CS_GA2009_Paper

2009 Workshop on Cyber Security and Global Affairs

Cryptographic Systems
Evaluation Problem

Alexandra A. Savelieva
Prof. Sergey M. Avdoshin

State University – Higher School of Economics, Russia
Software Engineering Department

Old Chinese Curse

寧為太平犬，
不做亂世人 *

*May you live in interesting times

2 Higher School of Economics - 2009

Data Protection and Financial Chaos
Human factor
Malicious insiders
Fired employees
Hardware loss
Laptop theft
Storage theft
And this means good
crypto!

CIO challenge: how to select an appropriate information
security strategy within budget limitations and growing
risks of unauthorized access to information assets?


Agenda

1. Analysis of relevant approaches

2. Problem statement

3. Solution

4. Conclusions


Evaluation Methods

Cryptographic Security Analysis
Mathematical implications (Bennet S. Yee)
Formalized security risk analysis and
management methodologies
Various tools for cryptographic protocols
analysis


Evaluation Methods

analysis



«… it becomes increasingly
clear that the term "security"
doesn't have meaning unless
also you know things like
"Secure from whom?" or
"Secure for how long?“»


Evaluation Methods

Mathematical implications
(Bennet S. Yee)
analysis



Security Measures as Resource Estimates
Work Factor Estimates
The Security-Through-Obscurity
Conundrum
The Monty Hall Problem


Evaluation Methods
British CRAMM (by Insight Consulting, Siemens)
American RiskWatch (by RiskWatch)
Russian GRIF (by Digital Security)
Various tools for cryptographic protocols analysis


Formalized security risk analysis: CRAMM
A comprehensive risk assessment
method with the ability to carry out
various functions including:
• Pre-defined risk assessments covering
generic information systems
• BS7799: 2005 Compliance
• Production of Security Documentation
• Investigation against Standards

Drawbacks:
• peculiarities of cryptographic systems are not taken into
account!


Evaluation Methods

Various tools for cryptographic
protocols analysis


Tools for cryptographic protocols analysis

Main classes:
Deductive methods
Static analysis methods
State exploration methods

Drawbacks:
the supposition that cryptographic algorithms
satisfy perfect encryption assumptions, so the
strength of ciphers remains out of scope


Comparative analysis

Economic Adversary
Evaluation technique Applicability
indicators resourses

Cryptographic security
analysis + - ±
Mathematical
implications ± + -
(Bennet S. Yee)
Formalized security risk
analysis - + +
Tools for cryptographic
protocols analysis ± - -


In our paper, we aim to…
formulate the steps of cryptographic systems
evaluation process;
develop a mathematical model of security
threats;
design software tools to facilitate the process
of cryptosystem efficiency assessment by a
computer security specialist;
select appropriate economic indicators as a
basis to build an economic rationale for
investments to cryptographic systems and to
provide sound arguments for implementing
an information security strategy


Cryptosystem security assessment process

Make conclusions regarding conformity of
the system to the organization needs
Step 5
Evaluate the cryptosystem’s
resistance to the attacks
Step 4
Determine the attacks
that the cryptosystem is
exposed to Step 3
Define the
potential attackers
Step 2

Define the
cryptosystem
Step 1


ABC-Model of Security Threats

Code-Breaker

uses

“A” for Attack
Attack “B” for code-Breaker
to break “C” for Cryptosystem

Cryptosystem



Step 5
Step 4
exposed to Step 3
Define the
potential attackers
Step 2

Define the
cryptosystem
Step 1


Classification of cryptosystems

Ueli Maurer's idea is to distinguish
cryptosystems by the number of
keys used for data processing
unkeyed
single-keyed
double-keyed

Gilles Brassard's scheme [4] has to do
with the secrecy of algorithm
• Restricted-use
• General


Classification of cryptosystems
By secrecy of the algorithm
Restricted ▪ General
By the number of keys
Unkeyed ▪ Single-keyed ▪ Double-keyed ▪ Multiple-keyed
By breakability
Theoretically unbreakable
Provably unbreakable
Supposedly unbreakable
By the type of key storage
Smart-card ▪ e-token ▪ Windows register ▪ File system
By the means of implementation
Software ▪ Hardware ▪ Software and hardware
By certification
Certified ▪ Uncertified


Classification of codebreakers
Bruce Schneier suggests using motivation as a
key parameter to identifying an adversary; this
results in the following classification scheme:
opportunists:
emotional attackers
friends and relatives
industrial competitors
the press
lawful governments
the police
national intelligence organizations


Classification of codebreakers
By equipment
PC
Network
Supercomputer
By expertise
PC user
Mathematician
Software developer
Physicist/electrical engineer
Psychologist aware of social engineering techniques
By initial knowledge on the cryptosystem
User of the cryptosystem
Designer of the cryptosystem
By final objective
Discovering a vulnerability
Total break
By access
Insider
Outsider
By manpower
Individual
Team

Classification of Attacks
The fundamental classification of attacks by access to
plaintext and ciphertext introduced by Kerckhoffs is no
longer complete since it does not include a new powerful
cryptanalysis technique called Side-Channel attacks

Are not suitable for cryptoattacks identification!
Modern schemes for computer system attack
classification
Landwehr C.E., Bull A.R. A taxonomy of computer program
security flaws, with examples // ACM Computing Surveys,
26(3): p. 211–254, September 1994.
Lindqvist U., Jonsson E. How to systematically classify
computer security intrusions. // IEEE Symposium on Security
and Privacy, p. 154–163, Los Alamitos, CA, 1997.
Paulauskas N., Garsva E. Computer System Attack
Classification // Electronics and Electrical Engineering 2006.
nr. 2(66)
Weber D. J. A taxonomy of computer intrusions. Master’s
thesis, Department of Electrical Engineering and Computer
Science, Massachusetts Institute of Technology, June 1998.


Classification of Attacks (1/2)
By access to plaintext and ciphertext
Ciphertext-only
Known-plaintext
Chosen-plaintext
Adaptive-chosen-plaintext
Side-channel
By control over the enciphering/deciphering process
Passive
Active
By the outcome
Total break
Global deduction
Instance (local) deduction
Information deduction
Distinguishing algorithm
By the level of automation
Manual
Semi-automatic
Automatic


Classification of Attacks(2/2)
By critical amount of resources
Memory
Time
Data
By applicability to various ciphers
Multi-purpose
For a certain type of ciphers
For a certain cipher
By tools and techniques
Mathematics
Special-purpose devices taking physical measurements during
computations
Evolution programming techniques
Quantum computers
By consequences
Breach in confidentiality
Breach in integrity
Breach in accessibility
By parallelizing feasibility
Distributed
Non-distributed


Classification Schemes
Classification of Сryptosystems
By secrecy of the algorithm
By the number of keys
By breakability Classification of Attacks
By the type of key storage By critical amount of resources
By the means of implementation By applicability to various ciphers
By certification By tools and techniques
By consequences
By parallelizing feasibility
By access to plaintext and
Classification of Codebreakers
ciphertext
By equipment
By control over the
By expertise
enciphering/deciphering process
By initial knowledge on the
By the outcome
cryptosystem
By the level of automation
By final objective
By access
By manpower


Parametric models of Attacks, Code-Breakers
and Cryptosystems
• Let Α ⊆ A1 × A2 × ... × A9 be a set of parametric
models of attacks, where Aj ( j = 1, 9) represents
a domain for the i - th parameter as per our taxonomy; a ∈ Α
• Let Β ⊆ B1 × B2 × ... × B6 be a set of parametric
models of codebreakers, where B j ( j = 1, 6) represents
a domain for the j - th parameter as per our taxonomy; b ∈ Β

• Let ⊆ C 1 × C 2 × ... × C 6 be a set of parametric
models of cryptosystems, where C j ( j = 1, 6) represents
a domain for the j - th parameter as per our taxonomy; c ∈


Mathematical Model for Cryptosystem Efficiency
Assessment

Risk ℜ(a, b, c) = Ι(a, c) ⋅ Ρ(a, b)

Impact Probability

Ι : Α× → [0; 1] Ρ : Α × Β → [0; 1]

Ι(a, c) = min ∏ Ιgh (cg , ah )
h =1,8 g =1,5
Ρ(a, b) = min ∏ Ρth (bt , ah )
h =1,8 t =1,6

Ιgh : Cg ×A → [0; 1], g = 1,5, h = 1,8
h Ρth : Bt × Ah → [0; 1], t = 1, 6, h = 1, 8

Ιgh (c, a ) Ρth (b, a )
Ιgh (c, a ) = Ρth (b, a ) =
∑ Ιgh (ξ, a ) ∑ Ρth (β, a )
ξ ∈C g β ∈Bt

Ιgh : C g × Ah → + Ρth : Bt × Ah → +


Efficiency Criterion

Satisfied when a cryptosystem that consists of
subsystems c ∈ ′ ( ′ ⊆ ) being exposed to
codebreakers b ∈ Β′ (Β′ ⊆ Β)
can resist the attacks out of the set:

Λ= ∪ ∪ ′ λ(b, c) ,
b ∈B ′ c ∈C

where λ(b, c) = {a ∈ Α : ℜ(a,b, c) > θ },
θ ∈ [0; 1] - admissible risk level



Step 5
Step 4
exposed to Step 3
Define the
potential attackers
Step 2

Define the
cryptosystem
Step 1


Available tools for cryptanalysis
C/C++ Multiprecision libraries
Mathematical packages Maple and Mathematica



Mathematical packages Maple and
Mathematica
“+”: unlimited precision
“+”: easy-to-program algorithms
“-”: extremely low efficiency of
number-theoretical computations



C and C++ built-in types have limited
precision
long – 32 bits
long long – 64 bits
double: 53 bits – mantissa, 11 bits –
characteristic
long double: 64 bits – mantissa,
15 bits – characteristic

Java has multiprecision capabilities
Highly portable
Not so efficient



Multiprecision mathematical
libraries
«+»: high performance
«+»: wide range of solutions freely
available (LIP, LiDIA, CLN, PARI, GMP,
MpNT)


C/C++ Multiprecision libraries
Mathematical packages Maple and Mathematica


CRYPTO high-level structure


NTL (a Library for doing Number Theory)

Written and maintained mainly by Victor
Shoup
C++ library
High performance
Polynomial arithmetic
•Lattice reduction
Portable
outperforms other libraries in terms of
big integer operations
«-»: lack of algorithms for index-calculus,
sieve, factorization


Implementation



Step 5
Step 4
exposed to Step 3
Define the
potential attackers
Step 2

Define the
cryptosystem
Step 1


ROI, NPV, IRR Metrics Usage*

* Source: CSI Computer Crime & Security
Survey 2008, http://www.gocsi.com/

Key Financial Metrics Overview

Financial Metric Advantages Drawbacks

Lack of trusted methods
Return on Investment for calculation
Popular with economists
(ROI)
«Static» indicator
Allows to evaluate a project
based on costs only Quality factor does not
Total Cost of Ownership The costs are assumed to receive attention
(TCO) be evaluated throughout «Static» indicator
the whole lifecycle of a IT-specific
product
Popular with economists
Time relation is taken into
Discounted Cash Flow account
Complexity
(DCF) Not only costs but all cash
flows related to a project
are considered


Discounted Cash Flow
Net present value (NPV): the sum of the
present values of all cash inflows minus the sum
of the present values of all cash outflows.
The internal rate of return (IRR):
(1) the discount rate that equates the sum of the
present values of all cash inflows to the sum of the
present values of all cash outflows;
(2) the discount rate that sets the net present value
equal to zero.
The internal rate of return measures the
investment yield.
Profitability index (PI)


Cash flow for a cryptographic system


Investment Efficiency Assessment Example
Cost of implementation: 120 000,00 RUR.
Value of information: 205 000,00 RUR/YR.
Risk reduction: 1 YR - 95%, 2 YR – 70%, 3 YR – 35%
Cash flows (annual rate: 20,8%):

■ NPV = 4 574,20 р. ■ IRR = 26,5% ■ PI =1.04 (PI < 1,2%)


Conclusion

«As information security is about
power and money …, the
evaluator should not restrict
herself to technical tools like
cryptanalysis and information
flow, but also apply
economic tools»

Ross Anderson,
Professor in Security
Engineering at the
University of Cambridge
Computer Laboratory


Future work
Development of a built-in expert knowledge base to aid in-
house cryptographic systems expertise:
evaluating the dependency between the parameters of a
cryptosystem model and the applicable attacks
evaluating the dependency between the parameters of an
attacker model and the types of attacks that they are likely to use

Design of new algorithms and improving of present methods
for factorization and computing discrete logarithms using
‘CRYPTO’ software tools

Extending the library to include modern techniques to
analyze the security of
hash-functions
symmetric cryptosystems


Cryptographic Systems
Evaluation Problem
asavelieva@hse.ru savdoshin@hse.ru

CS_GA2009_Paper

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (9)

Similar to CS_GA2009_Paper

Similar to CS_GA2009_Paper (20)

CS_GA2009_Paper