Asymmetric Cryptography
Domain 5
Pages 822-861
Official CISSP CBK Third Edition

Tim Jensen & Jem Jensen
StaridLabs
Symmetric Vs Asymmetric
In the Beginning...
●
●

●

Asymmetric cryptography is very new.
Largely attributed to Dr Whit Diffie and Dr Martin
Hellma...
Basics of Asymmetric
1) A keypair is generated
1)generally by the application to ensure the strength of key
generation (ke...
Private to Public
●

●

When the private key is used to encrypt a message,
the message can be ready by anyone who possesse...
RSA
●

●

Developed in 1978 by Ron Rivest, Adi Shamir, and
Len Adleman
Based on the mathematical challenge of factoring
th...
RSA Factoring Attacks
●

512 bit factoring attacks have been successful.
–

●

Took 8000 MIPS years. 1 MIPS is 1 million i...
Attacking RSA
●
●

●

Brute force: Trying all possible private keys
Mathematical attacks: Factoring the product of two
pri...
Diffie-Hellmann Algorithm
●

●

●

Algorithm for key exchange. Uses discrete
logarithms
Allows two users to exchange or ne...
Diffie in a GIF
El Gamal
●

Based on Diffie-Hellmann but included the ability to
provide message confidentiality and digital signature
ser...
Elliptical Curve Cryptography (ECC)
●

●
●

Uses discrete logarithmic algorithms based on the complex
mathematics of ellip...
Asymmetric advantages
●

Ability to send a message across an untrusted
medium in a secure manner without prior key
exchang...
Asymmetric Disadvantages
●
●

●

Extremely slow compared to symmetric
Impractical for large amounts of data and frequent
t...
Hybrid Cryptography
●

●

Symmetric can be used for encrypting large files and
handling encryption/decryption without impa...
Message Digests
●

●

A message digest is a small representation of a
larger message. Message digests are used to ensure
t...
Message Authentication Code
●

●

MAC, also known as a cryptographic checksum, is a
small block of data that is generated ...
MAC Characteristics
●

●

●

A MAC is much smaller than the message
generating it
Given a MAC, it is impractical to comput...
MAC Example
●

●

If a sending is using DES-CBC and generates a
MAC during the transaction, the MAC is the last
block of c...
HMAC
●

●

A hash MAC operation uses a hash function to
verify message integrity.
HMAC's are calculated by taking a secret...
Hashing
●

●

A hash function accepts an input message of any
length and generates, through a one-way operation,
a fixed-l...
Key properties of a hash function
●

●

●

●

●

Uniformly distributed – The hash output value should not be
predictable
W...
MD5 Message Digest Algorithm
●

Developed by Ron Rivest at MIT in 1992

●

Generates a 128 bit digest from a message of an...
SHA/SHA-1
●

The Secure Hash Algorithm was developed by NIST in 1993 and issued as
FIPS 180

●

A revised version (FIPS 18...
SHA-3
●

●

NIST is currently evaluating hash algorithms to
choose SHA-3.
(Update: Keccak has tentatively been chosen, but...
HAVAL
●

●

●

●

HAVAL was developed at the University of Wollongong in
Australia
It combines a variable length output wi...
RIPEMD-160
●

●
●

●

●

Developed by the European RACE Integrity Primitives
Evaluation project
In response to vulnerabili...
Hash/MAC attacks
●

Primary attack methods:
–

Brute force
●

●

–

Must find a weakness in the hashing algorithm that wou...
Birthday Paradox
●

●

●

●

Describes the probability of finding two people with the
same birthday from a group of people...
Key Management
●

Auguste Kerchhoff's law:
–

●

“A cryptosystem should be secure even if everything
about the system, exc...
Key Management
●

●

Loss of a key is the same as loss of the data itself –
protect it!
Control issuance, revocation, reco...
XKMS
●

Why is this here? Seems tangential

●

XML Key Management Specification
–

●

Spec defines protocols for distribut...
XKMS
●

X-KISS
–

●

Client delegates tasks to a trust server

X-KRSS
–

Registers public keys
Creating & Distributing Keys
●

Automated key generation
–

●

●

Hopefully quicker and more random than manual

Keys must...
Randomness
●

●

If an attacker can easily guess at a key or find
patterns in the key, it takes less effort to break
Compu...
Cupcakes Sausage
●

●

If we generate randomness with an algorithm, it isn't
really random since it follows the formula
Th...
Randomness
●

An initialization vector (IV) or seed is:
–

A value fed into a randomness algorithm to produce
apparently r...
Random Example!
Key Length
●

●

Cryptographic security is a logarithmic measure of
the fastest known computational attack on the
algorith...
Key Length
●

●

●

The longer the key, the more expensive to
encrypt/decrypt
The goal should be a key of just enough leng...
Asymmetric Key Length
●

●

Asymmetric cryptography relies on the difficulty of
solving certain mathematical problems
That...
Key Distribution
●

●

Exchanging keys is dangerous – if anyone intercepts
the key, they can decrypt messages
One solution...
Key Distribution
●

Methods:
–

Out-of-band exchange (CD, Fax, Phone call)

–

PKI key server
●

–

Central repository of ...
Key Storage
●

Often buried within equipment, inaccessible to the
users
–

●

Stored in protected smart cards (KEK cards)
...
NIST Guidelines
●

Keys should be signed with a MAC and encrypted

●

Make backup copies of central/root keys

●

Provide ...
Risk Factors (NIST)
●

Strength of cryptographic mechanisms

●

The implementation of the mechanism

●

The operating envi...
Key Destruction
●
●

Generally, shorter key periods enhance security
Once deleted, the key could still reside in memory
or...
Key Destruction
●

Manual keys
–

●

Higher risk to update and distribute – sometimes more
secure to update less frequentl...
Key Destruction
●

Balancing act
–
–

●

Reissuing too often can become excessively burdensome
Still has to happen enough ...
Cost of Certificate Replacement
●

Re-keying a large database or replacing a large
number of keys is very expensive
–

●

...
Key Recovery
●

Methods:
–

Common trusted directory

–

Policy requiring all keys be registered with security
department
...
Key Recovery
●

Multiparty key recovery
–
–

●

Divide the key into multiple parts
Pass out to multiple parties

Key escro...
CISSP Week 20
Upcoming SlideShare
Loading in …5
×

CISSP Week 20

746 views
661 views

Published on

Published in: Education, Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
746
On SlideShare
0
From Embeds
0
Number of Embeds
6
Actions
Shares
0
Downloads
150
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

CISSP Week 20

  1. 1. Asymmetric Cryptography Domain 5 Pages 822-861 Official CISSP CBK Third Edition Tim Jensen & Jem Jensen StaridLabs
  2. 2. Symmetric Vs Asymmetric
  3. 3. In the Beginning... ● ● ● Asymmetric cryptography is very new. Largely attributed to Dr Whit Diffie and Dr Martin Hellman (Diffie-Hellman) Diffie-Hellman released a paper in 1976 called “New Directions in Cryptography” which brought asymmetric cryptography mainstream
  4. 4. Basics of Asymmetric 1) A keypair is generated 1)generally by the application to ensure the strength of key generation (keygen) 2) One key is designated the private key and is kept secret by the user. 3) The other key is designated the public key and is freely given to anyone 4) Algorithms use one way functions to encrypt data with a key that can only be decrypted by the other key in a keypair. Not even the key used to encrypt can decrypt
  5. 5. Private to Public ● ● When the private key is used to encrypt a message, the message can be ready by anyone who possesses the corresponding public key. This provides non-repudiation since the receiver can have reasonable assurance that the message came from the intended sender. This is only applicable if the private key is properly secured.
  6. 6. RSA ● ● Developed in 1978 by Ron Rivest, Adi Shamir, and Len Adleman Based on the mathematical challenge of factoring the product of two large prime numbers
  7. 7. RSA Factoring Attacks ● 512 bit factoring attacks have been successful. – ● Took 8000 MIPS years. 1 MIPS is 1 million instructions per second. MIPS year is 31.5 trillion instructions per year. An i7 processor does 147,600 MIPS or 12.7 quadrillion instructions per year(if my calculation is correct) 1024 bit factoring attacks are quickly becoming economically feasible. NIST recommended moving away from 1024 by the end of 2010. Users weren't listening so the Certificate Authority Forum mandated that CA's stop issuing 1024 bit web certificates by Oct 1, 2014
  8. 8. Attacking RSA ● ● ● Brute force: Trying all possible private keys Mathematical attacks: Factoring the product of two prime numbers Timing attacks: Measuring the running time of the decryption algorithm
  9. 9. Diffie-Hellmann Algorithm ● ● ● Algorithm for key exchange. Uses discrete logarithms Allows two users to exchange or negotiate a secret symmetric key Diffie-Hellman does not provide message confidentiality
  10. 10. Diffie in a GIF
  11. 11. El Gamal ● Based on Diffie-Hellmann but included the ability to provide message confidentiality and digital signature service
  12. 12. Elliptical Curve Cryptography (ECC) ● ● ● Uses discrete logarithmic algorithms based on the complex mathematics of elliptic curves. Fast and high strength Highest strength per bit of key length of any asymmetric algorithm. ● Shorter keys allow computational power savings. ● Beneficial in smart cards, wireless, etc ● Provides confidentiality, digital signatures, and message authentication
  13. 13. Asymmetric advantages ● Ability to send a message across an untrusted medium in a secure manner without prior key exchange ● Non-repudiation of origin ● Access control ● Data integrity ● Non-repudiation of delivery
  14. 14. Asymmetric Disadvantages ● ● ● Extremely slow compared to symmetric Impractical for large amounts of data and frequent transactions Ciphertext output from asymmetric may be much larger than the plaintext making storage and transmission costly
  15. 15. Hybrid Cryptography ● ● Symmetric can be used for encrypting large files and handling encryption/decryption without impacting delivery time or performance Asymmetric crypto can handle the initial setup of the communications session through the exchange and negotiation of the symmetric keys
  16. 16. Message Digests ● ● A message digest is a small representation of a larger message. Message digests are used to ensure the authentication and integrity of information and not confidentiality Example MD5
  17. 17. Message Authentication Code ● ● MAC, also known as a cryptographic checksum, is a small block of data that is generated using a secret key and then appended to the message. When message is received, the recipient generates their own MAC using the secret key and can validate that the message has not changed during transit
  18. 18. MAC Characteristics ● ● ● A MAC is much smaller than the message generating it Given a MAC, it is impractical to compute the message that generated it Given a MAC and the message that generated it, it is impractical to find another message generating the same MAC
  19. 19. MAC Example ● ● If a sending is using DES-CBC and generates a MAC during the transaction, the MAC is the last block of ciphertext generated by the algorithm. This block of data is transmitted to the recipient. If the recipient runs the decrypt operation and receives the same last block of ciphertext then the checksum is valid and can prove authentication since only someone with the secret key could generate the message.
  20. 20. HMAC ● ● A hash MAC operation uses a hash function to verify message integrity. HMAC's are calculated by taking a secret key balue to a hash input function along witht he source message. ● HMAC's are more efficient than MAC's ● Used often with SSL/TLS, IPSEC, etc
  21. 21. Hashing ● ● A hash function accepts an input message of any length and generates, through a one-way operation, a fixed-length output. It does not use a secret key. The only input is the input message.
  22. 22. Key properties of a hash function ● ● ● ● ● Uniformly distributed – The hash output value should not be predictable Weak collision resistance - Difficult to find a second input value that hashes to the same value as another input Difficult to invert – Should be one way, should not be able to derive hash input x by reversing the hash function on output y Strong collision Resistance – Difficult to find any two inputs that hash to the same value Deterministic – Given an input x, it must always generate the same hash value y
  23. 23. MD5 Message Digest Algorithm ● Developed by Ron Rivest at MIT in 1992 ● Generates a 128 bit digest from a message of any length ● Processes the message in 512 bit blocks and does 4 rounds of processing. Each round contains 16 steps ● Hash/message collision odds are 264 ● Odds of reversing a message from a hash are 2 128 ● ● ● Commonly used in forensic investigations to ensure that the original media has not been altered since seizure Recently there have been several attacks developed against MD5 where it is now possible to find collisions. MD5 should be phased out. MD4 is weaker than MD5 and should not be used
  24. 24. SHA/SHA-1 ● The Secure Hash Algorithm was developed by NIST in 1993 and issued as FIPS 180 ● A revised version (FIPS 180-1) was issued in 1995 for SHA-1 ● SHA was based on the MD4 algorithm whereas SHA-1 uses MD5 ● ● ● ● SHA-1 operates on 512 bit blocks and can handle any message up to 2 64 bits in length. The output hash is 160 bits Processing includes 4 rounds of operations of 20 steps each Recently there have been several attacks descripbed against SHA-1 despite it being considerably stronger than MD5 NIST issued FIPS 180-3 which recognizes SHA-1, SHA-224, SHA-256, SHA384, SHA-512 as part of the secure hash standard. Output varies from 160 to 512 bits
  25. 25. SHA-3 ● ● NIST is currently evaluating hash algorithms to choose SHA-3. (Update: Keccak has tentatively been chosen, but there is some controversy)
  26. 26. HAVAL ● ● ● ● HAVAL was developed at the University of Wollongong in Australia It combines a variable length output with a variable number of rounds of operation on 1024 bit input blocks. The output can be 128, 160, 192, 224, or 256 bit and the number of rounds may vary from 3 to 5 HAVAL operates 60% faster than MD5 when only 3 rounds are used and just as fast when 5 rounds are used Not to be confused with HALAL
  27. 27. RIPEMD-160 ● ● ● ● ● Developed by the European RACE Integrity Primitives Evaluation project In response to vulnerabilities found in MD4 and MD5 The original algorithm RIPEMD-128 had the same vulnerabilities as MD4/MD5. Output for RIPEMD-160 is 160 bits and operates on 512 bit blocks. Performs 5 paired rounds of 16 steps each for 160 operations
  28. 28. Hash/MAC attacks ● Primary attack methods: – Brute force ● ● – Must find a weakness in the hashing algorithm that would allow an attack to reconstruct the original message from the hash value, find another message with the same hash value, or find any pair of messages with the same hash value Oorschot and Weiner developed a machine that could find a collision on a 128 bit hash in about 24 days Cryptanalysis ● ● Side channel attack – Attack implementation of algorithm rather than the algorithm directly Rainbow tables – pre-computed lists of hashes. Can be defeated by salting
  29. 29. Birthday Paradox ● ● ● ● Describes the probability of finding two people with the same birthday from a group of people In a room of 23 people there's more than a 50% chance of two of them sharing the same birth day Same principal can theoretically be used in hashing to find a collision Attacker wants to 1: Change the message contents to what he wants or 2: cast some doubt on the authenticity of the original message
  30. 30. Key Management ● Auguste Kerchhoff's law: – ● “A cryptosystem should be secure even if everything about the system, except the key, is public knowledge” Claude Shannon: – “The enemy knows the system”
  31. 31. Key Management ● ● Loss of a key is the same as loss of the data itself – protect it! Control issuance, revocation, recovery, and distribution of keys
  32. 32. XKMS ● Why is this here? Seems tangential ● XML Key Management Specification – ● Spec defines protocols for distributing and registering public keys (W3C) Consists of 2 parts: – XML Key Information Sercive Spec (X-KISS) – XML Key Registration Service Spec (X-KRSS)
  33. 33. XKMS ● X-KISS – ● Client delegates tasks to a trust server X-KRSS – Registers public keys
  34. 34. Creating & Distributing Keys ● Automated key generation – ● ● Hopefully quicker and more random than manual Keys must take a sufficient amount of time and effort for an attacker to break them The two main factors in a strong key are: – Randomness – Key length/size
  35. 35. Randomness ● ● If an attacker can easily guess at a key or find patterns in the key, it takes less effort to break Computers are designed for predictability and order so creating pseudo randomness can be troublesome
  36. 36. Cupcakes Sausage ● ● If we generate randomness with an algorithm, it isn't really random since it follows the formula The solution? SEEDS! … … ... ● Not those kinds of seeds!
  37. 37. Randomness ● An initialization vector (IV) or seed is: – A value fed into a randomness algorithm to produce apparently random results – Common seeds are mouse movements or time between keyboard inputs – Could also be manually input like with WEP/WPA ● As we've shown in previous classes, wireless keys are rarely random... ex: “password123”
  38. 38. Random Example!
  39. 39. Key Length ● ● Cryptographic security is a logarithmic measure of the fastest known computational attack on the algorithm Key length is distinct from cryptographic security, meaning a longer key doesn't necessarily mean more security Ex: 3DES with a key length of 168 (3x 56 bit keys) only has an effective security of 112 (2x 56) due to the meet in the middle attack
  40. 40. Key Length ● ● ● The longer the key, the more expensive to encrypt/decrypt The goal should be a key of just enough length to protect the information Depends on the worth of the information – Many websites use HTTP for much of their site because it's public and of low worth to protect – When they use HTTPS, they may use the lowest level they can so that the site is fast and doesn't tax their server
  41. 41. Asymmetric Key Length ● ● Asymmetric cryptography relies on the difficulty of solving certain mathematical problems That means it's easier to brute-force answers than to run the computations – Therefore asymmetric keys must be longer than symmetric to resist these attacks RSA (asymmetric) key length Equivalent to symmetric key length 1024-bit 80-bit 2048-bit 112-bit 3072-bit 128-bit 15,360 256-bit
  42. 42. Key Distribution ● ● Exchanging keys is dangerous – if anyone intercepts the key, they can decrypt messages One solution is a Key Encrypting Key (KEK) – Process of using a KEK called Key Wrapping – Protocols which use KEK: SSL, PGP, S/MIME
  43. 43. Key Distribution ● Methods: – Out-of-band exchange (CD, Fax, Phone call) – PKI key server ● – Central repository of public keys Key distribution center (KDC) ● ● Each user has a master (secret) key to talk to KDC KDC sets up session keys to talk to other users
  44. 44. Key Storage ● Often buried within equipment, inaccessible to the users – ● Stored in protected smart cards (KEK cards) Keys must have expiration dates to prevent longterm cryptanalytic attacks
  45. 45. NIST Guidelines ● Keys should be signed with a MAC and encrypted ● Make backup copies of central/root keys ● Provide key recovery capabilities ● Archive user keys for the period of time where a key can be used to protect information
  46. 46. Risk Factors (NIST) ● Strength of cryptographic mechanisms ● The implementation of the mechanism ● The operating environment ● The volume of information/# of transactions ● The security life of the data ● The security function (encryption, signing) ● The re-keying method ● The key update process ● The number of nodes with shared keys ● The number of copies of shared keys ● The threat to the information (who might be attacking)
  47. 47. Key Destruction ● ● Generally, shorter key periods enhance security Once deleted, the key could still reside in memory or on disk until sufficiently overwritten – Actually erasing can take multiple passes of overwriting the memory – Sometimes a key will reside in memory for so long that it gets “burned in” ● Can be mitigated by splitting the key in memory
  48. 48. Key Destruction ● Manual keys – ● Higher risk to update and distribute – sometimes more secure to update less frequently and control keys more closely with compensating controls Different key lifetimes depending on user roles – Key to use the printer could last much longer than key to open the datacenter due to lower risk
  49. 49. Key Destruction ● Balancing act – – ● Reissuing too often can become excessively burdensome Still has to happen enough to minimize loss Handle lost/compromised keys – Data signed before compromise should still be good – Should just prevent use of the key after the date it was compromised
  50. 50. Cost of Certificate Replacement ● Re-keying a large database or replacing a large number of keys is very expensive – ● Might justify expensive security measures to offset longer key lifecycle Conversely, you might justify shorter periods – Example: Employee keys expires more often so they must continually prove they are still authorized to have access. If they quit/change jobs, the shorter lifecycle will ensure they lose access
  51. 51. Key Recovery ● Methods: – Common trusted directory – Policy requiring all keys be registered with security department – Stenography? (bury key in an image) – Password wallet
  52. 52. Key Recovery ● Multiparty key recovery – – ● Divide the key into multiple parts Pass out to multiple parties Key escrow – Ensure third-party retains a copy of the key or their own key – Must be explicit trust between company and the third-party

×