App Development (Midterms Reviewer)
App Development (Midterms Reviewer)
• Block ciphers require the length n of the plaintext DES Operation - initial permutation 16 identical
to be a multiple of the “rounds” of function application, each using
block size b different 48 bits of key final permutation.
• Padding the last block needs to be unambiguous
(cannot just add zeroes) The Advanced Encryption Standard (AES)
• When the block size and plaintext length are a
multiple of 8, a common • In 1997, the U.S. National Institute for Standards
padding method (PKCS5) is a sequence of identical and Technology
bytes, each indicating (NIST) put out a public call for a replacement to
the length (in bytes) of the padding DES.
• Example for b = 128 (16 bytes) • It narrowed down the list of submissions to five
– Plaintext: “Roberto” (7 bytes) finalists, and
– Padded plaintext: “Roberto999999999” (16 ultimately chose an algorithm that is now known as
bytes), where 9 denotes the the Advanced Encryption Standard (AES).
number and not the character • AES is a block cipher that operates on 128-bit
• We need to always pad the last block, which may blocks. It is designed to
consist only of padding be used with keys that are 128, 192, or 256 bits
long, yielding ciphers
Block Ciphers in Practice known as AES-128, AES-192, and AES-256.
• Data Encryption Standard (DES)
– Developed by IBM and adopted by NIST Block Cipher Modes
in 1977 • A block cipher mode describes the way a block
– 64-bit blocks and 56-bit keys cipher encrypts and decrypts a sequence of
– Small key space makes exhaustive message blocks.
search attack feasible since late 90s • Electronic Code Book (ECB) Mode (is the
• Triple DES (3DES) simplest):
– Nested application of DES with three – Block P[i] encrypted into ciphertext block
different keys KA, KB, and KC C[i] = EK (P[i])
– Effective key length is 168 bits, making – Block C[i] decrypted into plaintext block
exhaustive search attacks unfeasible M[i] = DK(C[i])
– C = EKC(DKB(EKA(P))); P =
DKA(EKB(DKC(C))) Strengths and Weaknesses of ECB (Electronic
– Equivalent to DES when KA=KB=KC Code Book)
(backward compatible) Strengths:
• Advanced Encryption Standard (AES) – Is very simple
– Allows for parallel encryptions of the blocks of a • Stream cipher
plaintext – XOR the plaintext with the key stream C[i]
– Can tolerate the loss or damage of a block = S[i] P[i]
– Suitable for plaintext of arbitrary length
Weakness: generated on the fly, e.g., media Stream
– Documents and images are not suitable for ECB
encryption since patterns in the plaintext are Key Stream Generation
repeated in the ciphertext:
• RC4
– Designed in 1987 by Ron Rivest for RSA Security
Cipher Block Chaining (CBC) Mode – Trade secret until 1994
• In Cipher Block Chaining (CBC) Mode – Uses keys with up to 2,048 bits
– The previous ciphertext block is combined – Simple algorithm
with the current plaintext block C[i] = EK (C[i • Block cipher in counter mode (CTR)
1] P[i]) – Use a block cipher with block size b
– C[1] = V, a random block separately – The secret key is a pair (K,t), where K is key and t
transmitted encrypted (known as the (counter) is a b-bit value
initialization vector) – The key stream is the concatenation of
– Decryption: P[i] = C[i 1] DK (C[i]) ciphertexts EK (t), EK (t + 1), EK (t + 2), …
– Can use a shorter counter concatenated with a
Strengths and Weaknesses of CBC random value
Strengths: – Synchronous stream cipher
– Doesn’t show patterns in the plaintext
– Is the most common mode Cryptographic Hash Functions
– Is fast and relatively simple
Weaknesses: Hash Functions
– CBC requires the reliable transmission of all the • A hash function h maps a plaintext x to a fixed-
blocks sequentially length value x = h(P) called hash value or digest of
– CBC is not suitable for applications that allow P
packet losses (e.g., music and video streaming) – Usually x is much smaller in size
compared to P.
– A collision is a pair of plaintexts P and Q
that map to the same hash value, h(P) =
h(Q)
– Collisions are unavoidable
– For efficiency, the computation of the hash
function should take time proportional to the
length of the input plaintext
• MD5 hash function widely used (RFC 1321) Lecture 4 - Software Engineering
– computes 128-bit message digest in 4-step
process. Software Engineering - the application of a
– arbitrary 128-bit string x, appears difficult to systematic, disciplined, which is a computable
construct msg m whose MD5 hash is equal to x. approach for the development of software,
• SHA-1 is also used. operation, and maintenance of software.
– US standard [NIST, FIPS PUB 180-1] - Is the branch of computer science that deals
– 160-bit message digest with the design, development, testing, and
• There are many hash functions, but most of them maintenance of software applications.
do not satisfy cryptographic hash function Software engineers apply engineering
requirements principles and knowledge of programming
– example: checksum languages to build software solutions for
end users.
Message-Digest Algorithm 5 (MD5)
Steps/Phases/Activities
• Developed by Ron Rivest in 1991 1. Requirements Gathering / Analysis
• Uses 128-bit hash values 2. User Interface Design
• Still widely used in legacy applications although 3. Architectural Design
considered insecure 4. Detailed Design
• Various severe vulnerabilities discovered 5. Programming
• Chosen-prefix collisions attacks found by Marc 6. System Integration
Stevens, Arjen Lenstra and Benne de Weger 7. Validation
– Start with two arbitrary plaintexts P and Q 8. Verification (Testing)
9. Production
10. Documentation
11. Maintenance Deployment & Maintenance
12. Project Management
Core Software Development Life Cycle Model
1. Requirements Gathering & Analysis 1. Waterfall Model
2. Planning Advantage
3. Development - Simple and easy to understand and
4. Testing use
5. Deployment & Maintenance - Phases are processes and
completed one at a time
Software Development Life Cycle (SDLC) - Easy to arrange tasks.
Disadvantages
Requirements Gathering - develop useful - No working software is produced
software until late during the life cycle
- Survey, Interview, Observation, Use case - Not a good model for complex and
analysis, and more. OOPs.
Cloud computing
- Pay for what you use
- Scale up pay more Scale down pay less
- No server space required
- No experts required for hardware and
software maintenance
- Better data security
- Disaster recovery Public cloud
- High Flexibility The cloud infrastructure is made available to the
- Automatic software updates general public over the internet and is owned by a
- Teams can collaborate from widespread cloud provider
locations
- Data can be accessed and shared Example: AWS, Microsoft Azure, IBM's Blue Cloud
anywhere over the internet and Sun Cloud
- Rapid implementation
Service Model
PaaS
If your company requires a platform for building Cloud Providers
software products pick Platform as a Service ● AWS (Amazon Web Services)
● IBM Cloud
SaaS ● Google Cloud Platform
If your business doesn't want to maintain any IT ● Microsoft Azure
equipment, then choose Software as a Service ● Vmware
● DigitalOcean
IaaS
- laaS is a cloud service that provides basic
computing infrastructure
- Services are available on
pay-for-what-you-use model
- laaS providers include Amazon Web
Services, Microsoft Azure and Google
Compute Engine
- Users: IT Administrators
PaaS
- PaaS provides cloud platforms and runtime
environments for developing, testing, and
managing applications