Outline

• Crypto Terms
• Kerckhoffs' Principle
• Caesar's Cipher
• Quiz
• Shift-by-n Ciphers and Cryptanalysis
• Simple Substitution Ciphers and Cryptanalysis
• Double Transposition Ciphers

Crypto

• Cryptology -- The art and science of making and breaking "secret codes"
• Cryptography -- making "secret codes"
• Cryptanalysis -- breaking "secret codes"
• Crypto -- all of the above (and more)

Crypto Terms

• The input we want to encrypt is called plaintext.
• A cipher or cryptosystem is the algorithm or hardware used to encrypt the plaintext.
• The result of encryption is ciphertext.
• We decrypt ciphertext to recover plaintext
• A key is used to configure a cryptosystem
• A symmetric key cryptosystem uses the same key to encrypt as to decrypt
• A public key cryptosystem uses a public key to encrypt and a private key to decrypt

Kerckhoffs' Principle

• We will make the following basic assumptions about crypto systems:
  • The system is completely known to the attacker
  • Only the key is secret
• That is, we will assume crypto algorithms are not secret
• This is known as Kerckhoffs' Principle
• Why do we make this assumption?
  • Experience has shown that secret algorithms are weak when exposed
  • Secret algorithms never remain secret
  • Better to find weaknesses before a secret algorithm becomes public.

Crypto as a Black Box

A generic view of symmetric key crypto

Simple Substitution Cipher

We next study cryptography a little by looking at an example of a special case of a substitution cipher...

• Plaintext: fourscoreandsevenyearsago
• Key: The following permutation of the letters of the alphabet:

   Plaintext: abcdefghijklmnopqrstuvwxyz
  Ciphertext: DEFGHIJKLMNOPQRSTUVWXYZABC
  

• Ciphertext: IRXUVFRUHDQGVHYHQBHDUVDJR
• This shift-by-three cipher is known as "Caesar's cipher"

Caesar's Cipher Decryption

• If we know Caesar's cipher is being used then it is a straightforward matter to decrypt the ciphertext.
• Given a ciphertext like: VSRQJHEREVTXDUHSDQWV
• We take the letter in the alphabet which was three before the corresponding letter in the ciphertext (wrapping appropriately).
• For example three letters before V in the alphabet is S. (S T U V)
• Applying this to each letter in turn would allow us to recover the message: spongebobsquarepants

Quiz

Which of the following is true?

1. Authentication involves enforcing access control restrictions.
2. Software bugs do not play a role in information security.
3. Authorization involves enforcing access control restrictions.

Not-so-Simple Substitution

We can generalize Caesar's shift-by-three cipher to a shift-by-n cipher...

• Here `n` would be a number between 0 and 25 and would represent the key.
• For example, the shift-by-7 cipher does the following permutation of the alphabet:

   Plaintext: abcdefghijklmnopqrstuvwxyz
  Ciphertext: HIJKLMNOPQRSTUVWXYZABCDEFG
  

Cryptanalysis of shift-by-n cipher

• Suppose a simple substitution (shift-by-n) cipher is being used, but the key is unknown.
• You are given the ciphertext: CSYEVIXIVQMREXIH
• One way to recover the message is just to try all `n` from `1` to `25` and see if any corresponds to a human language message...
• It is unlikely that that two distinct shift will each correspond to something intelligible.
• This is called exhaustive search.
• In this case, even a human can perform exhaustive search because the key space is small.
• Afterr doing this, one finds the solution: is n=4

Least-Simple Simple Substitution

• Shift-by-n is a special case of the general simple substitution cipher.
• The key of a simple substitution cipher is any permutation of letters
• I.e., Not necessarily a shift of the alphabet
• For example,

   Plaintext: abcdefghijklmnopqrstuvwxyz
  Ciphertext: JICAXSEYVDKMBQTZRHFMPNULGO
  

• Then `26! > 2^88` possible keys!
• If we want to build such a code how do we pick a permutation at random?
• One technique is to loop over `i` from `1` to `26` and for each `i` swap `i` with a number randomly chose between `i` and `26`. (This algorithm might be analyzed in CS155 or CS255).

Cryptanalysis of simple substitution ciphers

• We know that a simple substitution is used
• But not necessarily a shift-by-n substitution.
• Find the key given the ciphertext:

  PBFPVYFBQXZTYFPBFEQJHDXXQVAPTPQJKTOYQWIPBVWLXTOXBTF
  XQWAXBVCXQWAXFQJVWLEQNTOZQGGQLFXQWAKVWLXQWAEBIPBFXF
  QVXGTVJVWLBTPQWAEBFPBFHCVLXBQUFEVWLXGDPEQVPQGVPPBFT
  IXPFHXZHVFAGFOTHFEFBQUFTDHZBQPOTHXTYFTODXQHFTDPTOGH
  FQPBQWAQJJTODXQHFOQPWTBDHHIXQVAPBFZQHCFWPFHPBFIPBQW
  KFABVYYDZBOTHPBQPQJTQOTOGHFQAPBFEQJHDXXQVAVXEBQPEFZ
  BVFOJIWFFACFCCFHQWAUVWFLQHGFXVAFXQHFUFHILTTAVWAFFAW
  TEVOITDHFHFQAITIXPFHXAFQHEFZQWGFLVWPTOFFA
  

More Substitution Cryptanalysis

This kinds of codes were broken before computers, so we know it can be done -- we just have to clever.

• A human could not try all `2^88` simple substitution keys
• So how can we be clever...
• Use letter frequencies! (Known to typesetters for a long time)

Yet More Substitution Cryptanalysis

Looking at the frequency counts for:

PBFPVYFBQXZTYFPBFEQJHDXXQVAPTPQJKTOYQWIPBVWLXTOXBTF
XQWAXBVCXQWAXFQJVWLEQNTOZQGGQLFXQWAKVWLXQWAEBIPBFXF
QVXGTVJVWLBTPQWAEBFPBFHCVLXBQUFEVWLXGDPEQVPQGVPPBFT
IXPFHXZHVFAGFOTHFEFBQUFTDHZBQPOTHXTYFTODXQHFTDPTOGH
FQPBQWAQJJTODXQHFOQPWTBDHHIXQVAPBFZQHCFWPFHPBFIPBQW
KFABVYYDZBOTHPBQPQJTQOTOGHFQAPBFEQJHDXXQVAVXEBQPEFZ
BVFOJIWFFACFCCFHQWAUVWFLQHGFXVAFXQHFUFHILTTAVWAFFAW
TEVOITDHFHFQAITIXPFHXAFQHEFZQWGFLVWPTOFFA

We get:

 A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
21 26  6 10 12 51 10 25 10  9  3 10  0  1 15 28 42  0  0 27  4 24 22 28  6  8

So we might guess F represents the letter e; Q, the letter T; and so on for the most frequent letter. One checks if the decryptions make sense and work back-and-forth to get more of the letters.

Cryptanalysis Terminology

• A cryptosystem is secure if the best known attack is to try all keys. i.e., exhaustive key search.
• A cryptosystem is insecure if any shortcut attack is known
• It is possible that an insecure cipher might be harder to break than a secure cipher!

Double Transposition Cipher

• Plaintext: attackxatxdawn
  
• Ciphertext: xtawxnattxadak
• Key is matrix size and permutations: (3,5,1,4,2) and (1,3,2). (Actually, from latter two can determine matrix size.)