Sebery J.Cryptography.An introduction to computer security.1989

alyst who does not know the secret key but can read cryptograms, may try to

{reveal messages from cryptograms or

{recover the secret key.

The attacker is also assumed to know the statistical properties of the message source. Thus they can calculate message and key equivocation to nd out the collection of most probable messages and keys. As the attacker knows n cryptograms, they can compute the message equivocation as follows:

In other words, the unicity distance is the amount of ciphertext needed to uniquely determine the key applied. Intuitively, as the number of observations increases, the key equivocation stays the same or decreases.

The unicity distance can be used to de ne two classes of cryptosystems (ciphers):

{ Unbreakable whose unicity distance is in nite and limn!1 H(K j C(n)) = H(K).

{ Breakable whose unicity distance is nite.

The class of unbreakable cryptosystems is also called ideal ciphers. Ideal ciphers are immune against any attacker who knows the statistical properties of the language (message source) and has access to cryptograms (communication channel) even if the attacker has unlimited computational power! Cryptographic designs that are secure against an enemy with unlimited computational power are called unconditionally secure.

62 2 BACKGROUND THEORY

2.4.5 Equivocation of a Simple Cryptographic System

Consider the cryptographic system (Figure 2.7) that encrypts binary messages using binary keys according to the following formula:

c = m k

where c 2 C, m 2 M, k 2 K are a cryptogram (ciphertext), a message, and a key, respectively (C = M = K = f0; 1g and stands for addition modulo 2). The message source is known to generate elementary messages (bits) with probabilities,

P (M = 0) = v and P(M = 1) = 1 v

while 0 v 1. For each transmission session, a cryptographic key K is selected from equally probable binary elements, namely,

P (K = 0) = P(K = 1) = 12:

Our task is to calculate the cipher equivocation and estimate the unicity distance.

Assume that our cryptosystem has generated n binary cryptograms so that the probability P (A), where A is the event that the ordered cryptogram sequence consists of i zeros and n i ones, is equal to:

P(A) = P (A; (K = 0 or K = 1))

=P (A; K = 0) + P(A; K = 1)

=P (A j K = 0)P(K = 0) + P (A j K = 1)P (K = 1)

The conditional probability P (A j K = 0) is equal to the probability that the ordered message sequence consists of i zeros and n i ones. On the other hand, P(A j K = 1) equals the probability that the ordered message sequence contains n i zeros and i ones. Therefore,

P (A j K = 0) = vi(1 v)n i and P (A j K = 1) = (1 v)ivn i: As the result, we have:

P (A) = 12 vi(1 v)n i + (1 v)ivn i

Assume that Ci;n is the event that the unordered cryptogram sequence contains i zeros and n i ones, then,

The probability P (Ci;n j K = 0) is equal to the probability that the unordered message sequence obtains i zeros and n i ones. Substituting values, we get the following expression:

Considering the second conditional probability of the key, we obtain: a

1 + a

Clearly, the conditional entropy H(K j Ci;n) of the key can be calculated according to the following formula:

So, the equivocation of the cipher (or the average conditional entropy of the cryptographic key) can be presented as:

Figure 2.8 shows the equivocation EQ(n) = H(K j Cn) for ve di erent parameters of v, namely, v = 0:5, 0:4, 0:3, 0:2 and 0:1.

First consider the case when v = 0:5. The equivocation is constant and equals 1. This means that the uncertainty in the key is xed no matter how

Table 2.3. The equivocation for v = 0:1 with various numbers of observations

much of the cryptogram sequence is known. In other words, the key applied can be determined by selecting from two equally probable elements from all observations of cryptograms.

The second case is for v = 0:1. More exact values of EQ(n) for n = 1; : : : ; 10 are given in Table 2.3. Our equivocation is the entropy of two value random variables. Now consider such a variable which is characterized by two probabilities P (a) = ", P(b) = 1 ". Its entropy H" is presented in Table 2.4. From the two tables, we can state the equivocation EQ(n) for v = 0:1 and n = 4 is less than H", that is:

EQ(4) = 0:078 < H" = 0:081

Table 2.4. Some probabilities and entropies

Therefore, in this case, the unicity distance equals 4. In other words, after observing four elementary cryptograms, we are able to discover the key applied with the probability 0.99. Moreover, if we accept the threshold probability 0.9 instead of 0.99, then the unicity distance equals 1 as:

EQ(1) = 0:47 H" = 0:47

As you can see in the above example, the calculation of equivocation becomes more and more complicated as the number of elementary messages and keys grows. Sometimes, we can calculate (or estimate) the unicity distance of a cipher, but, unfortunately, we may not be able to use this knowledge to break the cipher.

In the above example the unicity distance stays the same only when the language (message source) has no redundancy (the case v = 0:5). But we must not draw a conclusion that this is an ideal cipher as the in nite unicity distance results from the lack of redundancy of the language rather than the strength of the cryptosystem. The ideal cipher should keep the unicity distance in nite for all message sources no matter how redundant they are. It is possible to improve the cipher considered in the example and make it ideal. How? It is enough to generate the cryptographic key independently and uniformly for every single message. The resulting cipher is the well-known Vernam one-time pad. Gilbert Vernam invented the cipher in 1917 for encryption of telegraphic messages. Although the one-time pad provides the perfect secrecy the price to pay for it is the length of the cryptographic key { it has to be as long as the message (or cryptogram) itself.

14.Consider polynomials Z2[x] over the binary eld. Write a program (in C or other language) which generates all irreducible polynomials of a given degree. The degree should be an input argument passed to the program.

15.Create the multiplication and addition tables for

{ GF (22) generated by an irreducible polynomial p(x) = x2 + x + 1,

{GF (23) generated by an irreducible polynomial p(x) = x3 + x2 + 1.

16.Take a function g(n) = 12n6 + 34n5 + 23. Give examples of the function f(n) such that

{f (n) = o(g(n)),

{f (n) = O(g(n)),

{f (n) = (g(n)),

{f (n) = (g(n)).

17.De ne conditional entropy and show that

{H(S j X) H(S),

{H(S; X) = H(S) + H(X j S),

{H(S; X) = H(S) + H(X) if S and X are independent random variables.

18.Design a Hu man code for a message source S = fs1; s2; s3; s4; s5g with the probabilities p(s1) = 1=2; p(s2) = 3=16; p(s3) = 1=8; p(s4) = 1=8; p(s5) = 1=16. Calculate the average length of the code and compare it to the entropy of the source.

19.Design an algorithm for measuring statistical properties of English language. Your algorithm should count occurrences of single characters and output the complete statistics for all single letters. Implement the algorithm in C or any other high level programming language. Test your program for di erent texts and discuss the results. Compute the redundancy D1 of English for single letters. Modify your program so it will output statistics of two letter strings. Compute the redundancy D2 of English for two-letter sequences.

20.Show that the one-time pad cipher is ideal.

3 PRIVATE-KEY CRYPTOSYSTEMS

Section 3.1 presents some classical ciphers for which both plaintext and ciphertext are characters or strings of characters. Section 3.2 covers the theory of modern cryptosystems and describes two early ciphers: Lucifer and DES. Section 3.3 presents ve private-key block ciphers: FEAL, IDEA, RC6, Rijndael and Serpent, of which the last three took part in the recent AES competition. The Rijndael algorithm has won and is currently proposed as the encryption standard. Sections 3.4 and 3.5 introduce di erential and linear cryptanalysis, respectively. Finally, Section 3.6 studies the principles for secure S-box design.

3.1 Classical Ciphers

The private-key ciphers enable two parties, the sender and receiver, to talk in secrecy via an insecure channel (Figure 3.1). Before any communication of messages takes place, both parties must exchange the secret key k 2 K via a secure channel. The secure channel can be implemented using a messenger

70 3 PRIVATE-KEY CRYPTOSYSTEMS

or registered mail. If the distribution of the key is done, the sender can select message m 2 M, apply the encryption algorithm E : M K ! C, and put the corresponding cryptogram c = Ek(m) into the insecure channel, where

using a particular language, the sender always chooses letters according to the probability distribution which characterizes the language.

We must assume that an enemy cryptanalyst knows the statistical properties of the message source (language) and reads all cryptograms that are being sent via the insecure channel. This adversary may want to either recreate messages or determine the secret key from cryptograms. This is the so-called ciphertextonly attack.

Early encryption algorithms were monoalphabetic ciphers where the encryption and decryption were done independently for each character. Consequently, messages and letters are used interchangeably.

3.1.1 Caesar Ciphers

Julius Caesar used a cipher which moved each letter of the alphabet to the letter three to the left in the predetermined order of the letters of the alphabet, so:

Messages A B C D E F G H I J K L M

Cryptograms D E F G H I J K L M N O P

Messages N O P Q R S T U V W X Y Z

Cryptograms Q R S T U V W X Y Z A B C

The last three substitutions are X ! A, Y ! B, and Z ! C. It is much more convenient to convert letters of the alphabet into integers. The most natural conversion is to assign each letter an integer which indicates the position of the letter in the alphabet:

Letters A B C D E F G H I J K L M

Integers 0 1 2 3 4 5 6 7 8 9 10 11 12

Letters N O P Q R S T U V W X Y Z

Integers 13 14 15 16 17 18 19 20 21 22 23 24 25