Random Numbers in Cryptography - Computer and Network Security - Lecture Slides, Slides of Computer Science

Download Random Numbers in Cryptography - Computer and Network Security - Lecture Slides and more Slides Computer Science in PDF only on Docsity!

Part 1  Cryptography 1

Random Numbers in

Cryptography

Part 1  Cryptography 2

Random Numbers

 Random numbers used to generate keys

o Symmetric keys

o RSA: Prime numbers

o Diffie Hellman: secret values

 Random numbers used for nonces

o Sometimes a sequence is OK

o But sometimes nonces must be random

 Random numbers also used in simulations,

statistics, etc., where numbers only need to

be “statistically” random

Part 1  Cryptography 4

Bad Random Number Example

 Random numbers used to shuffle the deck

 Program did not produce a random shuffle

 Could determine the shuffle in real time!

 Online version of Texas Hold „em Poker

o ASF Software, Inc.

Part 1  Cryptography 5

Card Shuffle

 There are 52! > 2

225

possible shuffles

 The poker program used “random” 32-bit

integer to determine the shuffle

o Only 2

distinct shuffles could occur

 Used Pascal pseudo-random number

generator (PRNG): Randomize()

 Seed value for PRNG was function of

number of milliseconds since midnight

 Less than 2

27

milliseconds in a day

o Therefore, less than 2

possible shuffles

Part 1  Cryptography 7

Randomness

 Sources of randomness via software

o Software is (hopefully) deterministic

o So must rely on external “random” events

o Mouse movements, keyboard dynamics, network

activity, etc., etc.

 Can get quality random bits via software

 But quantity of such bits is very limited

 Bottom line: “The use of pseudo-random

processes to generate secret quantities can

result in pseudo-security”

Part 1  Cryptography 8

Public Key Infrastructure

Part 1  Cryptography 10

Certificate Authority

 Certificate authority (CA) is a trusted 3rd

party (TTP) that issues and signs cert‟s

o Verifying signature verifies the identity of the

owner of corresponding private key

o Verifying signature does not verify the identity

of the source of certificate!

o Certificates are public!

o Big problem if CA makes a mistake (a CA once

issued Microsoft certificate to someone else!)

o Common format for certificates is X.

Part 1  Cryptography 11

PKI

 Public Key Infrastructure (PKI) consists of

all pieces needed to securely use public key

cryptography

o Key generation and management

o Certificate authorities

o Certificate revocation (CRLs), etc.

 No general standard for PKI

 We consider a few “trust models”

Part 1  Cryptography 13

PKI Trust Models

 Oligarchy

o Multiple trusted CAs

o This approach used in browsers today

o Browser may have 80 or more

certificates, just to verify signatures!

o User can decide which CAs to trust

Part 1  Cryptography 14

PKI Trust Models

 Anarchy model

o Everyone is a CA!

o Users must decide which “CAs” to trust

o This approach used in PGP (Web of trust)

o Why do they call it “anarchy”? Suppose cert. is

signed by Frank and I don‟t know Frank, but I do

trust Bob and Bob says Alice is trustworthy and

Alice vouches for Frank. Should I trust Frank?

 Many other PKI trust models

Part 1  Cryptography 16

Crypto Summary

 Public key crypto

o RSA

o Diffie-Hellman

o Non-repudiation

o PKI, etc.

Part 1  Cryptography 17

Crypto Summary

 Hashing

o Birthday problem

o SHA1, HMAC, etc.

 Secret sharing

 Random numbers