buried treasure of gold, silver and jewels estimated to be worth over US$63 million as of September 2011

31 Was it an elaborate hoax? Why has it withstood cryptanalysis for centuries?

32 Enigma Marian Rejewski

33 Differential Cryptanalysis Where your disillusionment dies.

34 DES L R Linear Operations Subkey S-Box Linear Operations L R

35 S-Box Substitution boxes Non-Linear Can t represent output bits as linear operation of input bits.

36 S-Box Substitution boxes Non-Linear Implemented by a table look-up

37 S-Box S1(101011)

38 S-Box S1(101011)

39 S-Box S1(101011) = 7

40 How can we use an S-box? X Key S

41 X S K Inputs are known X 1 = 110 and X 2 = 010 Outputs of S-box known S(X 1 K) = 10 and S(X 2 K ) = 01

42 X S K Inputs are known X 1 = 110 and X 2 = 010 Outputs of S-box known S(X 1 K) = 10 and S(X 2 K ) = 01 X 1 K 000,101 K {110,011}

43 X S K Inputs are known X 1 = 110 and X 2 = 010 Outputs of S-box known S(X 1 K) = 10 and S(X 2 K ) = 01 X 1 K 000,101 K {110,011} K=011 X 2 K 001,110 K {011,100}

44 Differences Focus on input and output differences. We know the inputs X 1 and X 2. But the input to the S-boxes are X 1 K and X 2 K. XOR of the input to the S-box (X 1 K) (X 2 K) = X 1 X 2 The difference is independent of the key.

45 TINY DES (TDES) L R 8 8 Expand 12 F R, K = S(expand R K) 6 6 SL SR 12 K i L R

46 x 0 x A B C D E F 0 C 5 0 A E D F 1 B 1 1 C E B 2 F D A F A E 6 D B C 3 0 A 3 C E 9 7 F 6 B 5 D 4 K 1 = k 2 k 4 k 5 k 6 k 7 k 1 k 10 k 11 k 12 k 14 k 15 k 8 K 2 = k 4 k 6 k 7 k 0 k 1 k 3 k 11 k 12 k 13 k 15 k 8 k 9 K 3 = k 6 k 0 k 1 k 2 k 3 k 5 k 12 k 13 k 14 k 8 k 9 k 10 K 4 = k 0 k 2 k 3 k 4 k 5 k 7 k 13 k 14 k 15 k 9 k 10 k 11

47 x 0 x A B C D E F 0 C 5 0 A E D F 1 B 1 1 C E B 2 F D A F A E 6 D B C 3 0 A 3 C E 9 7 F 6 B 5 D 4 K 1 = k 2 k 4 k 5 k 6 k 7 k 1 k 10 k 11 k 12 k 14 k 15 k 8 K 2 = k 4 k 6 k 7 k 0 k 1 k 3 k 11 k 12 k 13 k 15 k 8 k 9 K 3 = k 6 k 0 k 1 k 2 k 3 k 5 k 12 k 13 k 14 k 8 k 9 k 10 K 4 = k 0 k 2 k 3 k 4 k 5 k 7 k 13 k 14 k 15 k 9 k 10 k 11 expand R = expand r 0 r 1 r 7 = (r 4 r 7 r 2 r 1 r 5 r 7 r 0 r 2 r 6 r 5 r 0 r 3 )

48 X 1 X 2 = SR X 1 SR X 2 = 0010 with probability ¾ If X 1 X 2 = SR X 1 SR X 2 = 0000 with probability 1 Chosen plaintext attack P = (L 0 R 0 and P = ( L 0 R 0 ) P P = (L 0 R 0 ( L 0 R 0 ) = = 0x0002

49 Is the expand function linear? expand X 1 expand X 1 = expand(x 1 X 2 ) R 0 R 0 = expand R 0 expand R 0 = expand R 0 R 0 = expand = F R 0, K F R 0, K = S e R 0 K S(e R 0 K) = with probability ¾

50 With probability R 2 R 2 = L 1 F R 1, K 2 ( L 1 F( R 1, K 2 )) = L 1 L 1 (F R 1, K 2 F( R 1, K 2 )) = R 0 R 0 (F R 1, K 2 F( R 1, K 2 )) = =

51

52 Recovering the key What do we have? P P (L 0 L 0 ) (R 0 R 0 ) C C (L 4 L 4 ) (R 4 R 4 ) R 4 = L 3 F R 3, K 4 and R 4 = L 3 F R 3, K 4 R 4 = L 3 F L 4, K 4 and R 4 = L 3 F L 4, K 4 L 3 = R 4 F L 4, K 4 and L 3 = R 4 F L 4, K 4

53 If C C = 0x0202, with high probability, L 3 = L 3 R 4 F L 4, K 4 = R 4 F L 4, K 4 R 4 R 4 = F L 4, K 4 F L 4, K 4

54 If C C = 0x0202, with high probability, L 3 = L 3 R 4 F L 4, K 4 = R 4 F L 4, K 4 R 4 R 4 = F L 4, K 4 F L 4, K 4 Let, L 4 = l 0 l 1 l 2 l 3 l 4 l 5 l 6 l 7 and L 4 = l 0 l 1 l 2 l 3 l 4 l 5 l 6 l 7 Then = SL(l 4 l 7 l 2 l 1 l 5 l 7 k 0 k 2 k 3 k 4 k 5 k 7 ) SR(l 0 l 2 l 6 l 5 l 0 l 3 k 13 k 14 k 15 k 9 k 10 k 11 ) (SL l 4 l 7 l 2 l 1 l 5 l 7 k 0 k 2 k 3 k 4 k 5 k 7 SR l 0 l 2 l 6 l 5 l 0 l 3 k 13 k 14 k 15 k 9 k 10 k 11 )

55 Algorithm 1. Pick plaintext pairs with the given difference. 2. Run the algorithm with the unknown key to get ciphertext pairs. 3. Discard ciphertext pairs that don t satisfy output difference. 4. For all possible values of the 6 key bits identified, check if the derived condition holds.

56

57 These key bits can be guessed separately from the others. The remaining keys bits can be guessed by exhaustive search with one cipher text. Thus an overall complexity of about 2 11 which is better than the exhaustive search over the entire keyspace.

58 Swept under the rug What is a good probability? How many plaintextpairs do we need? Are there assumptions that we ve taken for granted?

59 Thank you