Outline

• Uses for Public Key Crypto
• Hash Hunctions
• Birthday Attack

Sign and Encrypt
versus
Encrypt and Sign

Confidentiality and Non-repudiation?

• Suppose that we want confidentiality and integrity/non-repudiation
• Can public key crypto achieve both?
• Alice sends messages to Bob
  • Sign and encrypt `{[M]_(Alice)}_(Bob)`
  • Encrypt and sign `[{M}_(Bob)]_(Alice)`
• Can the order possibly matter?

Sign and Encrypt

• M = "I love you" sent from Alice to Bob confidentially.
• Bob later has a fight with Alice and wants to fake a message to Charlie saying Alice loves Charlie.
• Uses his private key and Charlie's public one to do this
• However, Charlie knows that his public key is public, so knows Alice wrote I love you, but he can't be sure that it was really Alice that applied Charlie's public key.

Encrypt and Sign

• M = "My theory, which is mine..." sent by Alice intended for Bob. Alice encrypts with Bob's public key and signs it with her private key, so Bob knows it's hers.
• Charlie, the man-in-the-middle, intercepts the message, decrypts it with Alice's public key to get `{M}_(Bob)` (can't decrypt this).
• Then signs `[{M}_(Bob)]_{Charlie}` to claim credit.
• However, Bob knows that anyone can apply their private key to `{M}_(Bob)`. So he knows the new theory, but can't be sure who sent it.

Public Key Infrastructure

Public Key Certificate

• Certificate contains a name of a user and a user's public key (and possibly other info)
• It is signed by the issuer, a Certificate Authority (CA), such as VeriSign
  `M = ("Alice", mbox(Alice's public key))`, `S = [M]_(CA)`
• Signature on certificate is verified using CA's public key:
  Verify that `M = {S}_(CA)`

Certificate Authority

• Certificate authority (CA) is a trusted 3rd party (TTP) -- creates and signs certificates
• Verify signature to verify integrity & identity of owner of corresponding private key
• Does not verify the identity of the sender of certificate & certificates are public keys!
• Big problem if CA makes a mistake (a CA once issued Microsoft certificate to someone else) A common format for certificates is X.509

PKI

• Public Key Infrastructure (PKI): the stuff needed to securely use public key crypto
  • Key generation and management
  • Certificate authority (CA) or authorities
  • Certificate revocation lists (CRLs), etc.
• No general standard for PKI
• We mention three generic "trust models"

PKI Trust Models -- Monopoly model

• One universally trusted organization is the CA for the known universe
• Big problems if CA is ever compromised
• Who will act as CA???
  • System is useless if you don't trust the CA!

PKI Trust Models -- Oligarchy Model

• Oligarchy
  • Multiple trusted CAs
  • This is approach used in browsers today
  • Browser may have 80 or more certificates, just to verify certificates!
  • User can decide which CAs to trust

PKI Trust Models -- Anarchy Model

• Anarchy Model
  • Everyone is a CA...
  • Users must decide who to trust
  • This approach used in PGP: "Web of trust"
• Why is it anarchy?
  • Suppose a certificate is signed by Frank and you don't know Frank, but you do trust Bob and Bob says Alice is trustworthy and Alice vouches for Frank. Should you accept the certificate?
• Many other trust models and PKI issues

Symmetric Key vs Public Key

• Symmetric key Plus's
  • Speed
  • No public key infrastructure (PKI) needed
• Public Key Pluss
  • Signatures (non-repudiation)
  • No shared secret (but, private keys..)

Notation Reminder

• Public key notation
  • Sign `M` with Alice's private key: `[M]_(Alice)`
  • Encrypt `M` with Alice's public key: `{M}_(Alice)`
• Symmetric key notation
  • Encrypt `P` with symmetric key `K`: `C = E(P,K)`
  • Decrypt `C` with symmetric key `K`: `P = D(C,K)`

Real World Confidentiality

• Hybrid cryptosystem
• Public key crypto to establish a key
• Symmetric key crypto to encrypt data...

Quiz

Which of the following is true?

1. (2, 3, 9, 15, 30, 57, 120, 251) might be a set of weights for a superincreasing knapsack problem.
2. Too small messages compared to the modulus might make one vulnerable to a cube root attack in RSA.
3. Exponentiation on elliptic curves is used in most EC cryptosystems.

Hash Function Motivation (1)

• Suppose Alice signs `M`
  • Alice sends `M` and `S = [M]_(Alice)` to Bob
  • Bob verifies that `M = {S}_(Alice)`
  • Can Alice just send `S`?
• If `M` is big, `[M]_(Alice)` costly to compute & send
• Suppose instead, Alice signs `h(M)`, where `h(M)` is much smaller than `M`
  • Alice sends `M` and `S = [h(M)]_(Alice)` to Bob
  • Bob verifies that `h(M) = {S}_(Alice)`

Hash Function Motivation (2)

• So, Alice signs h(M)
  • That is, Alice computes `S = [h(M)]_(Alice)`
  • Alice then sends `(M, S)` to Bob
  • Bob verifies that `h(M) = {S}_(Alice)`
• What properties must `h(M)` satisfy?
  • Suppose Trudy finds `M'` so that `h(M') = h(M)`
  • Then Trudy can replace `(M, S)` with `(M', S)`.
• Does Bob detect this tampering?
  • No, since `h(M') = h(M) = {S}_(Alice)`

Crypto Hash Function

• Crypto hash function h(x) must provide
  • Compression -- output length is small
  • Efficiency -- `h(x)` easy to compute for any `x`
  • One-way -- given a value `y` it is infeasible to find an `x` such that `h(x) = y`.
  • Weak collision resistance -- given `x` and `h(x)`, infeasible to find `y ne x` such that `h(y) = h(x)`
  • Strong collision resistance -- infeasible to find any `x` and `y`, with `x ne y` such that `h(x) = h(y)`
• Lots of collisions exist, but hard to find any

Pre-Birthday Problem

• Suppose `N` people in a room
• How large must `N` be before the probability someone has same birthday as me is `ge 1/2` ?
  • Solve: `1/2 = 1 - (364/365)^N` for `N`
  • We find `N = 253`

Birthday Problem

• How many people must be in a room before probability is `ge 1/2` that any two (or more) have same birthday?
  • `1 - 365/365 cdot 364/365 cdot cdot cdot (365-N+1)/365` (one minus odds no one shares a birthday)
  Set equal to `1/2` and solve: `N = 23`
• Surprising? A paradox?
• Maybe not: Should be about `sqrt(365)` since we compare all pairs `x` and `y`
  • And there are `365` possible birthdays

Of Hashes and Birthdays

• If `h(x)` is `N` bits, `2^N` different hash values are possible
• So, if you hash about `2^(N/2)` random values then you expect to find a collision with probability `1/2`
• The implication is a secure `N` bit symmetric key requires `2^(N-1)` work to break while secure `N` bit hash requires `2^(N/2)` work. i.e., as secure implies only exhaustive search attacks are possible.