Authenticated Encryption (AE): A scheme that simultaneously guarantees confidentiality and integrity ( and authenticity, depending on your threat model ) on a message.
Two ways of achieving: combine schemes that provide confidentiality with schemes that provide integrity use a scheme that is designed to provide confidentiality and integrity
Notation for this course: K, M, C: the key, the message, the ciphertext
Enc(K,M) → C: encrypt message M with key K Dec(K,C) → M: reverses it
(+) XOR: bitwise exclusive-or: 1 xor 1 = 0, 1 xor 0 = 1, note x xor x = 0 || concatenation: glue two strings together M_i, C_i: the ith block of the message / ciphertext H(M): the hash of M MAC(k,M) Mac function. for example, HMAC implemented as two rounds of hashing.
given an encryption scheme, does this provide confidentiality, integrity, both, or neither? Send C = AES-CBC(k,M) Send (M,T) where T=MAC(k,M) Send C = AES-CBC(k1, M1 || MAC(k2,M)) Send(C,H) where C = AES-ECB(k1,M), H=Hash(M) Send(C,T) where C = AES-CTR(k1,M), T = MAC(k2,C)
ECB no confidentiality CBC confidentiality hash no integrity mac integrity
if we switch C to M and do AES-CTR(k1, M), T = MAC(k2,M) provides integrity but no confidentiality mac is not ind-cpa secure.
if we enc(k1,M) || mac(k2,enc(k1,m)) integrity ? yes, attacker cant tamper with mac confidentiality? yes, the mac might leak info about the ciphertext, but that’s ok.
if we ENC(k1, M || MAC(k2, M)) integrity? Yes, attacker can’t tamper with the mac confidentiality? yes mac cant be tampered with
mac then encrypt: first compute mac(k2, m) then encrypt the message and the mac together: Enc(k1, M || mac(k2,M))
encrypt then mac: first compute Enc(k1, M) then mac the ciphertext: MAC(K2, ENC(k1,M))
Which is better? in theory, both are ind-cpa and eu-cpa secure if applied properly
mac then encrypt has a flaw: you don’t know if tampering has occured until after decrypting it attacker can supply arbitrary tampered input, and you always have to decrypt it
always use encrypt then mac becaues it is more robust to mistakes.
if we are maccing M and not C then he is FOOLING you
reuse IV on CBC means no confidentiality but you can still have integrity if mac’d.
PRNGs and diffie helman key exchange prng - psuedorandom number generators
Entropy: a measure of uncertainty it is a measure of how unpredictable the outcomes are high entropy = unpredictable outcomes = desirable uniform distribution has the highest entropy ( every outcome is equally likely, e.g. fair coin toss ) usually measured in bits ( so 3 bits of entropy = uniform, random distribution over 8 values )
randomness sources: lava lamps earthquake strength or interval unpredictable circuit on a cpu human activity measured at a very fine time scale
goal: total number of bits of entropy is the sum of all the input numbers of bits of entropy many poor sources + 1 good source = good entropy
issues with true randomness: expensive and slow to generate
true randomness is expensive and biased prng: algorithm that uses a little bit of true randomness for a lot of random-looking output also called drbg ( deterministic random bit generators )
usage: generate some expensive true randomness ( e.g. noisy circuit on cpu ) ( cpu cycles ) use the true randomness as input to the prng generate random looking numbers quickly and cheaply with the prng prngs are deterministicL output is generated according to a set algorithm however, for an attacker who can’t see the internal state, the output is computationally indistinguishable from true randomness
prng has 3 functions: seed ( randomness ) initializes the internal state using the entropy
reseed ( randomness ) updates the internal state using the existing state and the entropy
generate(n) generates n pseudorandom bits input: a number n
properties: correctness: deterministic efficiency: efficient to generate pseudorandom bits security: indistinguishability from random additional security: rollback resistance
number of bits of entropy should be the sum of number of bits in all sources a prng should be seeded with all available sources of entropy combining many low entropy sources should result in high entropy output if one source has 0 entropy, it should not reduce the entropy of the output
reseeding is used to add even more entropy as it becomes available
if the initial seed is s bits long, there are only 2^s possible output sequences.
rollback resistance: if a atacker learns about the internal prng state, they cannot learn about previous states or outputs