Upcoming SlideShare
×

Lecture 3b public key_encryption

817 views
710 views

Published on

Network Security Course (ET1318, ET2437) at Blekinge Institute of Technology, Karlskrona, Sweden

Published in: Technology, Education
0 Likes
Statistics
Notes
• Full Name
Comment goes here.

Are you sure you want to Yes No
• Be the first to comment

• Be the first to like this

Views
Total views
817
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
0
0
Likes
0
Embeds 0
No embeds

No notes for slide

Lecture 3b public key_encryption

1. 1. Public-Key Cryptography & Message Authentication
2. 2. Authentication • Requirements - must be able to verify that:  Message came from apparent source or author Authentic  Contents have not been altered message  Sometimes, it was sent at a certain time or sequence • Protection against active attack (falsification of data and transactions) 2 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
3. 3. Approaches to Message Authentication • Authentication Using Conventional Encryption  Only the sender and receiver should share a key • Message Authentication without Message Encryption  An authentication tag is generated and appended to each message • Message Authentication Code - MAC  The use of secret key to generate a small block of data, MAC Or  Calculate the MAC as a function of the message and the key.  MAC = F(K, M) 3 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
4. 4. Message Authentication Code• Need not to be reversible• A & B Share a common secret key KAB• A send message to B  A calculates message authentication code as a function of the message and the key.  MACM1 = F(KAB, M)  The message + MAC are transmitted to B.  B performs the same calculation on the recieved message, using same KAB  MACM2 = F(KAB, M)  If MACM1 = F(KAB, M) = MACM2 = F(KAB, M) – Message has not been altered – From intended sender 4 – Addition of sequence number, give more surity
5. 5. Message Authentication with MAC 5 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
6. 6. One-way HASH function• Alternative to MAC• Input: A variable size message• Output: Fixed size message digest H(M)• No secret Key• Message digest is sent with message in such a way that message digest is authentic  Using conventional encryption  Using Public-Key encryption  Using Secret Value 6
7. 7. One-way HASH function 7 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
8. 8. One-way HASH function cont. • Secret value (known to sender and receiver both) is added before calculating the hash and removed before transmission. • Variation of this technique is HMAC 8 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
9. 9. Secure HASH Functions • Purpose of the one-way or secure HASH function is to produce a ”fingerprint” of a file, message or block of data • Properties of a HASH function H : § H can be applied to a block of data at any size § H produces a fixed length output § H(x) is easy to compute for any given x. § For any given value h, it is computationally in-feasible to find x such that H(x) = h  one-way property / pre-image resistant § For any given block x, it is computationally infeasible to find y ≠ x with H(y) = H(x)  weak collision resistance § It is computationally infeasible to find any pair (x, y) such that H(x) = H(y)  strong collision resistance 9 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
10. 10. Block cipher VS Hash function • Block cipher – symmetric encryption method:  input: blocks of plain-text of a fixed length  output: blocks of cipher-text of the same length • Hash function – both symmetric and asymmetric encryption method  input: binary string of arbitrary length  output: string of some fixed length 10 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
11. 11. Other Secure HASH functions SHA-1 MD5 RIPEMD-160 Digest length 160 bits 128 bits 160 bits Basic unit of 512 bits 512 bits 512 bits processing Number of steps 80 (4 rounds of 64 (4 rounds of 160 (5 paired 20) 16) rounds of 16) Maximum message 264-1 bits size 11 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD
12. 12. HMAC • A keyed-hash message authentication code, or HMAC, is a type of message authentication code (MAC) calculated using a cryptographic hash function in combination with a secret key. • The cryptographic strength of the HMAC depends upon the cryptographic strength of the underlying hash function and on the size and quality of the key. • An iterative hash function breaks up a message into blocks of a fixed size and iterates over them with a compression function. • Motivations:  Cryptographic hash functions executes faster in software than encryption algorithms such as DES  Library code for cryptographic hash functions is widely available  No export restrictions from the US 12 ET2437 - Network SecurityRAJA M KHURRAM SHAHZAD