Betriebssysteme und Sicherheit. Stefan Köpsell, Thorsten Strufe. Modul 4: Mechanismen - Kryptographie

Transkript

1 Betriebssysteme und Sicherheit Stefan Köpsell, Thorsten Strufe Modul 4: Mechanismen - Kryptographie Disclaimer: Inhalte von Dan Boneh, Mark Manulis, Günter Schäfer, Mitarbeitern des Lehrstuhls Dresden, WS 17/18

2 The story so far Sicherheit als abstrakte Anforderung Safety vs. Security Datenschutz und Aspekte des Datenschutzes Formale Ziele der IT Sicherheit Bedrohungen abstrakt und technisch Bedrohungsanalysen Angreifermodelle und Angriffstechniken Risiko-Analysen Maßnahmen zum Schutz gegen Ausfälle Privacy and Security Folie Nr. 2

3 Was kann man tun: Sicherheitsmechanismen Vertraulichkeit Identität und Authentisierung Schlüssel-Management Integrität Zugriffskontrolle Privacy and Security Folie Nr. 3

4 Module Outline Einige Worte zu Krypto Ein kleiner Abriß der Geschichte Transposition Substitution Vernam Cipher The One Time Pad Konstruktionen für Strom-Chiffren Konstruktionen für Block-Chiffren (DES, AES) Operationsmodi für Block-Chiffren Asymmetrische Kryptographie Schlüsselgenerierung Verschlüsselung und Signaturen Privacy and Security Folie Nr. 4

5 Achieving the security goals Recall CIA: Confidentiality: only authorized access to information Integrity: detection of message modification Availability: services are live and work correctly Where crypto can (trivially) help: Confidentiality: Encryption transforms plaintext to conceal it Integrity Symmetric crypto (single key) Asymmetric crypto (key-pair) Message authentication / signing of data with authenticated digest (cryptographic hash/signature) Privacy and Security Folie Nr. 5

6 Einige Akteure des Spiels Die klassischen Datensicherheits-Angreifer Mallory : message Alice Bob Eve Privacy and Security Folie Nr. 6

7 Confidential Communication Spaces M C K plaintext space (e.g. words over an alphabet) space of ciphertexts space of keys Algorithms of a private-key (symmetric) encryption scheme KGen generates some (usually random) key k Enc encrypts a plaintext m using key k and outputs the ciphertext c Dec decrypts a ciphertext c using key k and outputs the plaintext m m M k KGen k Enc c Dec m Correctness for all k K, m M : Dec(k, Enc(k, m)) = m Privacy and Security Folie Nr. 7

8 The communication model and Kerckhoff message m key k E c=e(k,m) D key k Eve: no key, ciphertext m=d(k,c) The cipher method must not be required to be secret, and it must be able to fall into the hands of the enemy without inconvenience. i.o.w: KGen, E, and D will inevitably be discovered at some stage All algorithms should be public security must rely on secrecy of the key only Privacy and Security Folie Nr. 8

9 Crypto Basics Encrypt written communication: M: language over C: language over a b c d e f g h i j k l m n o p q r s t u v w x y z A B C D E F G H I J K L M N O P Q R S T U V W X Y Z K is determined by a bijective mapping f : M C for Enc and f -1 : C M for Dec Classification Transposition permute letters according to some scheme p l a i n t e x t Substitution substitute letters by other letters (or symbols) p l a i n t e x t Privacy and Security Folie Nr. 9

10 A simple Substitution Cipher Key Generation a b c d e f g h i j k l m n o p q r s t u v w x y z choose a shift value k [0, 25] Encryption Let m = m 0 m n and Let #m i denote the position of m i in the alphabet. Enc(k, m) = c 0 c n where for each c i : #c i = #m i + k (mod 26) Security How would you break it? What is the size of the key space? -> how many random guesses would you need? Privacy and Security Folie Nr. 10

11 Perfect Secrecy Observation: Patterns are your enemy! Concept: Long key (long/no periodicity) No recognizable pattern Key Generation choose k = (k 1,, k n ) where each k i is truly random permutation Gilbert Vernam ( ) Encryption Let m = m 0 m n. Enc(k, m) = c 0 c n where c i = f(k i, m i ) actually XOR, not ADD mod 26 in this case Privacy and Security Folie Nr. 11

12 The One-Time-Pad (Vernam cipher) Truly random key, as long as the message: m = k = A T T A C K T H E C I T Y A T T W E L V E P S P I U H G D S P H G D S P I W E E W O (+ mod 26) c = P L I I W R Z K W R P Z B S I B S I P R S k = m = Y H P R S R G F F D D X N S Q I S P W N F R E T R E A T F R O M C O A S T A T T E N (+ mod 26) or any other message of the same length, for that matter Now, what are the two problems with this method? Privacy and Security Folie Nr. 12

13 Security Definitions Perfect Secrecy The ciphertext does not reveal any information about the PT Caveat: Key must be random and as long as the message Provable Security Reduction of construction to some mathematical problem which is known to be hard (then so is breaking the construction) Semantic Security An efficient algorithm cannot find any information in the CT (the CT is polynomially indistinguishable from a CT with PS) Privacy and Security Folie Nr. 13

14 Attacker models revisited: Passive attacks Ciphertext-only attack: despite concealed key using ciphertext only learn about plaintext (or key) Known-plaintext attack: despite concealed key Knowing some plaintexts Learn about plaintext (or key) m 1,, m n?: m i c 1,, c n m 1, c 1 m 1,, m n xx, c i?: m i m n, c n Represents weakest attacker! Privacy and Security Folie Nr. 14

15 Attacker models revisited: Active attacks Chosen-plaintext attack: despite concealed key asking Alice to encrypt m a learn about m j (or key) Chosen-ciphertext attack: despite concealed key asking Bob to decrypt c a learn about m j (or key) m 1,, m n m 1, c 1 xx, c j m n, c n!: m i?: m j m 1,, m n m 1, c 1 xx, c j m n, c n!: c i = m i?: m j Strongest attacker! Privacy and Security Folie Nr. 15

16 Stream ciphers in general OTP: message ciphertext message ciphertext really random key k k (seed) PRNG running key Idea: replace random by pseudorandom key PRNG is a function G: {0,1} s {0,1} n n >> s Det. algorithm from seed space to key space (looking random) Privacy and Security Folie Nr. 16

17 Lack of integrity (Malleability) These stream ciphers are malleable: m 1 : From: Bob E: (m k) c 1 = m k p From: Eve D: (c k) c 2 = m k p In this simple example: Bob = 42 6F 62; Eve = ; Bob Eve = (p:= ) Lesson: Modification is undetected and has predictable impact! Privacy and Security Folie Nr. 17

18 Teil 2: Block-Chiffren Erinnerung an Funktionstheorie Pseudo-Zufallsfunktionen (PRF) und Pseudo-Zufallspermutationen (PRP) Grundidee der Block-Chiffren Substitutions-Permutations Netzwerk Feistel Netzwerke Zwei Beispiele: DES und AES Verschlüsselung langer Sequenzen (Operationsmodi) ECB, DCM, CBC mit zufälligem IV, OFB, R-CTR Privacy and Security Folie Nr. 18

19 Stream Ciphers and Block Ciphers message b i t s t r i n g ciphertext # # # # # # # # # k (seed) PRNG running key Goal: Build a secure PRP for b-bit blocks message blocks ciphertext blocks Examples: 3DES: n = 64, k = 168 AES: n = 128, k = 128,192,256 b l o c k b l o c k # # # # # # # # # # b bits key k bits E keys Privacy and Security Folie Nr. 19

20 round loop Interlude: Substitution Permutation Nets SPN implement the Confusion Diffusion Paradigm: Round keys k i are derived from k, then usually -ed with intermediate round output round functions f i are fixed, invertible substitution boxes (S-Box) subsequent fixed bitwise permutation to decorrelate in/output 64-bit input 64-bit round key 64-bit value substitution s 1 s 2 s 3 s 4 s 5 s 6 s 7 s 8 bitwise permutation 64-bit value Privacy and Security Folie Nr. 20

21 R(k 1, ) R(k 2, ) R(k 3, ) R(k n, ) Rounds and Round Keys: Key Expansion Recall from stream ciphers: Short key expanded to encrypt bitstream Idea: Perform several keyed permutations in rounds k G G(k) m c Expand key to round keys as parameters for random permutations k G (key expansion) k 1 k 2 k 3 k n m c Privacy and Security Folie Nr. 21

22 Feistel Networks / DES Goal: Create self-invertible PRP from arbitrary functions Idea: R i = f i (R i-1 ) L i-1 L i = R i-1 with round function f i (possibly non-invertible), keyed with round key k i Inverting is easy (basically identical, f 1 to f d reversed): R i-1 = L i L i-1 = R i f i (L i ) Horst Feistel β bits L i-1 R i-1 f i L i R i round i β bits Lucifer (DES): 56bit keys, 16 rounds standardized by NIST as DES DES is broken (22h for total break in 1999) Extension to 3DES: E(k 1, D(k 2, E(k 3,m)) ) L i-1 R i-1 Privacy and Security Folie Nr. 22 L i f i round i R i

23 The Advanced Encryption Standard 1997: NIST publishes request for proposal 1998: 15 submissions 1999: NIST chooses 5 finalists (Mars: IBM, RC6: RSA, Rijndael: Rijmen/Daemen Belgium, Serpent: Anderson/Biham/Knudsen, Twofish: Bruce Schneier et al.) 2000: NIST chooses Rijndael as AES Key sizes: 128, 192, 256 bits Block size: 128 bits Best known (theoretical) attacks in time 2 99 Privacy and Security Folie Nr. 23

24 input output AES Substitution-Permutation Network 1997: NIST commissions Advanced Encryption Standard (AES) 2000: NIST chooses Belgian proposal Rijndael as AES: k 1 S 1 S 1 k 2 S 1 k n S 2 S 2 S 2 S 3 S 3 S 3 S 16 S 16 S 16 subs. layer perm. layer Not a Feistel network: inversion Privacy and Security Folie Nr. 24

25 AES-128 scheme 10 rounds 4 4 input (1) ByteSub (2) ShiftRow (3) MixColumn (1) ByteSub (2) ShiftRow (3) MixColumn (1) ByteSub (2) ShiftRow k 0 invertible k 1 k 2 k 9 key 16 bytes key expansion: 16 bytes 176 bytes k 10 4 output 4 Privacy and Security Folie Nr. 25

26 Building Block Ciphers (Modes of Operation) So far we have seen PRFs and PRPs (3DES, AES) with fixed input sizes (64 or 128 bits) Your average message will usually be longer than 128 bits Goal: Build secure encryption from secure PRPs Privacy and Security Folie Nr. 26

27 Electronic Code Book Mode Encrypt each block with the keyed PRP: m[0] m[1] F(k) F(k) m[l] F(k) c[0] c[1] c[l] ECB encryption is deterministic identical PT is encrypted to identical CT: Is this secure (how)? Privacy and Security Folie Nr. 27

28 Making operation modes more secure ECB of a deterministic PRP is broken: Two messages encrypted with the same key yield identical CT Even two identical PT blocks are encrypted to identical CT blocks What can we do about this? One-time key (internal): encrypt each block differently Many-time key (external): introduce randomness Privacy and Security Folie Nr. 28

29 Counter Modes and Chaining (1) Encrypt each block differently: Integrate some (changing) value into the encryption of blocks Use Nonces: c i = E(k,n i,m i ) = E(k, (n i,m i )) or E((k,n i ),m i )? and transmit Nonces n i? Introduce counters! (2) Many-time key (introduce randomness): Integrate some (changing) value into the encryption of blocks! Independent randomness for each block (do we need this)? Choose random initial IV Chain/feedback m[0] m[1] m[l] F(k,0) F(k,1) F(k,L) c[0] c[1] c[l] IV m[0] m[1] m[2] m[3] E(k, ) E(k, ) E(k, ) E(k, ) IV c[0] c[1] c[2] c[3] Privacy and Security Folie Nr. 29

30 Randomized Counter Mode R-CTR Let F: K {0,1} n {0,1} n be a secure PRF. E(k,m): choose a random IV {0,1} n and do: IV m[0] m[1] F(k,IV) F(k,IV+1) m[l] F(k,IV+L) IV c[0] c[1] c[l] ciphertext Variation: Choose 128 bit IV as: nonce counter, to avoid repetition Remarks: E, D can be parallelized and F(k,IV+i) can be precomputed R-CTR allows random access, any block can be decrypted on its own Again: F can be any PRF, no need to invert Privacy and Security Folie Nr. 30

31 Zusammenfassung Sie kennen Kryptologie, Kryptographie und Kryptoanalyse Sie wissen was Strom- und Block-Chiffren sind Sie verstehen die unterschiedlichen Angreifermodelle Sie kennen perfekte und semantische Sicherheit und Sie wissen, wie diese nachgewiesen werden Sie kennen das One-Time-Pad Sie können Feistel-Netzwerke und 3DES erklären Sie kennen und verstehen AES Sie kennen sichere und unsichere Operationsmodi Privacy and Security Folie Nr. 31

32 Teil 3: Asymmetrie Ziel: Vereinbarung eines Schlüssels Diffie-Hellman(-Merkle) Alice zieht a, sendet g a mod n Bob zieht b, sendet g b mod n Beide Seiten können g ab mod n berechnen, Eve nicht Ziel: Direkt asymmetrisch verschlüsseln (nicht nur Schlüssel etablieren) Einfachste Idee mit DH (quasi El-Gamal): Öffentlicher Schlüssel von Bob: g b privater Schlüssel: b Alice sendet: E(g ab,m), g a Historisch: Ronald L. Rivest, Adi Shamir, Leonhard M. Adleman: A Method for Obtaining Digital Signatures and Public-Key Cryptosystems. Communications of the ACM, vol. 21, no. 2, 1978, Privacy and Security Folie Nr. 32

33 RSA Mathematische Grundlagen Bei freier Wahl großer Primzahlen p und q: Die Berechnung von n = p q leicht Faktorisierung von n zu p und q schwierig Mit Wissen der Primfaktoren und erweitertem euklidischen Algorithmus ist einfach zu berechnen: Für multiplikative zykl. Gruppe Z n * und e (teilerfremd zu n), gilt e -1 : ggt(e,n) = 1: d e + k n k n 0 mod n e e -1 1 mod n => e -1 = d Privacy and Security Folie Nr. 33

34 RSA - Schlüsselgenerierung Jeder Teilnehmer wählt zufällig und unabhängig 2 verschiedene Primzahlen p, q ungefähr gleicher Länge berechnet n = p q und ϕ (n) = n-p-q+1 = (p-1)(q-1) wählt zufällige Zahlen e,d mit 2 < e < ϕ (n), ggt(e, ϕ(n)) = 1 Und e d = 1 mod (ϕ (n)) (mit erweitertem euklidischen Algorithmus) Öffentlicher Schlüssel: (n, e) Geheimer Schlüssel: (p, q, d) Privacy and Security Folie Nr. 34

35 Ver- und Entschlüsselung Verschlüsselung: Gegeben (N,e), RSA (m): = m e mod N Entschlüsselung: Gegeben (p,q,d), RSA -1 (c): = c -1/e mod N = c d mod N = m e-1/e mod N = m Bonus, Signieren einer Nachricht: Gegeben sk (p,q,d): tag = RSA -1 (pk, h(m)) = RSA(d,h(m)) Privacy and Security Folie Nr. 35

36 Factoring (prime decomposition) Theorem: all integers > 1 are either prime or a product of primes. Factoring: Consider set of integers Z (2) (n)= { N=pq, where p,q are n-bit primes} Task: Find the prime factors (p and q) of a random N in Z (2) (n) Best known algorithm (NFS): exp( O( 3 n)) for n-bit integers Current world record: RSA-768 (232 digits) (200 machine years) Consumed enough energy to heat to boiling point 2 olympic pools (Breaking RSA-2380 equivalent to evaporating all water on earth) Lenstra, Kleinjung, Thomé Privacy and Security Folie Nr. 36

37 Hybride Verschlüsselung secret key (session key) k A,B Public key k e,b Private key k d,b E c 1 D k A,B = D(k d,b,c 1 ) Message m E c 2 c 1, c 2 c 1 = E(k e,b,k A,B ), c 2 = E(k A,B,m) D Message m = D(k A,B,c 2 ) Privacy and Security Folie Nr. 37

38 Zusammenfassung Sie haben Sicherheit, Safety, Datenschutz kennengelernt Sie kennen die Ziele von Sicherheit und Wege zur Minimierung operationeller Risiken Sie kennen den Ablauf einer Sicherheitsanalyse und können eine Bedrohungs-, Schwachstellen- und Risikoanalyse durchführen Sie kennen die Sicherheitsziele CIA und wissen, dass Sie die Annahmen klar festlegen müssen (wie definieren Sie ein Angreifermodell?) Sie kennen einfache Angriffsmethoden und deren Auswirkung Sie wissen, wozu Authentisierung gut ist und wie sie funktioniert Sie kennen Schlüssel und typische Austauschverfahren Sie wissen was Kryptologie, Kryptographie und Kryptanalyse ist Sie kennen einige historische Chiffren, das One-Time Pad und Strom-Chiffren Sie wissen wie Block-Chiffren funktionieren, was Operationsmodi sind und worauf hier zu achten ist! Sie kennen asymmetrische Verfahren und wissen, wie diese einzusetzen sind. Privacy and Security Folie Nr. 38