Cryptography

Lecture 07
 Methods of Defense
Controls
Encryption
• The most powerful tool in providing computer
security in coding.

• Encryption provides confidentiality of data.

• It is important to know the situations in which
encryption is useful and to use it effectively
 Methods of Defense
(contd.)
Software Controls
Software program controls include the following:
• Internal program controls
• Operating system controls
• Development controls
Hardware Controls
• Firewalls
• Intrusion Detection Systems
 Overlapping of
Controls
Physical
Program
Access
Access
Controls
Restrictions
DATA
File Access
Controls

Logical Access
Controls

HARDWAR SOFTWARE
E File Access
Physical Controls
Access
Controls
Why Encryption?
Secrecy or Confidentiality: Able
to keep information secret
Accuracy or Integrity: Certain
type of encryption protect against
forgery or tampering– malicious or
inadvertent
Authenticity: A type of encryption
called digital signature can be used
for unique financial or legal
transactions and hard to forge.
 Cryptography
The study of encryption and decryption. “kryptos”
meaning “hidden” and “graphia” meaning “writing”.

Cipher: An algorithm for encryption and

decryption. A cipher replaces a piece of message
with another object.
Cryptography: Legitimate study of encrypted
messages to convert the messages to the normal form

Cryptanalysis: Study of encrypted messages to break

the encryption

Cryptology: The study of secure communications, which

encompasses both cryptography and cryptanalysis.
Terminology
Sender (S)
Receiver (R)
Transmission Medium
Outsider (O)
 Interceptor
 Intruder
 Encryption and Decryption

Encryption: Process of encoding a message so that its

meaning is not obvious.
Decryption: Process of transforming an encrypted
message back into its normal form.
Cryptosystem: A system for encryption and decryption.
Plain text: The original form of a message
Cipher text: The encrypted form of a message
Outsiders can:
Block
 Prevent transmission or receipt
 Violate availability
Intercept
 Read / Listen
 Violate confidentiality
Modify
 Change / Seize
 Violate integrity
Fabricate
 Spoof
 Violate integrity / accountability
Cryptography
Plain text vs Cipher text
 Plain text: P
 Cipher text: C
Encryption
 Encode / Encrypt
 Denoted: C = E(P)
Decryption
 Decode / Decrypt
 Denoted: P = (D(C))
 Encryption Algorithms

The basic idea is to use a key K

Encryption: Cipher text can be obtained from plain text
using a key
C = E(K,P)
Decryption: When the encryption and decryption keys are
the same, then plain text can be obtained as
P = D(K, E(K,P))
This type of encryption is called Symmetric encryption
 Encryption Algorithms (contd.)
Original
Plaintext Cipher- Plaintext
Encryption text Decryption

Basic Encryption

When the encryption and decryption keys are not similar

then plain text can be obtained as:
P = D(KD, e(KE,P)) where
KE = Encryption key and KD = Decryption key
This type of encryption is called Asymmetric
encryption
 Encryption Algorithms (contd.)
KEY
Original
Plaintext Cipher-text Plaintext
Encryption Decryption

Symmetric Cryptosystem

Encryption key KE Decryption key KD

Original
Plaintext Cipher- Plaintext
Encryption text Decryption

Asymmetric Cryptosystem
 Secret key (Symmetric system )
and Public Key (Asymmetric
system)
Secret Key:
A particular key is shared between two users
Key distribution is a major problem
 n (n-1)/2 keys are needed for n users to communicate

Public Key:
 Works with two keys, public key and the private key
 Public key is publicly available for encryption
 The private key only decrypts the encrypted message
Cryptanalysis
Break an algorithm via:
 Breaking a single message
 Recognizing patterns
 Learn algorithm (ex. Repeated patterns)
 Finding weaknesses in encryption
algorithm
Works with any of the following:
 Intercepted messages (cipher and/or
plain)
 Known encryption algorithms
 Mathematics, statistics, language
properties, etc.
Modular Arithmetic
Represent letters with numbers
 A(0) B(1) C(2) D(3) E(4) F(5)
Can perform calculations
 A+3=D
Circular
 E+3=B
Also known as mod n
Monoalphabetic Ciphers
Also known as substitutions
 Uses a correspondence table
 Each ONE cipher “corresponds” to ONE plain

We will take TWO ciphers:

 The Caesar Cipher
 Named after Julius Caesar
 Permutations
 Monoalphabetic Substitution Ciphers
Substituting each character by another character or
symbol is called monoalphabetic cipher or a simple
substitution.
The Caesar Cipher
• Each letter is translated to the letter a fixed number of
letters after it in the alphabet.
• Uses a shift of 3
• Plain text pi can be used to obtain cipher text ci as
follows:
ci = E(pi ) = pi + 3

Encrypt TREATY IMPOSSIBLE

 The Caesar Cipher

A B C D E F G H I J K L M N O P Q R S T U V WX Y Z
d e f g h i j k l m n o p q r s t u v w x y z a b c

Example:

Plain: TREATY IMPOSSIBLE

Cipher: wuhdwb lpsrvvleoh
The Caesar Cipher
Advantages
 Easy to perform
 Was protected b/c only FEW people could read

 Pattern (pi + 3) is easy to remember
Disadvantages
 Pattern is easy to guess
 Pattern repetition in Cipher
Try breaking the following cipher:
 wklv phvvdjh lv qrw wrr kdug wr euhdn
 Disadvantages of the Caesar
Cipher
• It is easily observable that blanks are not
encrypted and are replaced by blanks itself.
• As English has got few small words, the two
letter words can be easily replaced with few
guesses
• Next the three letter words which have two
continuous same letters can be determined as
such patterned words are very few
• The ciphertext letters uncovered are just three
positions away from their plaintext
counterparts. A cryptanalyst might try that
same pattern on all the unmatched ciphertext.
Permutations
Alphabet is scrambled
Each plaintext letter maps to a
unique ciphertext letter
Example:
Plain: 1,2,3,4,5,6,7,8,9,10
Perm1: 1,3,5,7,9,10,8,6,4,2
Perm2: 10,9,8,7,6,5,4,3,2,1,0
Permutations (cont’d)
Some permutations use keys

Example:
Plain:
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Perm1:
KEYABCDFGHIJLMNOPQRSTUVWXZ
Perm2:
SPECTAULRBDFGHIJKMNOQVWXYZ
Polyalphabetic Substitution
Ciphers

Monoalphabetic ciphers reflect PLAIN

TEXT frequency distribution
Polyalphabetic ciphers aim to provide a
more flat distribution!!!
One way to do so is to COMBINE
monoalphabetic ciphers
 Odd plain text letters use a Permutation
 Even plain text letters use another
Permutation
Vigenère Tableaux
Vigenère Tableaux (cont’d)
Encrypt the following:
Plain: BUT SOFT WHAT LIGHT
Key: Juliet

B U T S O F T W H A T L I G
j u l i e t j u l i e t j u
k o e a s y c q s i x e r a
Cryptanalysis of Poly.
Subs.
# of alphabets used
Break cipher into pieces that were
ciphered with the same alphabet
Solve each piece as a
monoalphabet substitution
 Two tools can help:
 Kasiski method
 Index of coincidence
Kasiski Method
Relies on regularity of English
Not only letters but also groupings
 Ending: th, ing, ed, ion, tion, ation,
etc.
 Beginning: im, in, un, re, etc.
 Patterns: eek, oot, our, etc.
Kasiski Method (cont’d)
Identify all repeated patterns in the
ciphertext
For each pattern:
1. Write down the starting position
2. Compute the distance between successive
starting positions
3. Distance must be a multiple of key length
4. Determine all factors of difference (eg. 21
means the key is either 3 or 7 characters
long)
5. Divide the cipher into blocks (based on key
length)
6. Columns in each block must have been
encrypted using the SAME key character
7. Use frequency distribution to determine
Kasiski Method Example
Cipher text example:

 afexddyzlskfjkwlkdfxskejfkkfexdjfieuyt
y
 2 28

 28 - 2 = 26
 Key must be of length: 1, 2, 13, or 26
The “Perfect” Substitution
Cipher

Use many alphabets (infinite

nonrepeating sequence if
possible)
Kasiski method fails because:
 no repetition occurs
 If a repetition occurs, it does not
mean the end of the key  confusion
One-time Pads
Use key once and destroy
Identical pads at both sides
Problem:
 Need for absolute synchronization
 Need for unlimited number of keys
One-Time Pads
Long Random Number Sequences
 Random numbers are NOT random!
 They form a sequence with a VERY LONG
period
Vernam Cipher
 Random numbers are generated from a
tape
 Safe as long as tape is not reused
Binary Vernam Cipher
 Rely on binary operations
 Encrypts binary data using binary data
 Produces binary data
 Can be easily performed on computers
(XOR)
The Vernam Cipher
It is a type of One-Time pad
Immune to cryptanalytic attacks