Technology / Cryptography Case

Cryptography Case

This essay Cryptography Case is available for you on Essays24.com! Search Term Papers, College Essay Examples and Free Essays on Essays24.com - full papers database.

Autor:  lumartich  21 November 2011
Tags:  cryptography
Words: 3523   |   Pages: 15
Views: 104

Streaming cipher

It is a symmetric key cypher where text is encrypted by applying a key and algorithm to each binary digit in a data stream. This type of cipher encrypts data one bit at a time. A sequence of symbols (bits, bytes, or words) is created by a finite state automaton whose initial state is determined by a secret key. The symbols are mixed sequentially with the plaintext to produce the ciphertext. The output of this is called the keystream (McDonald, C., 2010).

HC-256 – Stream Cipher

HC-256 is a symmetric stream cipher invented by Hongjun Wu in 2004. It uses a 256-bit key and a 256-bit initialization vector to generate a keystream up to 2128 bits in length. It is made up of seven different operations, a key, an initialization vector, two tables and six functions.

The 256-bit key of HC-256 is represented by K. the 256-bit initialization vector of HC-256 is represented by IV. The keystream being generated from HC-256 is represented by s. The 32-bit output of the ith step is denoted as si. Then s = s0||s1||s2|| . . .

Symbol Operations related to the Symbol

+ x + y means x + y mod 232, where 0 < x < 232 and 0 < y < 232

x y means x - y mod 1024

bit-wise exclusive OR

|| Concatenation

>> right shift operator. x >> n means x being right shifted n bits.

<< left shift operator. x << n means x being left shifted n bits

>>> right rotation operator. x >>> n means ((x >> n) (x << (32-n))

where 0 < n < 32, 0 < x < 232

Table 1: Retrieved from: (Wu, H., n.d.).

P represents a table with 1024 32-bit elements. Each element is denoted as P[i] with 0 < i < 1023.

Q represents a table with 1024 32-bit elements. Each element is denoted as Q[i] with 0 < i < 1023.

There are six functions being used in HC-256 listed below:

f1(x) = (x >>> 7) (x >>> 18) (x >> 3)

f2(x) = (x >>> 17) (x >>> 19) (x >> 10)

g1(x, y) = ((x >>> 10) (y >>> 23)) + Q[(x y) mod 1024]

g2(x, y) = ((x >>> 10) (y >>> 23)) + P[(x y) mod 1024]

h1(x) = Q[x0] + Q[256 + x1] + Q[512 + x2] + Q[768 + x3]

h2(x) = P[x0] + P[256 + x1] + P[512 + x2] + P[768 + x3] (Wu, H., n.d.).

The initialization process is the first phase of the HC-256 stream cipher. This phase has the key (K) and the initialization vector (IV) expanded into the table P and table Q. During this phase, the cipher runs 4096 steps without generating any output.

As soon as this phase is completed, the cipher will generate a keystream using the &quot;keystream generation algorithm&quot;. For the second phase, there are 1024 steps that involve updating one element of a table generating one 32-bit output for every step. An S-box is used to generate only 1024 outputs, and then it is updated in the next 1024 steps. Finally, the keystream is XORed with the message for encryption and the decryption is to XOR the keystream with the ciphertext (Wu, H., n.d.).

Block cipher

It is a symmetric key cipher which is encrypted by applying a cryptographic key and algorithm to a &quot;block&quot; of data at one time. Block ciphers divide the data into fixed-size pieces called blocks. Each block of data must be the exact same size; therefore, the last block of data may need to have some padding done. The data use in a block cipher is called plaintext. When it is processed, it turns into ciphertext. A block cipher has two corresponding algorithms, one for encryption and another one for decryption. The decryption is the inverse of the encryption algorithm; the process used to encrypt the data, is inversed to decrypt the data.

Serpent – Block Cipher

Serpent is a symmetric key block cipher invented by Ross Anderson, Eli Biham and Lars Knudsen in 1998. The Serpent block cipher was a finalist in the Advanced Encryption Standard (AES) competition. The Serpent cipher maintains a block size of 128 bits and it is able to work with various key sizes such as 128, 192 or 256 bits. The cipher consists of three phases: the initial permutation IP phase, which is an early enciphering process, a 32-round substitution-permutation network (SP-network) phase, and a final permutation FP phase.

In first phase, the initial permutation IP is applied to the plaintext. The 128-bit plaintext is put through a process that mixes these bits using a permutation table. This data is then entered into the first round of the second phase.

For the second phase, it uses a process called bitslicing. There are 32 rounds and each of them consists of the following:

• a key mixing operation,

• a pass through 32 identical 4-bit S-boxes in parallel,

• and a linear transformation (this doesn't apply to the last round).

In the last round of this phase, a linear transformation is substituted by an added key mixing operation. The cipher uses a 32-round substitution-permutation network (SP-network) working on a block of four 32-bit words. SP-networks are mathematical operations used to create a block cipher algorithm (Çakiroglu, M., 2010). Each round uses a key mixing operation of a 128-bit subkey which is exclusive or'ed with the current transitional data. The 128-bit data is divided into four 32-bit words. These four words are applied to the S-box, and then implemented as a sequence of logical operations. The outcome of this process is four output words. The S-box will execute the 32 copies of this process at the same time. The 32 bits in each of the words is mixed using a linear transformation before being sent to the final phase. In the final phase, the result of the second phase is permuted by IP-1.

Similarities

The first similarity between the Serpent and HC-256 ciphers is that they are both symmetric key algorithms. Another similarity is that both cipher use S-boxes in their algorithm. One of the interesting facts about these ciphers is the fact that they were both created to participate in the AES contest. Serpent is a symmetric key block cipher which was a finalist in the Advanced Encryption Standard (AES) contest, where it came in second place to Rijndael. A 128-bit variant of the HC-256 was submitted as an eSTREAM cipher candidate and has been selected as one of the four final contestants in the software profile. Another interesting fact about both ciphers is that neither of them has been patented (Wu, H., n.d.).

Both Serpent and HC-256 are considered to be simple and secure. The main reason that Serpent wasn't chosen to be the AES contest winner because of it was slower than Rijndael. The designers of Serpent specifically chose to use twice the number of rounds that would be sufficient enough to block all known attacks at that time. They planned on this particular cipher having a service life of at least a century. When looking at the security of the HC-256 stream cipher it is easy to see why it is considered very secure. The author's believes that retrieving the key of HC-256 is as complicated as any extensive key search. Hongjun Wu wrote &quot;To distinguish the keystream from random, we expect that more than 2128 keystream bits are required (our current analysis shows that about 2256 outputs are needed in the distinguishing attack).&quot; (Wu, H., n.d.).

Differences

The HC-256 and the Serpents ciphers are different specific type of ciphers. The HC-256 cipher is a stream cipher while the Serpent cipher is a block cipher. The structure of both ciphers is different as well. The HC-256 comprises of two secret tables; each table contains 1024 32-bit elements. However, the Serpent cipher has a block size of 128 bits because it runs 32-rounds SP-network operating on four 32-bit words. One more difference the two ciphers have is Serpent uses 32 rounds under the control of 33 128-bit subkeys in order to encrypt a 128-bit plaintext P to a 128-bit ciphertext; whereas, the HC-256 includes 2048 rounds to update all the elements of the two tables. In each round, HC-256 generates one 32-bit output using the 32-bit-to-32-bit mapping and a linear masking is applied before the final output is generated.

It is difficult to compare the performance of the HC-256 and Serpent ciphers because of the computer speed, operating systems, compilers used to output the specific cipher. The closest comparison found was that the HC-256 reaches 1.93 bit/cycle on a Pentium 4 processor using C and the Serpent was tested at 388 kbit/s operating a 133 MHz Pentium MMX machine using Java.

Public Key Infrastructure

A PKI (public key infrastructure) enables users of a basically unsecure public network such as the Internet to securely and privately exchange data and money through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority.

The components in a public key infrastructure include:

• Certificate authority

• A registration authority

• One or more directories

• A Certificate management system

The first component, the certificate authority (CA), is the organization responsible for distributing and verifying digital certificates. The second component, the registration authority (RA), verifies an individual or organization prior to the CA issuing a digital certificate. The third component is used to store the certificates and public keys. Finally, the fourth component is a system to manage the certificates (Demand Media, Inc., 2010).

Our organization does not have a formal PKI implemented in our network; however, we do have several certificates installed to protect business transactions and comply with FERPA regulations by protecting student's information. There are many reasons academia is beginning to implement the use of PKI. Some of the reasons include: student portals, downloading grades, diplomas, certificates, transcripts, schedules, email, electronic signing of documents, wireless connections, instant messages, and much more. In our organization, Faculty and students have a facility of using a web based portal. Students are able to we have implemented the use of Smart Forms. This is where the students have to complete their financial aid and submit all of their documents online. They also have access to a student portal where they can see their class schedule, download their grades, access the virtual library, email their instructors and other students, and download software.

A PKI is generally considered to be associated with three primary services: Confidentiality, Integrity and Authentication. When looking at the three primary services associated with PKI, all of these student activities need to be protected using PKI. Authentication is the declaration that an individual is who they claim to be (Microsoft, 2011). Authentication is imperative when it comes to e-signing forms or completing financial aid. If not, then anyone could do this and the system would be flawed. Data integrity is the assurance of non-alteration: The data has not been unnoticeably changed. This type of assurance is critical in any kind of business or electronic commerce environment (Microsoft, 2011). Integrity is vitally important when it comes to class schedules and grades. If a student's schedule or grades were changed, you would have another breakdown in the system. Educational institutes today face even more security threats such as identity theft and phishing attacks and an increasing number of diploma/Certificate mills that attempt to capitalize on the institution's brand (GlobalSign & GMO Internet, n.d.). Confidentiality is the declaration of data privacy. Another words, no-one may read the data except for the specific entity the data was intended for (Microsoft, 2011).

In order to organized and formalized our PKI we are currently reviewing GlobalSign®. Some of the tools that accompany GlobalSign® for Educational Institutions include: SSL Managed Service, Adobe Certified Document Services, Enterprise PKI, and Trusted Root Certificate Authority.

Using SSL Managed Service will help our organizaiton to manage the complete lifecycle of educational level SSL Certificates including issuing, reissuing, renewing, revoking and billing management for multiple SSL Certificates across numerous departments and institute locations. Creating trusted documents is easy when using Digital IDs for the Adobe PDF Platform, Certified Document Services (CDS). CDS allows the creator of the document to add authenticating and approval signatures, making it possible for vital documents to maintain their integrity while allowing recipients to ascertain the document's legitimacy and authorship. Utilizing Enterprise PKI (ePKI) will provide administrators of our institution the essential tools for full control of how Digital IDs (also known as Digital Certificates) are distributed and managed in the company‘s legal name. Trusted Root permits Certification Authorities (CA) operated by companies to be recognized by all browser and mail client software (GlobalSign & GMO Internet, n.d.).

Similarities

Some of the easiest comparisons between the Public-Key Infrastructure using X.509 (PKIX) and GlobalSign® include: the use of Digital Certificates, Certificate Authorities (CAs), Registration Authorities (RAs), and Certificate Revocation List.

Public-Key Infrastructure using X.509 (PKIX)

X.509 (PKIX) uses a digital certificate, which is an electronic document that uses a digital signature to attach a public key with an identity. The digital certificate can be used to verify that a public key belongs to an individual. These digital certificates have a specific amount of time they are valid. An issuing certification authority (issuing CA) is the CA that issued the certificate. According to Request for Comments: 2527 &quot;A registration authority (RA) is an entity that is responsible for identification and authentication of certificate subjects, but that does not sign or issue certificates (i.e., an RA is delegated certain tasks on behalf of a CA)&quot; (Chokhani, 1999). Occasionally, a key may become lost or stolen. If this is the case, then X.509 deals with these incidents by using one of two possible methods: Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP).

Public Key Infrastructure using GlobalSign®

GlobalSign uses digital signatures to authenticate digital information by using cryptography delivered through a GlobalSign Digital ID. GlobalSign uses a compilation of electronic data consisting of a Public Key, specific data about the owner of the Public Key, and validity information, which has been Digitally Signed. This data is a Digital Certificate. GlobalSign's Digital Certificate services include: PersonalSign Digital Certificates, DocumentSign Digital Certificates, Code Signing Certificates, and Code Signing Certificates. GlobalSign has established a Worldwide Registration Authority Partner network and grants partners the right to issue digital certificates within a geographical region or community based on certain accreditation criteria (GlobalSign & GMO Internet., n.d.). GlobalSign uses an assortment of electronic data that includes information relating to revoked Digital Certificates called Certificate Revocation List (CRL).

Not only do both PKI's offer the above but they also support many of the same protocols. See Table 1 for the list of supporting protocols.

Protocols Supporting X.509 Certificates (TopBits, n.d.) Protocols Supporting GlobalSign®

(GlobalSign & GMO Internet, n.d.)

Transport Layer Security (SSL/TLS)

Yes Yes

HTTPS

Yes Yes

Secure Multipurpose Internet Mail Extensions (S/MIME)

Yes Yes

Smartcard Yes Yes

Table 1: Supporting Protocols

Differences

Some of the easiest comparisons between the Public-Key Infrastructure using X.509 (PKIX) and GlobalSign® include: the use of Digital Certificates, Certificate Authorities (CAs), Registration Authorities (RAs), and Certificate Revocation List.

Public-Key Infrastructure using X.509 (PKIX)

X.509 (PKIX) uses a digital certificate, which is an electronic document that uses a digital signature to attach a public key with an identity. The digital certificate can be used to verify that a public key belongs to an individual. These digital certificates have a specific amount of time they are valid. An issuing certification authority (issuing CA) is the CA that issued the certificate. According to Request for Comments: 2527 &quot;A registration authority (RA) is an entity that is responsible for identification and authentication of certificate subjects, but that does not sign or issue certificates (i.e., an RA is delegated certain tasks on behalf of a CA)&quot; (Chokhani, 1999). Occasionally, a key may become lost or stolen. If this is the case, then X.509 deals with these incidents by using one of two possible methods: Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP).

Public Key Infrastructure using GlobalSign®

GlobalSign uses digital signatures to authenticate digital information by using cryptography delivered through a GlobalSign Digital ID. GlobalSign uses a compilation of electronic data consisting of a Public Key, specific data about the owner of the Public Key, and validity information, which has been Digitally Signed. This data is a Digital Certificate. GlobalSign's Digital Certificate services include: PersonalSign Digital Certificates, DocumentSign Digital Certificates, Code Signing Certificates, and Code Signing Certificates. GlobalSign has established a Worldwide Registration Authority Partner network and grants partners the right to issue digital certificates within a geographical region or community based on certain accreditation criteria (GlobalSign & GMO Internet., n.d.). GlobalSign uses an assortment of electronic data that includes information relating to revoked Digital Certificates called Certificate Revocation List (CRL).

Not only do both PKI's offer the above but they also support many of the same protocols. See Table 1 for the list of supporting protocols.

Protocols Supporting X.509 Certificates (TopBits, n.d.) Protocols Supporting GlobalSign®

(GlobalSign & GMO Internet, n.d.)

Transport Layer Security (SSL/TLS)

Yes Yes

HTTPS

Yes Yes

Secure Multipurpose Internet Mail Extensions (S/MIME)

Yes Yes

Smartcard Yes Yes

Table 1: Supporting Protocols

Authentication Protocol - Kerberos

It is a network authentication protocol designed to provide strong authentication for client/server applications. It uses a private key cryptography. Protocols in the internet do not provide security. Many tools to sniff passwords are used to steal user's credentials. The encryption used in this protocol allows a client to authenticate to a server over a network. &quot;After a client and server have used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business.&quot; (MIT, 2011).

A key feature of Kerberos is that it allows for a single sign-on environment where a user only needs to verify his identity to the resources within the Kerberos network once. Another advantage is that the user ID administration is simplified because a central repository for principals is used. Kerberos provides a mechanism that allows both users and machines to identify themselves to network and receive defined, limited access to the areas and services that the administrator configured. It authenticates nodes by verifying their identity, and Kerberos also secures this authenticating data so that it cannot be accessed and used or tampered with by an outsider. (RedHat, n. d.).

Revoking a Public Key Certificate

Many organizations with an established public key infrastructure provide mechanisms for individuals to obtain such key when needed and in some occasions revoke this key when needed as well. Organizations should provide a way to verity the authenticity of a public key certificate.

To revoke a key means to remove a digital certificate authentication prior to its expiration date. It lets the user know that a certificate is no longer valid and should not be trusted. &quot;The meaning of &quot;certificate revocation&quot; in a literal sense can be defined as removing a certificate's validity prematurely.&quot; (Fairbrother, S. 2003).

Revoking a key can be prompted by:

•Change of relationship between a subject and an organization

•Severing or suspension of the relationship between an issuing party and an organization

•An issuing authority ceases to operate

•Suspected private key compromise

•Detected private key compromise

•Media containing a private key is compromised or lost

•There has been improper of faulty issue of the certificate

•Certificate no longer required by the subject. (Fairbrother, S. 2003).

For the certificate to maintain its validation, the user must trust the organization issuing the certificate. To maintain this trust relationship is critical that the revocation process is defined, implemented as transparent as possible. Making clear at all times what is the status of such certificate.

References

Anderson R, Biham E, Knudsen L (1998). Serpent: A Flexible Block Cipher with Maximum Assurance. Retrieved on June 27, 2011 from: http://eref.uqu.edu.sa/files/serpent__a_flexible_block_cipher_with_ma_200580.pdf

Çakiroglu, M. (2010). Software implementation and performance comparison of popular block ciphers on 8-bit low-cost microcontroller. Retrieved on June 27, 2011 from: http://www.academicjournals.org/ijps/PDF/pdf2010/18%20Aug/Cakiroglu.pdf

Chokhani, S. (1999). Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework. Retrieved on June 27, 2011 from: http://www.ietf.org/rfc/rfc2527.txt

Demand Media, Inc. (2010). What is PKI? Retrieved on June 27, 2011 from: http://www.ehow.com/about_6693189_pki_.html

Fairbrother, S. (2003). Certificate Revocation in Public Key Infrastructures. Retrieved on June 28, 2011 from: http://www31.giac.org/paper/gsec/657/certificate-revocation-public-key-infrastructures/101508

GlobalSign & GMO Internet. (n.d.). PKI for Educational Institutions. Retrieved on June 27, 2011 from: http://www.globalsign.com/solutions/industry-solutions/education.html

MacDonald, C. (2010). Analysis of Modern Cryptographic Primitives. Retrieved on June 27, 2011 from: http://web.science.mq.edu.au/groups/acac/researchstudent_completed/Cameron_thesis.pdf

Microsoft. (2011). Core PKI Services: Authentication, Integrity, and Confidentiality. Retrieved on June 27, 2011 from: http://technet.microsoft.com/en-us/library/cc700808.aspx

MIT (2011). Kerberos: The Network Authentication Protocol. Retrieved on June 28, 2011 from: http://web.mit.edu/kerberos/

RedHat (n. d.). Retrieved on June 28, 2011 from: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/Using_Kerberos.html

Schmeh, K. (2003). Cryptography and Public Key Infrastructure on the Internet. West Sussex: England.

TopBits. (n.d.). x.509. Retrieved on June 27, 2011 from: http://www.tech-faq.com/x509.html

Wu, H. (n.d.). Stream Cipher HC-256. Retrieved on June 27, 2011 from:

http://www.ecrypt.eu.org/stream/p3ciphers/hc/hc256_p3.pdf



Get Better Grades Today

Join Essays24.com and get instant access to over 60,000+ Papers and Essays

closeLogin
Please enter your username and password
Username:
Password:
Forgot your password?