Cryptography, Digital Signatures, and Public Key Certificates

Reference:

• RSA Laboratories, Frequently Asked Questions about Today's Cryptography
• L. Stein, How to Set up and Maintain a Web Server, 2nd. ed., 1997, pp. 228-240.

Example

• Bob has asked Alice out for a date via the Internet.
• Alice wants to accept.
• Meanwhile, Alice's parents are curious what Alice is saying to Bob.
• So Alice wants to send a secret message to Bob, accepting the date, so parents don't know what's up...

         PARENTS
ALICE =============> BOB


• Alice starts with a cleartext or plaintext message: "Yes, I'm free tonight!"
• To assure message secrecy, Alice encrypts cleartext into an encrypted message: "aslu38198314h, b.q,mb4kj4q5"
• Upon receipt, Bob decrypts message to retrieve cleartext.
• Even if the parents hear encrypted message (e.g., by eavesdropping on transmission channel), they cannot learn cleartext.

In addition to confidentiality, cryptography can be used for:

authentication --
Bob gets a message saying "No, I'm not free tonight!"
Did Alice really send it, or did the parents spoof Alice's host?
integrity --
Maybe Alice sent "Yes, I'm free tonight!" but the parents modified the message during transmission to say "No, I'm not free tonight!"
non-repudiation --
Something happens that gets Alice mad at Bob.  So Alice sends a nasty note to Bob.  Bob is incensed!  
Alice later forgives Bob, and claims that she never sent the note.  Alice explains that her parents must have either modified the note or spoofed her host!  How can Bob tell if Alice or her parents sent it?

Encryption Algorithms

• Lets Alice encode the information so that the original message can not be retrieved by the parents.
• Two forms:
• secret-key
• public-key

Key-Exchange Algorithms

• Lets Alice and Bob agree on a secret keys over an insecure channel

One-Way Hashing Algorithms

• Guard against someone changing a message.
• Solves the integrity problem:  If parents try to modify Alice's message, Bob will know
• How it works: Alice create a digest of her message.  If "Yes I'm free" is modified, the digest won't match the modified text.

---

Secret-Key Encryption

Encryption:
characters in message are XORed with the key
Decryption:
characters of the encrypted message are XORed with the same key

• Very easy to break -- there are methods to derive key and cleartext from encrypted text.
• It's the algorithm used in cellular phones (160 bit key).

• Adopted by U.S. government in 1977 as federal standard for encryption of commercial and sensitive-yet-unclassified government computer data.
• DES is a block cipher (encrypts data in blocks of 64 bits) and relies on a key of 56 bits.
• Modified DES is used to authenticate users on standard UNIX machines.
• Some cryptographers consider that key too short; a brute force attack (i.e., attacker tries all possible keys) can break message.
• A more secure variant which applies DES three times with different keys is called Triple DES (TDES).
• U.S. National Security Agency (NSA) has proposed Skipjack to replace DES in the future.
• Not much information about the algorithm
• Will be implemented only in hardware (the Clipper chip).
• Algorithm is considered strong
• Has raised controversy because of Clipper chip. Implementation of Skipjack, contains key-escrow mechanism that allows governmental agencies to decrypt messages.

• Developed at RSA Data Security Inc.
• Algorithms have not been published but are considered strong.
• RSA has made agreement with U.S. Government to have a special export status for RC2 and RC4 when key is 40 bits or less. This algorithm is used in Netscape Navigator and other software products for the U.S. and abroad.

• Block cipher algorithm with blocks of 64 bits and key of 128 bits.
• Used in Pretty Good Privacy (PGP) program.

• Successor to DES
• Objective:  protect government information
• Goal:  mandatory use by U.S. government, voluntary use by private sector
• 128-bit key to be "secure" for next 30 years, given pace of Moore's law
• National Institute of Standards and Technology (NIST) is evaluating submitted proposals for what AES should be
• Requirements:
• "unclassified,
• publicly disclosed encryption algorithm(s),
• available royalty-free, worldwide
• must
• implement symmetric key cryptography as a block cipher
• support (at a minimum) block sizes of 128-bits and key sizes of 128-, 192-, and 256-bits"
• NIST selected 15 candidate algorithms in August 1998; narrowed to five in Aril 1999, selected winner in Fall 2000
• Winner:
• Rihndael (pronounced "Rhine-doll")
• By Joan Daemen of Proton World International & Vincent Rijmen of Catholic Univ. in Leuven, Belgium
• Had best comination of security, performance, efficiency, ease of implementation, flexibility
• Expected to become a standard in Feb. 2001
• Likely that U.S. financial institutions will adopt

---

Key-Exchange Protocols

• Suppose they choose the key "1997".
• If Bob sends Alice "1997", and the parents eavesdrop, the parents could decode any subsequent encrypted messages!

Alice and Bob agree on a large prime number nand another number g; these numbers are not necessarily secret.
e.g., n=31 and g=2
Alice generates a random number xand sends to Bob the value: X = g^x mod n.
x=1 and X=2¹ mod 31=2
Bob generates a random number yand sends to Alice the value: Y = g^y mod n.
y=3 and Y=2³ mod 31=8
Alice receives the value of Y and computes: K_x= Y^xmod n.
K_x = 8¹ mod 31 = 8
Bob receives the value of X and computes K_y= X^ymod n.
K_y = 2³ mod 31 = 8

A third party (Eve) cannot determine value of secret key by eavesdropping. The reason is that it is difficult to determine K_x (= K_y) given the values X and Y.

Public-Key Encryption Algorithms

Yes!  Use public keys!

It uses two different keys, one for encryption and one for decryption.

Bob has two keys:

• one private known only to Bob
• one public known by any other party (e.g., Alice) that wants to communicate with Bob

Even the parents can know the public key!  But Alice never needs to know the secret key!
 
 

• Alice encrypts message with Bob's public key and sends message to Bob.
• Bob decrypts message with his private key.

(But how does Alice know the public key came from Bob, and not from the parents?  Alice could wind up encrypting messages that only the parents can decrypt!  More on this problem later...)

2) Alice must wait longer to get her messages encrypted with a public key algorithm compared to a secret key algorithm.

3) Alice could get the best of both worlds by using a hybrid protocol:

Alice and Bob use public-key protocol to exchange a secret key.
Then they use the secret key to send encrypted messages!

Algorithm has two phases.

• In first, Bob generates keys and makes public the public-key.
• Choose "two large primes, p and q.
• Compute n = pq

(n is called the modulus).
• Choose a number, e, less than n and relatively prime to (p-1)(q-1).

Thus e and (p-1)(q-1) have no common factors except 1.
• Find another number d such that (ed - 1) is divisible by (p-1)(q-1).
• The values e and d are called the public and private exponents, respectively.
• The public key is the pair (n,e); the private key is (n,d)." [From RSA FAQ.]
• Bob sends the public key to Alice.
• In second, Alice encrypts message and Bob decrypts it:
• Alice encrypts the message m with Bob's private key: c = m^emod n and sends the message to Bob.
• Bob decrypts the message with the private key: m = c^dmod n.

• RSA gets its security from the difficulty of factoring large numbers:

"If one could factor n into p and q, however, then one could obtain the private key d. Thus the security of RSA is related to the assumption that factoring is difficult." [From RSA FAQ.]

Patent until 20 Sept. 2000 held by RSA Data Security, Inc. (but most non-US countries don't recognize patent, and use public key encryption anyway)

Licensed to many companies

---

One-Way Hash Functions

But that won't stop someone from corrupting or otherwise changing a message.

So how can we guard against someone changing a message? Use a One-Way Hash Function!

The purpose is to generate a digest of a message that has the following properties:

• It's relatively short (between 128 and 256 bits).
• Given a message it is easy to generate the digest.
• Given the message digest it is difficult to reconstruct the message.
• Given a hash value it is difficult to find a message which has the same hash value.

"The algorithm takes a message of less than 2⁶⁴ bits in length and produces a 160-bit message digest. [From RSA FAQ]"

1. Alice computes digest of the message and encrypts digest with her private key. Encrypted digest is called digital signature of message.
2. Alice sends message and digital signature to Bob.
3. Bob receives message and digital signature. He decrypts digital signature using Alice's public key. After that, he computes digest and compares it with value decrypted. If the two digests are the same, Bob is sure that message was not altered during transmission.

• MD5 (Message Digest 5, developed by RSA)
• Use both SHA and MD5 (used in Netscape's Secure Sockets Layer)

How Can Bob Be Sure Who Sent a Message and When it Was Sent?

• Alice adds to the end of her message identity text such as "Love, Alice (2/21/2000)" encrypted with her private key.
• Alice encrypts whole thing (message + encrypted identity text) with Bob's public key.
• Alice sends whole thing to Bob.
• Bob decrypts whole thing with his private key, and decrypts encrypted identity text with Alice's public key to retrieve "Love, Alice (2/21/2000)".

Public Key Certificates

• Alice and Bob use a secure channel to get the public key.
• Bob sends to Alice his Public-Key Certificate. Other names for certificates are: digital IDs, digital passports, digital certificates.

[Certificates] allow verification of the claim that a specific public key does in fact belong to a specific individual.

Certificates help prevent someone from using a phony key to impersonate someone else. [from RSA FAQ]

Bob's X.509 certificate consists of the following fields:
 

•                subject (Bob's) name
•                     subject (Bob's) public-key information
•                     version
•                     serial number
•                     signature algorithm ID
•                     issuer name (whomever gave Alice the certificate)
•                     validity period
•                     issuer unique identifier (version 2 and 3 only)
•                     subject unique identifier (version 2 and 3 only)
•                     extensions (version 3 only)
•                digital signature on the above fields

• She computes hash function of the certificate (less the signature)
• She decrypts digital signature using the public key of the issuer
• She compares the computed hash value with the decrypted value; they must be the same, or else the certificate is invalid.

• Issuer (e.g., Bob) uses a well-publicized public key (e.g., published in a newspaper ad), or
• Alice uses another Certificates Authority that can certify the public key of the issuer (e.g., Bob) with a public key certificate.
This can go on until Alice knows, and trusts, public key of an authority. This process of certification is called a certificate chain and entire system that supports the process of certification and verification is called public key infrastructure.

Examples of Security Settings in Web Browsers

Conclusions

• Theoretically, it is not possible to prove correctness, and thus there is suspicion surrounding cryptographic algorithms.
• Patents and licensing procedures slow the spread of commercial applications.
• There are still some export regulations on encryption (e.g., FBI looks at them as munitions), but foreign programmers can easily add them because many algorithms are published (e.g., Ecryption was added back to Netscape's browser within 24 hours of the source being published on the Internet).

Due to international terrorism, U.S. government in the past forbid export of strong crypographic algorithms (classified as a type of munitions), even though similar software is available abroad.

Cryptograpic-enabled Web software is available free on non-U.S. servers, but U.S. citizens cannot download it without violating patent law!

However, export regulations are changing.  As of November 1999 the Clinton administration issued this draft rule:

"You may export and re-export to any end-user retail encryption commodities, software and components... Encryption products exported under this paragraph can be used to provide products and services to any end-user."

However, the meaning of "retail" is ambiguous.

Things are improving: In spring '96 National Science Foundation recommended loosening U.S. export regulations, and RSA has begun licensing for free to noncommercial organizations.