4.3 KiB
Lecture Topic:
Symmetric Block Encryption Algorithms: A block cipher processes the plaintext into in fixed sized blocks and produces a ciphertext of equal size for each plaintext block, the algorithm process longer plaintexts amounts as a series of fixed sized blocks
- DES
- AES
- Triple DES
Comparison of three popular symmetric encryption algorithms
| Size in Bits | DES | Triple DES | AES |
|---|---|---|---|
| Plaintext Block Size | 64 | 64 | 128 |
| Ciphertext Block Size | 64 | 54 | 128 |
| Key size | 56 | 112 or 168 | 128, 192, 256 |
Average Time for Exhaustive Key Search
| Key Size (bits) | Cipher | Number of Alternative Keys | Time Required at 10^9 decryptions/us | Time Required at 10^13 decyption/us |
|---|---|---|---|---|
| 56 | DES | 2^56 | 2^55us = 1.125 years | 1 hour |
| 128 | AES | 2^128 | 2^127us = 5.3x10^21 years | 5.3^10^17 years |
| 168 | Triple DES | 2^168 | 2^127us | 5.3x10^17 years |
| 192 | AES | |||
| 256 | AES |
Practical Security issues How do you encrypt a unit of data larger than a single 64 bit or 128 bit block? Larger data must be broken down into a series of fixed length blocks
Problem: You use the same key for every single block
Stream Cipher: A stream cipher processes the input elements continuously, producing output one element at a time, as it goes along. It goes by bit, or by byte, not by block
A pseudorandom stream is one that is unpredictable without knowledge of the input key. The output of the generator called a keystream, is combined one byte at a time with the plaintext stream using the bitwise exclusive or operator (XOR)
What is Message (Data) Authentication? Encryption protects against passive attacks (eavesdropping) A different requirement is to protect against active attack (falsification of data or transactions). Protection against this is Message or Data Authentication
A message, file, document or other data is said to be authentic, when it is genuine and came from its alleged source. We may also with to verify a message's timeliness (if it has not been delayed or replayed) and sequence relative to other message flowing between the two parties
Authentication using symmetric encryption? Perform authentication by using symmetric encryption. If we assume only the sender and receiver share a key, then only the genuine sender would be able to encrypt a message successfully or the other participant, provided the receiver can recognize a valid message
If the message includes an error detection code and a sequence number the receiver is assured that no alterations have been made and the sequence is proper. If the message includes a timestamp, the receiver is assured that the message has not been delayed beyond that normally expected for network transit
But note! Symmetric encryption alone cannot guarantee that data is authenticated
Message Authentication without message encryption: An exchange in which one side has a heavy load and can't afford to decrypt all incoming messages, authentication is carried out on a selective basis, with messages being chosen at random for checking.
Message Authentication Code: The use of a secret key to generate a small block of data, known as a message authentication code (MAC) that is appended to the message. This verifies that the message has not been modified if the MAC value can be verified.
The MAC is generated by using a secret key in combination with the rest of the message. This verifies that the message is authentic, even if it is not encrypted, as only the sender and receiver could generate a valid MAC.
The code can also be called a message integrity code instead of a MAC