Downloaded 17 times
![RSA (1977) RSA Security, PKCS #1 modulus n = product of 2 large primes p, q public: e = relatively prime to (p-1)(q-1) private: d = e -1 mod ((p-1)(q-1)) C = P e mod n [ P < n ] P = C d mod n small e => faster encryption](https://image.slidesharecdn.com/06esugcrypto2-12874629454595-phpapp02/85/Cryptography-for-Smalltalkers-2-ESUG-2006-5-320.jpg)
![MD5 (MD5 hash: 'Hello' asByteArray) asHexString (MD5 hash: #[1 2 3 4 5] from: 2 to: 4) asHexString input := #[1 2 3 4 5 6 7 8 9] readStream. (MD5 hashNext: 3 from: input) asHexString (MD5 hashFrom: input) asHexString](https://image.slidesharecdn.com/06esugcrypto2-12874629454595-phpapp02/85/Cryptography-for-Smalltalkers-2-ESUG-2006-17-320.jpg)
![Books [1] Anderson: Security Engineering [2] Ferguson, Schneier: Practical Cryptography [3] Kahn: The Codebreakers [4] Menezes, van Oorschot, Vanstone: Handbook of Applied Cryptography [5] Schneier: Applied Cryptography](https://image.slidesharecdn.com/06esugcrypto2-12874629454595-phpapp02/85/Cryptography-for-Smalltalkers-2-ESUG-2006-25-320.jpg)
Uploaded byMartin Kobetic
Cryptography for Smalltalkers 2 - ESUG 2006
The document discusses various topics in public key cryptography including public key algorithms like RSA and Diffie-Hellman key exchange. It also covers hashing algorithms like MD5 and SHA, digital signatures using RSA and DSA, and applications like encryption, key establishment, and signing. Code examples are provided in Smalltalk to demonstrate encrypting, decrypting, signing and verifying messages using these cryptographic techniques.
Cryptography for Smalltalkers 2 - ESUG 2006
- 1. Cryptography or Smalltalkers2 Public Key Cryptography Martin Kobetic Cincom Smalltalk Development ESUG 2006
- 2. Contents Public KeyAlgorithms Encryption (RSA) Key Establishment (RSA, DH) Signing Hashes (SHA, MD5) MACs (HMAC, CBC-MAC) Digital Signatures (RSA, DSA)
- 3. Public Key Algorithmspublic and private key hard to compute private from the public sparse key space => much longer keys based on “hard” problems factoring, discrete logarithm much slower RSA, DSA, DH, ElGamal elliptic curves: ECDSA, ECDH, …
- 4. Encryption provides: confidentialitysymmetric (secret) key ciphers same (secret) key => encrypt and decrypt DES, AES, RC4 asymmetric (public) key ciphers public key => encrypt private key => decrypt RSA,ElGammal
- 5. RSA (1977) RSASecurity, PKCS #1 modulus n = product of 2 large primes p, q public: e = relatively prime to (p-1)(q-1) private: d = e -1 mod ((p-1)(q-1)) C = P e mod n [ P < n ] P = C d mod n small e => faster encryption
- 6. RSA keys :=RSAKeyGenerator keySize: 512. alice := RSA new publicKey: keys publicKey. ctxt := alice encrypt: 'Hello World' asByteArray. ctxt asHexString bob := RSA new privateKey: keys privateKey. (bob decrypt: ctxt) asString
- 7. RSA keys :=RSAKeyGenerator keySize: 512. alice := RSA new publicKey: keys publicKey. msg := 'Hello World' asByteArrayEncoding: #utf8. msg := alice encrypt: msg. bob := RSA new privateKey: keys privateKey. msg := bob decrypt: msg. msg asStringEncoding: #utf8
- 8. Key Establishment publickey too slow for bulk encryption public key => secure symmetric key symmetric key => bulk encryption key exchange (RSA) generate one-time symmetric key public key => encrypt the symmetric key key agreement (DH) parties cooperate to generate a shared secret
- 9. RSA – KeyExchange key := DSSRandom default byteStream next: 40. msg := 'Hello World!' asByteArray. msg := (ARC4 key: key) encrypt: msg. alice := RSA new publicKey: keys publicKey. key := alice encrypt: key. bob := RSA new privateKey: keys privateKey. key := bob decrypt: key ((ARC4 key: key) decrypt: msg) asString.
- 10. Diffie-Hellman (1976) sharedsecret over unprotected channel http://www.ietf.org/rfc/rfc2631. txt modulus p: large prime (>=512b) order q: large prime (>=160b) generator g: order q mod p private x: random 1 < x < q - 1 public y: g^x mod p public y’: other party’s y = g^x’ (mod p) shared secret: y’^x = y^x’ (mod p)
- 11. Diffie-Hellman (interactive) gen:= DHParameterGenerator m: 160 l: 512. alice := DH p: gen p q: gen q g: gen g. ya := alice publicValue. bob := DH p: alice p q: alice q g: alice g. yb := bob publicValue. ss := bob sharedSecretUsing: ya ss = (alice sharedSecretUsing: yb)
- 12. Diffie-Hellman (offline) bob:= DH newFrom: gen. yb := bob publicValue. alice := DH newFrom: gen. ya := alice publicValue. ss := (alice sharedSecretUsing: yb) asByteArray. msg := 'Hello World!' asByteArray. msg := (ARC4 key: ss) encrypt: msg. ss := (bob sharedSecretUsing: ya) asByteArray. ((ARC4 key: ss) decrypt: msg) asString.
- 13. Signing Provides: integrity(tamper evidence) authentication non-repudiation Hashes (SHA, MD5) Digital Signatures (RSA, DSA)
- 14. Hash Functions provides:data “fingerprinting” unlimited input size => fixed output size must be: one-way : h(m) => m collision resistant : m1,m2 => h(m1) = h(m2) MD2, MD4, MD5, SHA, RIPE-MD
- 15. Hash Functions compressionfunction: M = M 1 , M 2 , … h i = f(M i , h i-1 ) MD-strengthening: include message length (in the padding) doesn’t completely prevent “length extension”
- 16. MD5 (1992) http://www.ietf.org/rfc/rfc1321.txt (Ron Rivest) digest: 128-bits (16B) block: 512-bits (64B) padding: M | 10...0 | length (64bits) broken in 2004, avoid MD5!
- 17. MD5 (MD5 hash:'Hello' asByteArray) asHexString (MD5 hash: #[1 2 3 4 5] from: 2 to: 4) asHexString input := #[1 2 3 4 5 6 7 8 9] readStream. (MD5 hashNext: 3 from: input) asHexString (MD5 hashFrom: input) asHexString
- 18. SHA (1993) SHS- NIST FIPS PUB 180 digest: 160 bits (20B) block: 512 bits (64B) padding: M | 10...0 | length (64bits) FIPS 180-1: SHA-1 (1995) FIPS 180-2: SHA-256, 384, 512 (2002) SHA-1 broken in 2005!
- 19. SHA input :='Hello World!' asByteArray readStream. sha := SHA new. sha updateWithNext: 5 from: input. sha digest asHexString. sha updateFrom: input. sha digest asHexString. input reset. (SHA256 hashFrom: input) asHexString.
- 20. Digital Signatures authentic,non-reusable, unalterable signing uses the private key message, key => signature verification uses the public key message, key, signature => true/false
- 21. RSA signing: hashthe plaintext encode digest encrypt digest with private key verifying: decrypt digest with public key decode digest hash the plaintext compare the digests
- 22. RSA alice :=RSA new privateKey: keys privateKey. msg := 'Hello World' asByteArray. sig := alice sign: msg. sig asHexString bob := RSA new publicKey: keys publicKey. bob verify: sig of: msg
- 23. DSA (1994) NISTFIPS PUB 186 p prime (modulus): (512 + k*64 <= 1024) q prime factor of p – 1 (160 bits) g > 1; g^q mod p = 1 (g has order q mod p) x < q (private key) y = g^x mod p (public key) FIPS 186-1 (1998): RSA(X9.31) FIPS 186-2 (2001): ECDSA(X9.62) FIPS 186-3 (?2006): bigger keys up to 15K bits
- 24. DSA keys :=DSAKeyGenerator keySize: 512. alice := DSA new privateKey: keys privateKey. sig := alice sign: 'Hello World' asByteArray bob := DSA new publicKey: keys publicKey. bob verify: sig of: 'Hello World' asByteArray
- 25. Books [1] Anderson:Security Engineering [2] Ferguson, Schneier: Practical Cryptography [3] Kahn: The Codebreakers [4] Menezes, van Oorschot, Vanstone: Handbook of Applied Cryptography [5] Schneier: Applied Cryptography
Editor's Notes
- #4 much slower than secret key encryption: expensive operations (x^y mod z), long keys (1-8K bits) => used for key encryption/exchange, signing elliptic curve crypto (ECC) same ciphers, different number field allows much shorter keys for comparable security => faster heavily patented (www.certicom.com) some royalty free licenses for specific purposes (NIST/IETF)
- #5 Usage: sender uses the *public* key of the recipient to encrypt the message receiver uses her *private* key to decrypt the message encryption does not provide integrity protection!
- #6 Rivest, Shamir, Adelman can be used for both encryption and digital signatures use small e to optimize encryption/verification Pitfalls: don’t use the same key to encrypt and sign; decrypting c is the same operation as signing c ! not good with small messages; if modular reduction doesn’t occur (good chance with small e), the plaintext can be recovered by simple (non-modular) e-th root computation; => PKCS#1 applies padding in fact any kind of structure in the message seems to facilitate attacks; messages should be protected against that using suitable “encoding”; including padding => use PKCS#1 v2.1 – OAEP padding
- #8 public key structure: n, e ciphertext size is 512 bits! (depends on the key size) private key structure: n, d p, q: CRT => 3-4 times speed up of decryption.
- #10 you have to transfer both the encrypted key and the encrypted message
- #11 allows to establish a shared, secret value over an unprotected communication channel used to establish a secret session key for further communication (DH handshake) doesn’t provide authentication of the parties => doesn’t protect against the man-in-the-middle attack small subgroup attack –small order g the shared secret is in that subgroup, if the group is small enough, it can be searched for the secret => solution: safe primes p = 2q + 1; q prime
- #12 m – bit size of q => bit size of x (at least twice the size of symmetric key) l – bit size of p => bit size of y - Ephemeral-ephemeral DH - perfect forward secrecy (PFS)
- #13 Ephemeral-static DH Unlike RSA with DH Bob needs ya to decrypt!
- #15 a.k.a “message digest” one-way : hard to find the input for given output collision resistant : hard to find two distinct inputs with the same output used a lot in MACs and digital signatures used for file “fingerprints”: md5sum, sha1sum
- #16 MD-strengthening: with inclusion of the length no encoded input is a prefix of another encoded input MD-stregthening helps a lot but doesn’t completely prevent “length extension” if M2 = M1’ || X => h(M2) = h ( h (M1) || X)) M1’ means, the original M1 message padded as prescribed by the hash function possible fixes: h(h(M), M) – expensive, or h(h(M)) - weaker; MACs usually address the weakness as well
- #17 derived from MD4 (fixing known MD4 weaknesses) broken in 2004 by Wang, Yin; furher improved by others currently collision in a few hours on common desktop PC
- #18 higher level API, processes entire input at once both stream and byte array based parameter support
- #19 also derived from MD4 SHA-0 broken (Wang, Yin, Yu 2004): collisions in 2**69 instead of 2**80 SHA-1 broken (Wang, Yin, Yu 2005): collisions in 2**69 instead of 2**80
- #20 lower-level API, processes input in arbitrary chunks can get digest value in progress, I.e can continue with updates after a #digest call can clone a digest in progress (#copy) can be queried for #blockSize and #digestSize and current #messageLength can reuse algorithm instances after #reset
- #21 - bound to the key and to the data being signed (it won’t validate with any other data)
- #22 digest encoding is to expand the digest to match the bit-size of n destroy any structure that the encoded bytes might have seed a random generator with the digest and use as many bytes as possible
- #24 based on “discrete logarithm” problem used for signatures only signing: Generate a random per message value k where 0 < k < q (this is known as a nonce ) Calculate r = ( g k mod p ) mod q Calculate s = ( k -1 (SHA-1( m ) + x * r )) mod q Recalculate the signature in the unlikely case that r =0 or s =0 The signature is ( r , s ) verification: Reject the signature if either 0< r <q or 0< s <q is not satisfied. Calculate w = ( s ) -1 mod q Calculate u 1 = (SHA-1( m )* w ) mod q Calculate u 2 = ( r * w ) mod q Calculate v = (( g u 1 * y u 2 ) mod p ) mod q The signature is valid if v = r Note: FIPS-186-2, change notice 1 specifies that L should only assume the value 1024 forthcoming FIPS 186-3 (described, e.g., in SP 800-57) uses SHA-224, SHA-256, SHA-384, and SHA-512 as a hash function, q of size 224, 256, 384, and 512 bits, with L equal to 2048, 3072, 7680, and 15360, respectively.