Secret-Key Encryption

Introduction
• Encryption is the process of encoding a message in such a way that
only authorized parties can read the content of the original message
• History of encryption dates back to 1900 BC
• Two types of encryption
• secret-key encryption : same key for encryption and decryption
• pubic-key encryption : different keys for encryption and decryption

• We focus on secret-key encryption in this chapter

Substitution Cipher
• Encryption is done by replacing units of plaintext with ciphertext,
according to a fixed system.
• Units may be single letters, pairs of letters, triplets of letters, mixtures
of the above, and so forth
• Decryption simply performs the inverse substitution.
• Two typical substitution ciphers:
• monoalphabetic - fixed substitution over the entire message
• Polyalphabetic - a number of substitutions at different positions in the
message
Monoalphabetic Substitution Cipher
• Encryption and decryption
Breaking Monoalphabetic
Substitution Cipher
• Frequency analysis is the study of the frequency of letters or groups
of letters in a ciphertext.
• Common letters : T, A, E, I, O
• Common 2-letter combinations (bigrams): TH, HE, IN, ER
• Common 3-letter combinations (trigrams): THE, AND, and ING
Breaking Monoalphabetic
Substitution Cipher
• Letter Frequency Analysis results:
Breaking Monoalphabetic
Substitution Cipher
• Bigram Frequency Analysis results:
Breaking Monoalphabetic
Substitution Cipher
• Trigram Frequency analysis results:
Breaking Monoalphabetic
Substitution Cipher
• Applying the partial mappings…
Data Encryption Standard (DES)
• DES is a block cipher - can only encrypt a block of data
• Block size for DES is 64 bits
• DES uses 56-bit keys although a 64-bit key is fed into the algorithm
• Theoretical attacks were identified. None was practical enough to
cause major concerns.
• Triple DES can solve DES’s key size problem
Advanced Encryption Standard
(AES)
• AES is a block cipher
• 128-bit block size.
• Three different key sizes: 128, 192, and 256 bits
Encryption Modes
Encryption Modes
• Encryption mode or mode of operation refers to the many ways to
make the input of an encryption algorithm different.
• Examples include:
• Electronic Codebook (ECB)
• Cipher Block Chaining (CBC)
• Propagating CBC (PCBC)
• Cipher Feedback (CFB)
• Output Feedback (OFB)
• Counter (CTR)
Electronic Codebook (ECB) Mode
Electronic Codebook (ECB) Mode
• Using openssl enc command:

• We use the 128-bit (key size) AES algorithm

• The -aes-128-ecb option specifies ECB mode
• The -e option indicates encryption
• The -d option indicate decryption
• The -K option is used to specify the encryption/decryption key
Cipher Block Chaining (CBC) Mode

• The main purpose of IV is to

ensure that even if two
plaintexts are identical, their
ciphertexts are still different,
because different IVs will be
used.
• Decryption can be parallelized
• Encryption cannot be parallelized
Cipher Block Chaining (CBC) Mode
• Using openssl enc command to encrypt the same plaintext, same key, different IV:

• We use the 128-bit (key size) AES algorithm

• The -aes-128-cbc option specifies CBC mode
• The -e option indicates encryption
• The -iv option is used to specify the Initialization Vector (IV)
Cipher Feedback (CFB) Mode
• A block cipher is turned into a stream
cipher.
• Ideal for encrypting real-time data.
• Padding not required for the last
block.
• decryption using the CFB mode can be
parallelized, while encryption can only
be conducted sequentially
Comparing encryption with CBC and
CFB

• Plaintext size is 21 bytes

• CBC mode: ciphertext is 32 bytes due padding
• CFB mode: ciphertext size is same as plaintext size (21 bytes)
Output Feedback (OFB) Mode
• Similar to CFB
• Used as stream cipher
• Does not need padding
• Decryption can parallelized

• Encryption in the OFB mode can be

parallelized
Counter (CTR) Mode
• It basically uses a counter to generate the
key streams
• no key stream can be reused, hence the
counter value for each block is prepended
with a randomly generated value called
nonce
• This nonce serves the same role as the IV
does to the other encryption modes.
• both encryption and decryption can be
parallelized
• the key stream in the CTR mode can be
calculated in parallel during the encryption
Modes for Authenticated Encryption
• None of the Encryption modes discussed so far cannot be used to
achieve message authentication
• A number of modes of operation have been designed to combine
message authentication and encryption.
• Examples include
• GCM (Galois/Counter Mode)
• CCM (Counter with CBC-MAC)
• OCB mode (Offset Codebook Mode)
Padding
• Block cipher encryption modes divide plaintext into blocks and the
size of each block should match the cipher’s block size.
• No guarantee that the size of the last block matches the cipher’s block
size.
• Last block of the plaintext needs padding i.e. before encryption, extra
data needs to be added to the last block of the plaintext, so its size
equals to the cipher’s block size.
• Padding schemes need to clearly mark where the padding starts, so
decryption can remove the padded data.
• Commonly used padding scheme is PKCS#5
Padding Experiment

• Plaintext size is 9 bytes.

• Size of ciphertext (cipher.bin) becomes 16 bytes
Padding Experiment
• How does decryption software know where padding starts?

7 bytes of 0x07 are added

as the padding data
 Padding Experiment – Special case
• What if the size of the plaintext is already a multiple of the block size
(so no padding is needed), and its last seven bytes are all 0x07

• Size of plaintext (plain3.txt) is 16 bytes

• Size of decryption output (plaint3_new.txt) is 32 bytes ( a full block is added as the padding).
• Therefore, in PKCS#5, if the input length is already an exact multiple of the block size B, then B bytes of
value B will be added as the padding.
Initial Vector and Common Mistakes
• Initial vectors have the following requirements:
• IV is supposed to be stored or transmitted in plaintext
• IV should not repeat (uniqueness).
• IV should not be predictable.
Experiment - IV should not be
predictable
• Eve calculates the next IV
Experiment - IV should not be
predictable
• Eve guesses that Bob voted for John Smith, so she creates P1_guessed and XOR it with IV_bob
and IV_next, and finally constructs the name for a write-in candidate.
Experiment - IV should not be
predictable
• Eve gives her write-in candidate’s name (stored in P2) to the voting
machine, which encrypts the name using IV_next as the IV. The result
is stored in C2.
• If C1 (Bob’s encrypted vote) == C2, then Eve knows for sure that Bob
has voted for “John Smith”.
Programming using Cryptography
APIs
• We use PyCryptodome
package’s APIs.
• Line:
1. Initialize cipher
2. Encrypts first 32 bytes of data
3. Encrypts the rest of the data
4. Initialize cipher (start new
chain)
5. Encrypt the entire data
6. Initialize cipher for decryption
7. Decrypt
Programming using Cryptography
APIs
• Modes that do not need padding include CFB, OFB, and CTR.
• For these modes, the data fed into the encrypt() method can have an
arbitrary length, and no padding is needed.
• Example below shows OFB encryption
Attack on ciphertext’s integrity
• Attacker makes changes to ciphertext (Line 2)

• Result
Authenticated Encryption
• To protect the integrity, the sender needs to generate a Message
Authentication Code (MAC) from the ciphertext using a secret shared
by the sender and the receiver.
• The MAC and the ciphertext will be sent to the receiver, who will
compute a MAC from the received ciphertext.
• If the MAC is the same as the one received, the ciphertext is not
modified.
• Two operations are needed to achieve integrity of ciphertext: one for
encrypting data and other for generating MAC.
• Authenticated encryption combines these two separate operations
into one encryption mode. E.g GCM, CCM, OCB
The GCM Mode
Programming using the GCM Mode
The unique part of the above code is the tag
generation and verification.
In Line 3 , we use the digest() to get the
authentication tag, which is generated from
the ciphertext.
Programming using the GCM Mode

In Line 6 , after feeding the ciphertext to the

cipher, we invoke verify() to verify
whether the tag is still valid.
Experiment - GCM Mode
• We modify the ciphertext by changing the 10th byte to (0x00)
• Decrypt the modified ciphertext and verify tag