Basic Cryptography

Defining Cryptography

  • Cryptography involves:
    • Understanding what it is.
    • Understanding what it can do.
    • Understanding how it can be used as a security tool to protect data.

What is Cryptography?

  • Cryptography:
    • Scrambling information so it cannot be read.
    • Transforms information into secure form so unauthorized persons cannot access it.
  • Steganography:
    • Hides the existence of data.
    • An image, audio, or video file can contain hidden messages embedded in the file.
    • Achieved by dividing data and hiding it in unused portions of the file.
    • May hide data in the file header fields that describe the file, between sections of the metadata (data used to describe the content or structure of the actual data).
  • Encryption:
    • Changing original text into a secret message using cryptography.
  • Decryption:
    • Changing secret message back to original form.
  • Plaintext:
    • Unencrypted data to be encrypted or is the output of decryption.
  • Ciphertext:
    • The scrambled and unreadable output of encryption.
  • Cleartext data:
    • Data stored or transmitted without encryption.
  • Plaintext data is input into a cryptographic algorithm (also called a cipher).
    • Consists of procedures based on a mathematical formula used to encrypt and decrypt the data.
  • Key:
    • A mathematical value entered into the algorithm to produce ciphertext.
    • The reverse process uses the key to decrypt the message.
  • Substitution cipher:
    • Substitutes one character for another.
    • One type is a ROT13, in which the entire alphabet is rotated 13 steps (A = N).
  • XOR cipher:
    • Based on the binary operation eXclusive OR that compares two bits.
  • Modern cryptographic algorithms rely upon underlying mathematical formulas.
    • depend upon the quality of random numbers (no identifiable pattern or sequence).
    • Software relies upon a pseudorandom number generator (PRNG).
      • An algorithm for creating a sequence of numbers whose properties approximate those of a random number.
    • Two factors that can thwart threat actors from discovering the underlying key to cryptographic algorithms:
      • Diffusion: If a single character of plaintext is changed, then it should result in multiple characters of the ciphertext changing.
      • Confusion: The key does not relate in a simple way to the ciphertext.

Cryptography and Security

  • Cryptography can provide five basic protections:
    • Confidentiality: Ensures only authorized parties can view it.
    • Integrity: Ensures information is correct and unaltered.
    • Authentication: Ensures sender can be verified through cryptography.
    • Non-repudiation: Proves that a user performed an action.
    • Obfuscation: Making something obscure or unclear.
      • Security through obscurity: An approach in security where virtually any system can be made secure as long as outsiders are unaware of it or how it functions.
  • Cryptography can provide protection to data as that data resides in any of three states:
    • Data in-use: Data actions being performed by “endpoint devices”.
    • Data in-transit: Actions that transmit the data across a network.
    • Data at-rest: Data this is stored on electronic media.

Cryptography Constraints

  • The number of small electronic devices (low-power devices) has grown significantly.
    • These devices need to be protected from threat actors.
  • Applications that require extremely fast response times also face cryptography limitations.
  • Resource vs. security constraint:
    • A limitation in providing strong cryptography due to the tug-of-war between available resources (time and energy) and the security provided by cryptography.
  • It is important that there be high resiliency in cryptography.
    • The ability to quickly recover from these resource vs. security constraints.

Cryptographic Algorithms

  • A fundamental difference in cryptographic algorithms is the amount of data processed at a time.
    • Stream cipher: Takes one character and replaces it with another.
    • Block cipher: Manipulates an entire block of plaintext at one time.
    • Sponge function: Takes as input a string of any length and returns a string of any requested variable length.
  • Three categories of cryptographic algorithms:
    • Hash algorithms.
    • Symmetric cryptographic algorithms.
    • Asymmetric cryptographic algorithms.

Hash Algorithms

  • Hash algorithms:
    • Creates a unique “digital fingerprint” of a set of data and is commonly called hashing.
    • This fingerprint, called a digest (sometimes called a message digest or hash), represents the contents.
      • Its contents cannot be used to reveal original data set.
    • Is primarily used for comparison purposes.
    • Hashing is intended to be one way in that its digest cannot be reversed to reveal the original set of data.
  • Secure hashing algorithm characteristics:
    • Fixed size: Short and long data sets have the same size hash.
    • Unique: Two different data sets cannot produce the same hash.
    • Original: Data set cannot be created to have a predefined hash.
    • Secure: Resulting hash cannot be reversed to determine original plaintext.
  • Hashing is often used as a check to verify that the original contents of an item has not been changed.
  • Message Digest 5 (MD5):
    • Most well-known of the MD hash algorithms.
    • Message length padded to 512 bits.
    • Weaknesses in compression function could lead to collisions.
    • Some security experts recommend using a more secure hash algorithm.
  • Secure Hash Algorithm (SHA):
    • More secure than MD.
    • SHA-2 is currently considered to be a secure hash.
    • SHA-3 was announced as a new standard in 2015 and may be suitable for low-power devices.
  • Race Integrity Primitives Evaluation Message Digest (RIPEMD):
    • The primary design feature is two different and independent parallel chains of computation.
    • The results are combined at end of process.
    • Several version of RIPEMD - RIPEMD -128, RIPEMD -256, and RIPEMD -320.
  • Hashed Message Authentication Code (HMAC):
    • A hash variation providing improved security.
    • Uses a “shared secret key” possessed by sender and receiver.
    • Receiver uses a key to decrypt the hash.

Symmetric Cryptographic Algorithms

  • Symmetric cryptographic algorithms use the same single key to encrypt and decrypt a document.
    • Original cryptographic algorithms were symmetric.
    • Also called private key cryptography (the key is kept private between sender and receiver).
    • Common algorithms include:
      • Data Encryption Standard.
      • Triple Data Encryption Standard.
      • Advanced Encryption Standard.
      • Several other algorithms.
  • Data Encryption Standard (DES):
    • Based on product originally designed in early 1970s.
    • Uses a 56-bit key and is a block cipher.
  • Triple Data Encryption standard (3DES):
    • Designed to replace DES.
    • Uses three rounds of encryption.
    • Ciphertext of the first round becomes input for the second iteration.
    • Most secure versions use different keys used for each round.
  • Advanced Encryption Standard (AES):
    • A symmetric cipher approved by the NIST in 2000 as a replacement for DES.
    • Performs three steps on every block (128 bits) of plaintext.
    • Designed to be secure well into the future.
  • Other Algorithms:
    • Rivest Cipher (RC): Family of cipher algorithms designed by Ron Rivest.
    • Blowfish: Block cipher operating on 64-bit blocks with key lengths from 32-448 bits - No significant weaknesses have been identified.
    • International Data Encryption Algorithm (IDEA): Used in European nations - Block cipher processing 64 bits with a 128-bit key with 8 rounds.

Asymmetric Cryptographic Algorithms

  • Weakness of symmetric algorithms:
    • Distributing and maintaining a secure single key among multiple users distributed geographically.
  • Asymmetric cryptographic algorithms:
    • Also known as public key cryptography.
    • Uses two mathematically related keys.
      • Public key available to everyone and freely distributed.
      • Private key known only to individual to whom it belongs.
  • Important principles:
    • Key pairs.
    • Public key.
    • Private key.
    • Both directions - keys can work in both directions.
  • Common asymmetric cryptographic algorithms:
    • RSA.
    • Elliptic Curve Cryptography.
    • Digital Signature Algorithm.
    • Those relating to Key Exchange.
  • RSA:
    • Published in 1977 and patented by MIT in 1983.
    • Most common asymmetric cryptography algorithm.
    • Uses two large prime numbers.
  • Elliptic curve cryptography (ECC):
    • Users share one elliptic curve and one point on the curve.
    • Uses less computing power than prime number-based asymmetric cryptography.
      • Key sizes are smaller.
    • Considered as an alternative for prime-number-based asymmetric cryptography for mobile and wireless devices.
  • Digital Signature Algorithm (DSA):
    • Digital signature - an electronic verification.
      • Verifies the sender.
      • Prevents sender from disowning the message.
      • Proves message integrity.
  • Key Exchange:
    • There are different solutions for a key exchange that occurs within the normal communications channel (in-band) of cryptography:
      • Diffie-Hellman (DH).
      • Diffie-Hellman Ephemeral (DHE).
      • Elliptic Curve Diffie-Hellman (ECDH).
      • Perfect forward secrecy.

Cryptographic Attacks

  • Several of the more common cryptographic attacks include those that:
    • Target algorithm weaknesses.
    • Exploit collisions.

Algorithm Attacks

  • Methods attackers can focus on circumventing strong algorithms:
    • Known ciphertext attacks.
    • Downgrade attacks.
    • Using deprecated algorithms.
    • Taking advantage of improperly implemented algorithms.
  • Known Ciphertext Attack:
    • Statistical tools can be used to attempt to discover a pattern in the ciphertexts, which can then be used to reveal the plaintext or key.
    • Statistic, Example, How Used.
      • Underlying language of plaintext, English, By knowing which language is used for the plaintext message inferences can be made regarding statistical values of that language.
      • Distribution of characters, In English E is most commonly used letter, Q is least commonly used, Patterns can emerge when more common letters are used more frequently.
      • Null ciphertexts, Distinguishing between actual ciphertexts and injected null messages, Attacks may inject a frame that contains null values to compare it with the frames containing ciphertext.
      • Management frames, Analyze content of network management information, Because network management frames typically contain information that remains constant this can help establish patterns.
  • Downgrade Attack:
    • A threat actor forces the system to abandon the current higher security mode of operation and instead “fall back” to implementing an older and less secure mode.
  • Using Deprecated Algorithms:
    • Means to use a cryptographic algorithm that should not be used because of known vulnerabilities.
  • Improper Implementation:
    • Known as misconfiguration implementation.
    • Many cryptographic algorithms have several configuration options.
    • Unless careful consideration is given to these options the cryptography may be improperly implemented.

Collision Attacks

  • When two files have the same hash, this is known as a collision.
  • Collision attack:
    • An attempt to find two input strings of a hash function that produce the same hash result.
  • Birthday attack:
    • Based on the birthday paradox, which says that for there to be a 50 percent chance that someone in a given room shares your birthday, 253 people would need to be in the room.

Using Cryptography

  • Cryptography should be used to secure:
    • Data-in-transit, data-at-rest, and when possible data-in-use.
  • This includes:
    • Individual files.
    • Databases.
    • Removable media.
    • Data on mobile devices.
  • Cryptography can be applied through:
    • Software.
    • Hardware.

Encryption Through Software

  • File and File System Cryptography:
    • Encryption software can be used to encrypt or decrypt files one-by-one.
  • Pretty Good Privacy (PGP):
    • Widely used asymmetric cryptography system.
    • Used for files and e-mails on Windows systems.
  • GNU Privacy Guard (GNuPG): Open-source product that runs on Windows, UNIX, and Linux operating systems.
  • OpenPGP: is another open-source alternative that is based on PGP.
  • Operating System Encryption:
    • Microsoft Windows Encrypting File System (EFS):
      • Cryptography system for Windows.
      • Uses NTFS file system.
      • Tightly integrated with the file system.
      • Encryption and decryption are transparent to the user.
  • Full Disk Encryption (FDE):
    • Protects all data on a hard drive.
    • Example: BitLocker drive encryption software that is included in Microsoft Windows.
    • BitLocker encrypts the entire system volume, including the Windows Registry.
    • Prevents attackers from accessing data by booting from another OS or placing the hard drive in another computer.

Hardware Encryption

  • Software encryption can be subject to attacks to exploit its vulnerabilities.
  • Cryptography can be embedded in hardware.
    • Provides a higher degree of security.
    • Can be applied to USB devices and standard hard drives.
  • Hardware encryption options include:
    • Trusted platform module.
    • Hardware security model.
  • USB device encryption:
    • Encrypted hardware-based flash drives can be used.
      • Will not connect a computer until the correct password has been provided.
      • All data copied to the drive is automatically encrypted.
      • Tamper-resistant external cases.
      • Administrators can remotely control and track activity on the devices.
      • Stolen drives can be remotely disabled.
  • Self-Encrypting Drives (SEDs):
    • Self-encrypting hard disk drives protect all files stored on them.
    • The drive and host device perform authentication process during initial power up.
    • If authentication fails, the drive can be configured to deny access or even delete encryption keys so all data is permanently unreadable.
  • Trusted Platform Module (TPM):
    • A chip on a computer’s motherboard that provides cryptographic services.
    • Includes a true random number generator.
    • Entirely done in hardware so it cannot be subject to software attack.
    • Prevents computer from booting if files or data have been altered.
    • Prompts for password if the hard drive is moved to a new computer.
  • Hardware Security Module (HSM):
    • A secure cryptographic processor.
    • Includes an onboard key generator and key storage facility.
    • Performs accelerated symmetric and asymmetric encryption.
    • Can provide services to multiple devices over a LAN.