Transcript Document

Conventional Cryptography
Dr. Ron Rymon
Efi Arazi School of Computer Science
IDC, Herzliya. 2010/11
Pre-Requisites: Simple Math Background
Overview
 Symmetric Cryptography
 Cipher Block Modes
 Key Management
 Message Authentication Using
Conventional Cryptography
Symmetric Cryptography
Main sources: Network Security Essentials / Stallings
Applied Cryptography / Schneier
Symmetric Cryptography Protocol
 A typical protocol
1.
2.
3.
4.
5.

Alice and Bob agree on cryptosystem (algorithm)
Alice and Bob agree on a key
Alice encrypts her message with the key
Alice sends the message to Bob
Bob decrypts the messages using same key
A common variation is where a new key is issued for
each “session” (set of messages) and is exchanged
encrypted using the “master” key
Feistel Networks
 Most block encryption algorithms use this general
structure, due to Horst Feistel (1973)
 Inputs: Plaintext (halved) , Key, Round function F
 Uses n rounds, in each
(e.g., n=16)
–
–
–
–
Inputs: Li and Ri ; Ki is derived from K (sub-key)
Li+1=Ri
Ri+1=LiF(Ri,Ki)
F (“round function”) selects certain bits, duplicates
some, and permutes them. Ki is derived from K
 Final ciphertext is combination of Ln and Rn
 At IBM, Feistel built Lucifer, the first such system

Notes on Feistel Cipher Structure
 Decryption: The same process is reversible
– Ri-1=Li
– Li-1=RiF(Ri-1,Ki-1)
– Same algorithm can be used but with keys reversed
 Security Considerations
–
–
–
–
–
Larger block size results in fewer blocks and increased security
Larger key size also increases security (recall Shannon)
More rounds considered to offer better security (?)
Greater complexity of subkey generation may help security
Greater complexity of round function may increase security
Design Goals for Block Ciphers
 Highly secure – more of everything…
 Fast – fewer rounds that use simpler operations
– Low communication overheads
– Low battery consumption in hand-helds
 Easy to implement in hardware
– Simple, ubiquitous operations
 Efficient in memory usage
– Can run on a smart card
 Require less secret material (keys, boxes)
– Sometimes put on expensive tamper-proof memory
Design Principles for Feistel Round
Function
 Feistel is a family of algorithms
– Depends on choice of F, and subkey generation algorithm’
– Can be designed to fit needs
 Non-Linearity. F is as difficult as possible to approximate
with a set of linear equations
 Avalanche
– Strict Avalanche Criterion (SAC) – with the change of any one
input bit, every output bit shall change with probability of exactly
½
– Bit Independence Criterion (BIC) – output bits i,j shall change
independently from each other when an input bit is inverted
– Guaranteed Avalanche – at least n output bits will change
whenever any single input bit is inverted
Data Encryption Standard (DES)
 Without a standard, software and hardware cannot
interoperate, or at least it is very expensive
 In 1973, National Institute for Standards and Technology
(NIST) issued RFP for Data Encryption Algorithm (DEA)
–
–
–
–
–
–
–
–
–
provide high level of security
completely specified and easy to understand
the security must reside in the key
available to all users
adaptable to diverse applications
economically implementable in hardware
efficient to use
validated
exportable
Data Encryption Standard (DES)
 NIST (NBS) issued a Request For Proposal (RFP)
 Only serious proposal came from IBM
– Patented and based on Lucifer (Feistel et al)
 NIST issued a Request For Comments (RFC)
– For first time, a crypto algorithm is reviewed by experts (NSA)
– Quite a few were concerned about NSA backdoor
•
•
•
•
NSA reduced the key size from 112 to 56 bits
Diffie and Helman presented a $20MM 1-day DES cracking machine
NSA had also changed the original “S-boxes” design
There were some claims of linearity in the new design
 DES was adopted in 1977, and renewed in 1983
 In 1987, under NSA pressure, DES almost not re-certified
– Concerned about the details of the algorithm being open and
available to software implementations
– Certified only hardware implementations until 1994
Data Encryption Standard (DES)
 A Feistel block cipher
structure
–
–
–
–
64-bit blocks
56-bit keys
16 rounds
Adds initial and final
permutation of the text
(irrelevant to security)
– Key shifted circularly for
next round, and 48 bits are
selected for Ki
One Round of DES
One Round of DES
 Key Transformation
– Each key-half is shifted 1 or 2 bits in each round (per given table)
– The 56 key bits are permuted and 48 bits are chosen (per table)
 Text transformations
– Expansion of Ri from 32 to 48 bits (size of key)
• Avalanche effect – some bits are duplicated
– 48 bits are XORed with Ki
– Substitution, using 8 S-Boxes with 6-bit input and 4-bit output
• S-boxes are well chosen to introduce non-linearity
– 32 bits are permuted according to specified P-Box
– 32 bits are XORed with Li to create Ri+1
Data Encryption Standard (DES)
 Confusion
– Obtained through permutations, substitutions, and number of rounds
 Diffusion
– Good avalanche effect – 1 bit difference in plaintext quickly results
in a large difference in bits, even after few rounds
 Performance
– Software implementations were slow
• On IBM Mainframe 32,000 blocks / second
– Hardware implementations were very fast
• VLSI Technology 6868 (“Gatekeeper”) DESes in 8 clock cycles
• DEC built GaAs gate array that DESes 16.8 million blocks / second
DES Avalanche Effect
 (a) Difference between
two plaintexts with 1-bit
original difference
 (b) Difference between
two keys with 1-bit
original difference
Data Encryption Standard (DES)
 Weak keys
– Some keys will result in identical subkeys, e.g., if all 0’s, or all 1’s
 Claims that the S-boxes were weakened by the NSA
 Notable DES Attacks
– In 1990, Eli Biham and Adi Shamir presented differential
cryptanalysis
• A chosen-plaintext attack that uses two plaintexts with specific
difference. Then, based on the difference in the ciphertext (and also
internal rounds), one can update the a priori probability of keys
• Similar to the “T-attack” that was originally developed at IBM and was
classified by NSA
– In 1993, Mitsuru Matsui showed linear cryptanalysis attack
• Certain XORs of plaintext and ciphertext bits will result in a certain
XOR of key bits with some probability p1/2
EFF’s DES Cracker
 In 1996, a public debate about security of DES.
– US Agencies (FBI, NSA) claiming that they cannot practically
break DES (takes weeks on many computers)
– Offer companies software export license in return for establishing
a “key recovery” system
 Electronic Frontier Foundation DES Cracker project
–
–
–
–
DES is slow in software but fast in hardware
Used easily available Field Programmable Gate Arrays
Total budget is $200,000
Used hardware to winnow false positives (plaintext recognizer)
then software to test the remaining
 A 1996 paper by top cryptographers suggests a minimum
key size of 75 bits, and 90 bits needed to hold for 20 years
RC5
 Also a block cipher, invented by Ron Rivest (1994)
– Similar in structure to Feistel
 Operations: XORs, Additions (mod bitsize), and Rotations
– Word-oriented, Low-cycle operations – Fast in software
 Variable length blocks, keys, and number of rounds (r)
–
–
–
–
Each block is made of 2 w-bits blocks (A, B) (w=16,/32/64)
Each key is made of bx8 bits (0<b<255; can be larger than a block)
Round keys (S2i , S2i+1), each with w bits, are derived from the key
Encryption and decryption consist of r rounds
 With 16+ rounds, RC5 resists differential attack
– 12 round RC5 shown susceptible with 244 chosen plaintexts
 Data-dependent shifts is one of the innovations of RC5
RC5 Encryption and Decryption
 S2i ,S2i+1 are round sub-keys
 Start: A=A+S0 ; B=B+S1
 In each encryption round (i=1..r)
– A=((A  B)<<<B) + S2i
– B=((A  B)<<<A) + S2i+1
A
B
A
B
S2i
 In each decryption round (i=r…1)
S2i+1
– B=((B-S2i+1)>>>A)  A
– A=((A-S2i)>>>B)  B
 Finish: A=A-S0 ; B=B-S1
RC5: Subkey Generation
 Sub-keys are a mix of original key with two words
– P=Odd((e-2)2w) – e is the natural log ≈ 2.71
– Q=Odd((Phi-1)2w) – Phi is golden ratio (1+sqrt(5))/2 ≈ 1.61
 Initialize a c-word sub-key array
– S0=P
– For i=1…2r+1
• Si=(Si-1+Q)
 Mix with key bits
– L is a c-word array filled with 0-padded concatenation of key bits
• c rounds the key bytes into words
– i=j=0; A=B=0;
– Do 3n times (n=max{2(r+1),c})
• A= Si=(Si +A+B)<<<3
• B= Lj=(Lj +A+B)<<<(A+B)
• i=(i+1) mod 2(r+1)
• j=(j+1) mod c
Variants in Other Block Ciphers
 Blowfish (Schneier)
– Simple: additions, XORs, and table lookups
– Table lookups may require large memory
– Variable key length
 CAST
– The round function differs from one round to next
 Int’l Data Encryption Alg (IDEA), Lai and Masey
– Plaintext, key, and ciphertext are divided to 4 parts
– Uses XORs, additions, and multiplications in 8 rounds
– 128-bit key, 52 16-bit subkeys (can be independent)
– Resists differential cryptanalysis
– Used in PGP
Triple DES (3DES)
 In 1999, DES becomes too weak
– NIST replaces DES with 3DES
 3DES (EDE) uses three 56-bit keys
– C=Ek3(Dk2(Ek1(P)))
– P=Dk1(Ek2(Dk3(C)))
 Note: if K1=K2 then 3DES=DES
 Double encryption doesn’t work well
– Merkle-Hellman chosen plaintext
man-in-the-middle attack requires
only 2n+1 trials (instead of 22n)
 Quintuple encryption also ok
– C=Ek1(Dk2(Ek3(Dk2(Ek1(P)))
Keystream
Generator
Stream Ciphers
Ki
Pi
Ci
 A pseudorandom keystream generator
– Keystream depends only on generating key
 Keystream bits are XORed with the plaintext to produce
the ciphertext, and vice-versa
– Similar to one-time pads, except that not strictly random
– Keystream period should be as long as possible
 Other options
– Keystream may change according also to previous encryptions,
block index, etc.
– In synchronous stream ciphers, keystream does not depend on text,
otherwise, it is called self-synchronizing
RC4
 Byte-based stream cipher, with variable key size
 Uses an S-box, with all possible 8-bit key-entries
– Initialized so that S[i]=i, i=0…255
– S[i]’s are initially permuted, based on the key
• j=0
• for i=0 to 255
– j=(j+S[i]+K[i]) mod 256; // K[i] is original key
– Swap S[i] and S[j]
 In each iteration
– Indices i,j are updated
• i=i+1 mod 256; j=(j+S[i]) mod 256
– S[i] and S[j] are swapped for current i,j
– K=S[(S[i]+S[j] mod 256]
– The keystream K is then XORed with the plaintext
 RC4 with up to 40-bit keys was approved by NSA, and is used in
Lotus Notes, CDPD, WEP, and original SSL
Summary of Cryptography Algs
 Block by block
 Rounds structure
 Key generation
– Mixing key bits for confusion and diffusion
– Use of state matrix for session key
 Encryption
–
–
–
–
–
Mix round key with plaintext for confusion/diffusion
Bit permutation
Substitution with S-boxes for non-linearity
Data dependent operations (e.g., shifts) to add complexity
Use of processor-friendly operations for software speed
 Key size, block size, many rounds add to security
 Multi-application of encryption with more key bits
 Block ciphers vs. Stream Ciphers
Advanced Encryption Standard
(AES)
 NIST put out the RFP in 1997
– In meantime, 3DES replaces DES in 1999
 Main criteria for evaluation
– Security
– Cost and performance of implementation
– General evaluation of design features
 Five finalists (out of 21):
MARS
General Security
Implementation of Security
Software Performance
Smart Card Performance
Hardware Performance
Design Features
3
1
2
1
1
2
RC6
Rijndael
2
1
2
1
2
1
Serpent
2
3
3
3
3
2
 In October 2000, NIST recommended Rijndael
 Approved 2002
3
3
1
3
3
1
Twofish
3
2
1
2
2
3
Rijndael Block Cipher
 By Belgians Joan Daemen, and Vincent Rijmen
 Variables block size and key size
– Number of rounds determined by block and key size
 Does not use Feistel structure
 Instead, each round uses a state and 4 operations
– Non-linear layer, uses optimized S-boxes, for confusion
• 16x16 S-box with all byte values, and a separate inverse S-box
– Linear mixing layer for diffusion
• Row shifts on the state matrix
• Column mixes on the state matrix
– Key addition layer, using a simple XOR
 AES set to use Rijndael with 128bit blocks, key size of
128-192-256 bits, and 10-12-14 rounds
Rijndael Structure
Rijndael Round
Cipher Block
Modes of Operation
Main sources: Network Security Essential / Stallings
Applied Cryptography / Schneier
Cipher Block Modes of Operation
 FIPS 81 defines four “modes” of operation for block
ciphers:
–
–
–
–
Electronic Codebook (ECB)
Cipher Block Chaining (CBC)
Cipher Feedback (CFB)
Output Feedback (OFB)
 Other modes also developed, e.g., Counter Mode (CTR)
 Can work with any symmetric block cipher as the
underlying encryption algorithm
– Many standard protocols, e.g., IPSec, allow the parties to select
which block cipher to use
Cipher Block Modes Requirements
 Efficiency – not much overhead over the block
encryption
 Robustness to chosen plaintext attacks where
blocks can be set by attacker to reveal the key
 Robustness to ciphertext attacks, to protect against
selective modifications
 Fault Tolerant to potential bit errors, not crashing
or smashing the entire ciphertext/plaintext
Electronic CodeBook (ECB) Mode
 Simplest form
– Each block (e.g., 64 bits) encrypted separately
– As if there is a codebook of 264 entries (per key)
 Fast, easy to parallelize
 Relatively fault tolerant
 Easier target to known-
plaintext attack
– cryptanalyst can rebuild the
code book
– Susceptible to stereotypical
parts of messages, statistical
attacks
 Also easier target to modification attack
– E.g., replacing the target-account block in a bank money wiring
communication
Cipher Block Chaining (CBC) Mode
Cipher Block Chaining (CBC) Mode
 Encryption
– Ci=Ek(PiCi-1)
– C0=IV
 Decryption
– Pi=Dk(Ci)Ci-1
 Initialization vector modifies encryption of identical block
sequences
– Can be chosen by source and sent in the clear (e.g. as C0)
– Or, encrypt random data in the first block
 Errors
– A bit of error in the plaintext will not extend the error
– A bit of error in the ciphertext will garble that block, and will alter
same bit in the next block, but then CBC self-recovers completely
 Security
– A man-in-the-middle can easily append blocks in the end
– Can change a bit, knowing which bit will be affected in 2nd block
Cipher Feedback Mode (CFB)
IV
K
E
K
K1
P1
 Errors
E
K2
P2
C1
K
Kn
…
C2
E
Pn
Cn
– A bit of error in the plaintext affects all subsequent blocks but does
not extend the error when decrypted
– A bit of error in the ciphertext affects same bit and next block, after
which CFB self synchronizes
Output Feedback Mode (OFB)
IV
K
E
K
K1
P1
E
K2
P2
C1
K
…
E
Kn
Pn
C2
 Repeatedly encrypt IV
Cn
Counter Mode (CTR)
Counter
K
E
K
K1
P1
E
K
K2
P2
C1
Counter+n-1
Counter+1
Kn
…
C2
E
Pn
Cn
 Advantages:
– Parallelism
– Random access to specific block
– Requires only the encryption algorithm (advantageous when E and
D have different algorithms, e.g. AES)
Summary
 Application of block ciphers to arbitrary-sized
messages
 Encrypt one-block at a time
 Prevent same encryption to same text through
feed-forward mechanisms
– Conceptually similar to avalanche
 Fault tolerance to communication errors (flipped
bits in ciphertext/plaintext)
Key Management
Main sources: Network Security Essential / Stallings
Applied Cryptography / Schneier
Key Generation, Distribution and
Management
 The security of any cryptographic system depends on safe and
effective key distribution and management
– frequent changes
– low computational and communication overhead
 Key Distribution Center (KDC) is a third-party that enables easier and
more secure key management
 KDC is single most critical point of failure
– if KDC fails, many communication threads may fail
 KDC is a good place to attack
– Attacks on key generation algorithm
– Attacks on key distribution through impersonation or communication
hijacking
– Attacks on KDC store or on human managers
 Most common implementation is Kerberos
Key Generation
 Key space should be large enough
 Selection from key space shall be random
– Humans select poor keys - prone to dictionary attack
– Some algorithms have weak keys that should be avoided (DES has
16 such weak keys)
 Example: ANSI X9.17
– Financial Institutions Key Generation Standard
– Pseudo random key Ri generated from previous key, time stamp
– Ri=3DESK(3DESK(Ti)  Ri-1)
• Ti is time stamp bits
– It is recommended that seeds are generated from low-order bits of
time stamps, or from time between keystrokes of administrator, etc.
Key Distribution Alternatives
 Physical Delivery
– Alice can select the key and deliver to Bob
– Charles, a trusted third-party, can select the key and deliver to both
Alice and Bob
 Direct Delivery (encrypted)
– From Alice to Bob, encrypted with a previous key, or using a
master key
 Encrypted communication with trusted third-party
– From Charles to both Alice and Bob, and encrypted with hostKDC keys (master keys) that themselves may have been delivered
physically
Key Distribution (cont.)
 Choice of key distribution
method depends also on
network encryption needs
– Link encryption
– End-to-end encryption
 Link encryption
– Typically can use physical
delivery, at least for master
keys
 End-to-end encryption
–
–
–
–
–
Physical delivery can be hard to implement
Peer-to-peer encryption of keys is dangerous (catch one, catch all)
Can use pre-set key, or a key generated concurrently by a token
Can also use keys delivered by third party (data keys)
Later we’ll see use of public key schemes
Session Key Distribution by KDC
 It is safer if KDC-host connection uses physically delivered key
 KDC-host communication shall also be mutually authenticated
Example: Ansi X9.17
 Financial Institution Key Management Standard
– Defines protocol to be used by banks to transfer encryption keys
 Defines a 3-level hierarchy of keys
– Master key (KKM), distributed manually
– Key-encrypting-keys (KKs), distributed online
– Data Keys (KD), also online, encrypted using KKs
 Encryption uses 3DES with one or two keys
 Each pair of banks must share a master key
– A new protocol, ANSI X9.28, was developed to cluster several banks
around same master key
 Standard has been augmented to use DH key distribution (public key)
Example: Kerberos
 Common client/server access control protocol
– Unix, Windows
 Serves also as Key Distribution Center (KDC)
– Uses “tickets” to allow access to servers
– Ticket provides a “session” key T(c,s)=EKs(authinfo,Kc,s)
Ticket
Granting
Server
Grant
Server
Req
Server
Ticket
Req
Service
Grant
TGS
Client
Server
Req
TGS
Ticket
Kerberos
Authentication
Server (AS)
Review: Key Management Principles
 To reduce the risk of eavesdropping
– use different keys for different purposes
– generate new keys from old ones using hash function
 To reduce the risk of impersonation
– use mutual authentication when exchanging keys
 To reduce the risk of computer/physical break-in
–
–
–
–
store most keys encrypted using master key
save master keys in human memory, smart card, token, etc.
use tamper-proof hardware to store keys
destroy media on which keys were stored, even if were encrypted
 Other principles:
– Replace keys frequently
– Report compromised keys to KDC with timestamp
– Backup keys shall be broken and spread
Message Authentication
Using Conventional
Cryptography
Main sources: Network Security Essential / Stallings
Applied Cryptography / Schneier
Message Authentication
 Goal: offer protection against active attacks
– Impersonation
– Modification of contents
– Timing and/or Sequencing modification
• Replay
• Interruption
– A weak form of non-repudiation vis-à-vis other party
 Technical Requirements
– Verify that the message is authentic
– Verify that source is authentic
• Destination is verified through protocol
Message Authentication Approaches
 Conventional encryption
– Relies on the exclusivity and confidentiality of the key
 Message Authentication Code (MAC)
– A public function of the message and the key
 Hash functions
– A public function that maps the message to an
authentication tag (no key!)
 HMAC
– Combination of hash and MAC
Message Authentication Code
MAC Properties
 Message is authentic
– If the attacker modified the message, the MAC will likely not
match the one calculated by the receiver
 Source is authentic
– No one else has the key to generate same MAC
– Hence, also non-repudiation (other party knows source)
 Message is in sequence
– Should add timestamp or other nonce to the message before
calculating the MAC
 Any encryption algorithm can be used to generate MAC
– NIST recommended last n bits of DES-encryption of the message
 Note that for the purpose of authentication, MAC function
need not be reversible
Message Authentication with
One-Way Hash Functions
 A one-way hash function H, takes an input an arbitrary
length message M, and produces a fixed-length hash value
– H must be hard to “reverse”, i.e. given H(M), its hard to find Ms
– H should be easy to compute (encryption algorithms are not)
 Collision Resistance
– H(M) should be hard to duplicate , i.e., given M it is hard to find
M’ such that H(M)=H(M’)
– Sometimes, we may need strong collision resistance, i.e., hard to
find arbitrary M, M’ such that H(M)=H(M’)
 H(M) is a fingerprint of the message M and is also called
Message Digest (MD)
Message Authentication Protocol
Using a One-Way Hash Function
Using a symmetric secret / key (K)
1.
•
Compute H(M+K) as a MAC
Using symmetric encryption
2.
•
Compute EK(H(M)) as the MAC (note that H(M) is
much shorter than M, hence faster computation)
Simple Hash Functions
 Bitwise-XOR
 Not very secure, e.g., for English text (ASCII<128) the high-order bit
is always zero
 Can be improved by rotating the hash code after each block is XORed
into it
 Beware of a man-in-the-middle attack: if the message itself is not
encrypted, it is easy to modify the message and append one block that
would set the hash code as needed
Cryptographic One-Way Hash
Functions
 Cryptographic hash functions are typically based on
compression functions (f) that work on blocks (Mi)
 This structure (Merkle), resembles a Chained Block Cipher
– Produces a hash value for each fixed-size block based on its
content and based on the hash value for the previous block
M1
IV
f
M2
h1
f
Mn
h2
…
hn-1
f
 Rabin suggests using symmetric encryption
– f=DES; Mi (message blocks) serve as the keys
h
Secure Hash Algorithm (SHA)
 Published by NIST as a standard in 1993; SHA-1 in 1995
– Input: Up to 264 bits, Output: 160 bit digest
 Pad to resist padding attack with “1000…0<message length>”
SHA-1 Basic One-Way Hash Block
 Process 512-bit block (Y)
 Initiates 5 32-bit Message
Digest registers
– Fixed values determined by
algorithm
 Apply compression
functions
– 4 rounds of 20 steps each
– each round uses a different
non-linear compression
function fi
– add output registers from
previous round
SHA-1 Compression Function
 Same structure for each
of 4 20-rounds
– f, K are differently
parameterized
– f is a bit-wise logical
function (different one in
each 20-round phase)
– Sk = k left-circular shifts
– W1…W16 from input (Yq)
– Other Ws are computed
as XORs of earlier W’s,
then circularly shifted
once (SHA-0: no shift)
 In SHA-1 every output
bit is function of every
input bit
Other Famous MD Algorithms
SHA-1
MD5
(MD4+)
RIPEMD-160
Digest length
160 bits
128 bits
160 bits
Basic unit of
processing
512 bits
512 bits
512 bits
Number of steps
80 (4 rounds of
20)
64 (4 rounds 160 (5 paired
of 16)
rounds of 16)
Maximum message 264-1 bits
size
unlimited
unlimited
 Recent attacks on SHA-1 (2005) reduce the effective search space for a
colliding message M’ such that H(M)=H(M’)
 SHA-2, offered as a response, allows 256/512 bit digests
 NIST published a call for a new design (SHA-3) for 2012
Variable Length Hash Codes
 Some hash functions have good cryptographic qualities
(confusion and diffusion), but generate short hash codes
– If the message digest is too short, it may be easier for the receiver
to forge another message with same hash code (collision)
– Similarly, easier to find a (message, hashcode) pair that match
• Use the Birthday Paradox to select a “good” message on which the
sender will sign, and a “fraudulent” message that would replace it
 Can use the following algorithm to enlarge a hash code
–
–
–
–
Start with M0=M, H0=H(M)
Generate M1 by appending H0 to M0, and generate H1=H(M1)
Append H1 to H0
Repeat until generated enough hash codes
Hash Function MAC (HMAC)
 HMAC Idea: Produce a MAC based on a cryptographic
hash function
– Note that hash functions do not use a key, and therefore cannot
serve directly as a MAC
 Motivations for HMAC:
– Cryptographic hash functions execute faster in software than
encryption algorithms such as DES
– No need for the reverseability of encryption
– No US export restrictions
 Status: designated as mandatory for IPSec
– Used in many other protocols, e.g., Transport Layer Security
(TLS/SSL), and SET
HMAC Algorithm
 Compute H1= H(K1+M)
 To prevent an “additional
block” attack, compute again
H2= H(K2+H1)
 K1 and K2 selected to
maximize difference
– K+ =K padded with 0’s
– ipad= 00110110 x b/8
– opad=01011100 x b/8
 Compute time is same as
H(M) plus 3 blocks
Summary
 Goals of message authentication
– Verify source (and sometimes destination)
– Verify message integrity, timing/sequence
 Main methods:
– Symmetric cryptography
– Message Authentication Codes
– HMACs (using one-way crypto hash functions)
Next Class
 Public key Cryptography