Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

Softpanorama Slightly Skeptical
Symmetric Crypto Algorithms Links

Traditional area of cryptography are symmetric ciphers and public key cryptosystems. See SSH - Tech Corner - Cryptographic Algorithms for an excellent introduction. Breaking cipher refers to finding a property (or fault) in the design or implementation of the cipher that reduces the number of keys required in a brute force attack (that is, simply trying every possible key until the correct one is found). For example, assume that a symmetric cipher implementation uses a key length of 128 bits: this means that a brute force attack needs to try up to all 2^128 possible combinations to convert the ciphertext into plaintext, which is way too much for the current and foreseeable future computing abilities. However, a cryptanalysis of the cipher with 16 bit key allow the plaintext to be found in 2^16 rounds, which is feasible.

There are numerous techniques for performing cryptanalysis, depending on what access the cryptanalyst has to the plaintext, ciphertext, secret key or other aspects of the cryptosystem. Below are some of the most common types of attacks:

1. Known-plaintext analysis: With this procedure, the cryptanalyst has knowledge of a portion of the plaintext from the ciphertext. Using this information, the cryptanalyst attempts to deduce the key used to produce the ciphertext. The famous brute force is essentially a know-plaintext attack although it can be extended to ciphertext-only attacks by using heuristics for detecting the plaintext. 
2. Chosen-plaintext analysis (also known as differential cryptanalysis): The cryptanalyst is able to have any plaintext encrypted with a key and obtain the resulting ciphertext, but the key itself is not known. The cryptanalyst attempts to deduce the key by comparing the entire ciphertext with the original plaintext. Older RSA algorithms has been shown to be somewhat vulnerable to this type of analysis.
3. Ciphertext-only analysis: here we need to work only from the ciphertext. This requires accurate guesswork about the style and how a message could be worded. It helps to know as much as possible about the subject of the message. It its extreme such knowledge might bring this case closer to known plaintext analysis.

In addition to the above, other techniques are available. Even more important, the boundaries between a ciphertext-only attack, a known plaintext attack, and a chosen-plaintext attack are not necessarily rigid in practice. One of the techniques used to mount a ciphertext-only attack on a message is the probable word method, where a guess about possible plaintext is tried as a hypothesis. This was how Enigma messages were decrypted and despite the fact that Enigma was very secure stream cipher machine of its time this negligence was successfully exploited by British.  This trick, in effect, at the cost of some wrong guesses and additional trials, turns the ciphertext-only case into the known plaintext case. In case of Enigma, the guessed plain text of the intercepted cipher message was called a crib.  In 1939-40 Alan Turing and another Cambridge mathematician, Gordon Welchman, designed the most famous deciphering machine, the British Bombe. The basic property of the Bombe was that it could break any Enigma-enciphered message, provided that the hardware of the Enigma was known and that a plain-text 'crib' of about 20 letters could be guessed accurately.

Similarly, if a sufficient amount of known plaintext is available, that quantity will include plaintexts with different properties, including some that are desirable to the cryptanalyst; hence, at least in extreme cases, the known plaintext case blurs into the chosen-plaintext case.

Successful cryptanalysis is a combination of mathematics, inquisitiveness, intuition, persistence, powerful computing resources - and more often than many would like to admit - luck. It's often a government's favorite game: enormous resource are usually required: the breaking of the German Enigma code during WWII, for example, was probably the most famous such case.

Today, cryptanalysis is practiced by a wider range of organizations that includes companies developing security products, etc. It is this constant battle between cryptographers trying to secure information and cryptanalysts trying to break cryptosystems and invent approaches that moves the cryptology forward. My impression is that cryptographers are now in much better position then ever before to defeat attempts of cryptanalysts to break their ciphers.

The reader needs to be very careful in judging the security of algorithms. Weak keys problem is especially important, much more so than resistance to differential crypto attacks -- the currently fashionable area. One needs to understand that people are probably is the weakest link and many attacks were possible because of poor selection of keys or other blunders (Enigma). But with a good cipher even in this case you need a genius working on the problem (Alan Turing) and huge resources (those of UK government) to succeed.

Generally attacks on well-studied crypto algorithms are very difficult and in this sense popular papers often distort the truth hinting that if algorithms contain a particular weakness it is easy to break it. Not true. The cryptanalysis of single-key cryptosystems depends on one simple fact - that some traces of the original structure of the plaintext may be visible in the ciphertext. For example, in a monoalphabetic substitution cipher where each letter in the plaintext is replaced by a letter in the ciphertext which is the same each time, a simple statistical analysis of a sizeable portion of ciphertext can be used to retrieve most of the plaintext due to the difference frequencies of letters in the natural languages. That's why block ciphers are generally preferable. 

Moreover even a slight variation of the classic scheme of application of a cipher (one secret key to a monolithic plaintext) completely changes the rules of the game and may substantial increase the security of even a very simple algorithm. That means that restrictions of exporting of a product that contain cryptographic algorithms are not as effective as one can think. For example if the key is artificially limited to say 56 bits to make brute-force attack possible there are still multiple cheap ways to foil such attempts. For example if you think that DES in insecure, you can use Triple DES without any problems.

With the advent of computers nothing prevent using such methods as injection of random letters, striping and compression. For example striping involved splitting the text into stripes (for example each n-th character method produces n stripes) and then encoding each stripe separately, using a different key. Striping reduces the effective length of the ciphertext and distorts statistical properties of the plaintext that are present and thus makes cryptanalysis a lot more difficult.

That means that with minor additional transformation it's not that easy to break even very weak ciphers, algorithms that are often dismissed by a popular press as insecure. For example many consider DEC to be insecure. Let's assume that it is incorporated into some hardware of black-box program and you need to enhance the security of the communication of information storage. There are several easy ways to do that: 

• To use the two additional rounds of software DEC encryption converting DES into Triple DES.
• To preprocess the plaintext with, say, bijective Huffman encoding. This is probably the most logical way to enhance the strength of  stream ciphers. What you lose in speed of encoding you get back in speed of transmission. Moreover any type of compression  effectively shorten the message and this increases the ratio length of plaintext/length of  the password. 
• The second simple way that is the most logical for block ciphers like DEC is to add a random first byte to each block (salt) to invalidate "chosen plaintext" attacks. During the decryption those first bytes can be easily discarded at almost no computational cost. The only penalty is a slight increase of the length of the ciphertext (1/8 or ~12% for 64 bit blocks).  This method is used to encode Unix passwords.
• The other possibility for clock ciphers is to use block-length-based striping (eight way striping for DEC) with the simple transposition of each stripe as the extension of the secret key (random letters should be added to the stripes to make the length mod 8. In this case the content of each block depends on the plaintext. 
• Yet another method is to use for each message a key generated by pseudorandom generator with the actual key acting as the seed.  This way there is no two messages with the same key and by knowing the initial key and pseudorandom generator used it's easy to recover the message even if some of previous messages were lost. That also to a large extent invalidates "chosen plaintext" attacks.

Each of those measures makes attacks more difficult and negatively affect even the exhaustive search of the key space (brute force attack). Please note that brute force attack on plain vanilla DEC is not an easy task and the cost of specialized computer is substantial (one million dollars in 1998, probably around $100K now). As RSA FAQ states:

No easy attack on DES has been discovered, despite the efforts of researchers over many years. The obvious method of attack is a brute-force exhaustive search of the key space; this process takes 2⁵⁵ steps on average. Early on, it was suggested [DH77] that a rich and powerful enemy could build a special-purpose computer capable of breaking DES by exhaustive search in a reasonable amount of time. Later, Hellman [Hel80] showed a time-memory tradeoff that allows improvement over exhaustive search if memory space is plentiful. These ideas fostered doubts about the security of DES. There were also accusations the NSA (see Question 6.2.2) had intentionally weakened DES. Despite these suspicions, no feasible way to break DES faster than exhaustive search (see Question 2.4.3) has been discovered. The cost of a specialized computer to perform exhaustive search (requiring 3.5 hours on average) has been estimated by Wiener at one million dollars [Wie94]. This estimate was recently updated by Wiener [Wie98] to give an average time of 35 minutes for the same cost machine.

The first attack on DES that is better than exhaustive search in terms of computational requirements was announced by Biham and Shamir [BS93a] using a new technique known as differential cryptanalysis (see Question 2.4.5). This attack requires the encryption of 2⁴⁷ chosen plaintexts (see Question 2.4.2); that is, the plaintexts are chosen by the attacker. Although it is a theoretical breakthrough, this attack is not practical because of both the large data requirements and the difficulty of mounting a chosen plaintext attack. Biham and Shamir have stated they consider DES secure.

More recently Matsui [Mat94] has developed another attack, known as linear cryptanalysis (see Question 2.4.5). By means of this method, a DES key can be recovered by the analysis of 2⁴³ known plaintexts. The first experimental cryptanalysis of DES, based on Matsui's discovery, was successfully achieved in an attack requiring 50 days on 12 HP 9735 workstations. Clearly, this attack is still impractical.

Most recently, a DES cracking machine was used to recover a DES key in 22 hours; see Question 2.4.4. The consensus of the cryptographic community is that DES is not secure, simply because 56 bit keys are vulnerable to exhaustive search. In fact, DES is no longer allowed for U.S. government use; triple-DES (see Question 3.2.6) is the encryption standard until AES (see Section 3.3) is ready for general use.

This is just random thoughts and there are definitely better and still very simple simple ways to enhance any well studied cipher like DEC or GOST.  The area is definitely more complex and I am not a specialist in this area, but still level of hype and distortions is enough to raise red flags even for me.

My impression is that even in best case brute force attacks are mostly impractical. So "other" methods are much more attractive and that is a very powerful argument against reusing keys and using some kind of modern "one-time keys" technology (for example any Secure-ID token is essentially a generator on one time keys that can be used  for encoding messages).

All-in all I feel that the availability of powerful computers radically changed this field not in favor of cryptanalysis specialists, but in favor of those who want the protect the text from decryption. Such methods like compression, steganography, new types of one-time pads, code-length manipulation (with Huffman encoding the length of the letter became a variable) generally favor the defender not the attacker of the encrypted text.  All these methods provides a lot of interesting opportunities and IMHO can significantly enhance the level of security of even the weakest ciphers. Unfortunately those areas are usually ignored in the traditional cryptography textbooks.

I would like to reiterate my impression that with the current level of sophistication of  crypto algorithms, the chances that a particular message will be decrypted are very small and outside of well known three letter agencies are minimal even with ciphers that are considered "weak" (e.g. DES).  All discussions of a weaknesses of DES assume that it is a single level of defense and that the party involved does not understand that limitation of the technology used. The reality is more complex and it is more realistic to assume that in all practical cases the relative weakness of DEC with short keys (as for example implemented in export version of Lotus Notes) is known to both parties. 

And it might well be that further progress can be achieved not by a creating a stronger cipher, but by using new capabilities provided by computers including but not limited to striping (multiple pipelines encoding), compression, steganography (with adding noise as the simplest form),

The latter might provide a substantial increase in security for weak ciphers. It is very attractive method when the length of  the transmitted text is not critical and can be at least doubled. The simplest examples include:

• Imbedding the message into another "decoy" message possibly having different meaning. In this case chosen plaintext attack is useless as for any given plaintext there is an infinite number of  decoy texts. 
• The injection of random characters using some formula that becomes the part of the secret key. For example if only each second letter constitute a plaintext and all other letters are decoy, the statistical properties of the text can be distorted enough to make the  text look like a pseudo random sequence of letters. More complex variant of the same is the manipulation of the size of the symbol codes (in bits) to avoid 8-bit boundaries. One of the simplest implementation is to consider length of codes for each letter to be a variable and a part of the secret key. Consider for example an English language codepage that uses 11 bits codes for each letter instead of 8 bits and is constructed in such a way that that the last three bits of the code of the letter can be random. In this case  seven different codes for a particular letter (including space) can be selected in round robin fashion (or randomly) during the encoding phase. This method artificially increases the size of alphabet and invalidates most statistical properties of the English language plaintext.
• Usage of pre-encoding scheme like uuencode or base64 before encryption.

Here is a nice illustration of the classic striping technique with "information" stripe consisting of each second (odd) line that is obfuscated by even lines.

Jokes Magazine

Employee Review January 25, 2000

My boss asked me for a letter describing my partner Bob Smith, and this is what I wrote:

Bob Smith, my assistant programmer, can always be found

hard at work in his cubicle. Bob works independently, without

wasting company time talking to colleagues. Bob never

thinks twice about assisting fellow employees, and he always

finishes given assignments on time. Often Bob takes extended

measures to complete his work, sometimes skipping

coffee breaks. Bob is a dedicated individual who has absolutely no

vanity in spite of his high accomplishments and profound

knowledge in his field. I firmly believe that Bob can

be classed as a high-caliber employee, the type which cannot

be dispensed with. Consequently, I duly recommend that Bob

be promoted to executive management, and a proposal will

be executed as soon as possible.

S.D. - Project Leader

Shortly afterward I sent the following follow-up note: That bastard Bob was reading over my shoulder while I wrote the report sent to you earlier today. Kindly read only the odd numbered lines (1, 3, 5, etc.) for my true assessment. Regards,

It is important to understand that the cipher is just a kind of the envelope for the message and nothing prevents you sending the message in several stripes (the method of combining which becomes a part of secret key) possibly using different keys (for example using sequential key transmission when the first message contains the secret code for the second and so on) or even different ciphers. In this case individual messages became meaningless and can be only understood in a larger context of a group of messages. Of course loss of any message in the group becomes fatal for recovering the whole message.  Like classic striping it makes the recovery of plaintext more difficult for the same length of the message and the same strength of the cipher.

Outside of well studied areas (like DES) ciphers still represent a little known type of algorithms and like pseudorandom generators more complex ciphers are not necessarily better or more secure. Unfortunately, multiple application of the same ciphers to increase security (like 3DES) represent a very little researched area (see chapter 15 "Combining Block ciphers in Schneier1996 for a brief introduction to the topic). How two ciphers interact with each other in the scheme (cipher-1-cipher2-cipher1) and to what extent they increase the strength of the original cipher in a general case is unclear. Moreover the answer may well be different depending on the types of the ciphers combined and whether the same of different secret keys are used on each round of encryption.

Please note that while compression is a powerful method to increase the security of the messages the usage of of-the-shelf compression utilities is a mixed blessing: they reduce the overall redundancy of the text, but they often put a predictable header at the beginning of the compressed stream, which facilitates known-plaintext attacks. That problem can be solved by several different methods and on several different levels, but even a simplest communication device now contains enough memory and CPU power to use bijective Huffman encoding that was designed to nullify this disadvantage. For more information, see

• Creating a ''One to One Adaptive Huffman Compression-Decompression Program for the real world of 8 bit byte files
• SCOTT's "one to one" compression discussion
• BIJECTIVE ADAPTIVE ARITHMETIC COMPRESSION

It has been argued that the prevention of brute force attacks is actually one of the purposes of compression. As for chosen plaintext attacks compression does not add much: you can always compress the chosen plaintext and compare results not with known plaintext but with the compressed encoding. But the limitation is that all plaintext needs to be known, partial knowledge is problematic and applies only to initial bytes of the message as compressed image of  "internal text" depends on previous context. Also compression can be based not on bytes but on larger entities for example digrams. Another classic defense is replacing any frequently used word with randomly chosen from a set of languages or (for articles) a random letter combinations that does not occur in a given natural language and due to this can be automatically eliminated.  In the paper Compression and Security the author aptly summarized the advantages of this method:

It has long been appreciated that there are advantages to eliminating regularities in the plaintext before encrypting.

The primary advantages to doing this are:

• The opponents get less ciphertext to analyze;
• What they do get has a corresponding plaintext with fewer redundancies and regularities.

The advantage of the first point should be obvious enough: the less data the enemy has to analyze, the fewer clues the have about the internal state of your cipher, and thus its key. The advantage of the second point is that it hinders cryptanalytic attacks. "Fewer redundancies and regularities" may be translated into more formal terms as "greater entropy per bit". The more closely the statistical properties of the file approach that of a random data stream, the fewer regularities the cryptanalyst has to go on. All this should be uncontroversial.

That compression aids encryption was realized by those who first employed "code-words" in their ciphers. By replacing frequently-used words like "the" and "and" with otherwise little-used symbols before encrypting they succeeded in reducing the volume of the text based on known regularities in the English language. This type of cipher was employed, for example, by Mary Queen of Scots.

That eliminating patterns in the frequency of the occurrence of particular symbols in the text before enciphering is desirable was clearly realized by the time homophones were employed in conjunction with mono alphabetic-substitution ciphers.

Dr. Nikolai Bezroukov

Old News ;-)

2002/185 ( PDF )

Turing, a fast stream cipher

Greg Rose and Philip Hawkes

2002/182 ( PS PS.GZ )

Oblivious Keyword Search

Wakaha Ogata and Kaoru Kurosawa

2002/142 ( PDF )

On the Applicability of Distinguishing Attacks Against Stream Ciphers

Greg Rose and Philip Hawkes

2002/131 ( PS PS.GZ PDF )

An Improved Pseudorandom Generator Based on Hardness of Factoring

Nenad Dedic and Leonid Reyzin and Salil Vadhan

AES Home Page

Cryptography Technology

Since graduating in theoretical physics and electrical engineering some 30+ years ago I have had an interest in cryptography and this has developed with the advent of progressively more powerful home computers.  In recent years I have played with a number of algorithms where I have taken a particular interest in the techniques involved in making algorithms go as fast as possible.

The Rijndael Page -- new standard cypher.

• Answer to the observations on the Rijndael diffusion layer, recently submitted to the NIST AES forum.
• Updated documentation and complete specification , as required by NIST (Adobe PDF format). This version corrects the errors that were found in the original document.
• A more theoretic paper , detailing the design principles behind Rijndael (Adobe PDF format).
• A document on efficient implementation of the S-box in hardware.
• Java code , for use with the Cryptix toolkit .
• Reference code in ANSI C v2.2.
• Optimised C code v3.0 (code provided by Paulo S.L.M. Barreto). Bug fixes and improved efficiency (with some compilers).

  IMPORTANT

The Limits of Cryptanalysis

Classical Cryptography Course (Lanaki)

CSE207C Lattices in Cryptography and Cryptanalysis

Cryptanalysis of CipherSaber-1

Cryptanalysis of Contents Scrambling System

Links to papers about cryptanalysis of block ciphers

FM 34-40-2 Basic Cryptanalysis

Cryptography, Encryption and Stenography

Springer LINK Lecture Notes in Computer Science 2133

Public-Key Crypto-systems Using Symmetric-Key Crypto-algorithms

Bruce Christianson, Bruno Crispo, and James A. Malcolm

Abstract. The prospect of quantum computing makes it timely to consider the future of public-key crypto-systems. Both factorization and discrete logarithm correspond to a single quantum measurement, upon a superposition of candidate keys transformed into the fourier domain. Accordingly, both these problems can be solved by a quantum computer in a time essentially proportional to the bit-length of the modulus, a speed-up of exponential order.

At first sight, the resulting collapse of asymmetric-key crypto-algorithms seems to herald the doom of public-key crypto-systems. However for most security services, asymmetric-key crypto-algorithms actually offer relatively little practical advantage over symmetric-key algorithms. Most of the differences popularly attributed to the choice of crypto-algorithm actually result from subtle changes in assumptions about hardware or domain management.

In fact it is straightforward to see that symmetric-key algorithms can be embodied into tamper-proof hardware in such a way as to provide equivalent function to a public-key crypto-system, but the assumption that physical tampering never occurs is too strong for practical purposes. Our aim here is to build a system which relies merely upon tamper-evident hardware, but which maintains the property that users who abuse their cryptographic modules through malice or stupidity harm only themselves, and those others who have explicitly trusted them.

LNCS 2133, p. 182 ff.

Full article in PDF (35 KB)

AES and Beyond- The IETF and Strong Crypto Nortel slides about some crypto issues in networking. Pretty basic, but still useful.

Crypto Scientists Crack Prime Problem

Recently, a group of Indian scientists made news by announcing an algorithm that appears to be able to tell quickly whether a number is prime or not.

http://zdnet.com.com/2100-1104-949170.html

If you're mathematically minded, the actual downloadable primality.pdf is worth reading.

So what does this actually mean for cryptography? First, a little background.

Many of the popular common crypto algorithms work because of "something to do with prime numbers". Most security books are about that vague. So math research about primes could have interesting effects on our field. But is being able to determine whether a number is prime quickly going to be able to help or hinder us? Let's look at the RSA algorithm as an illustrative example. (It lost its patent a few years back, so it's okay to discuss now.)

... ... ...

Public key crypto algorithms such as RSA depend on there being two keys used to encrypt and decrypt a message. (Hence, the "generate a key pair" step you see when setting up many applications that use cryptography.) Every user has a complimentary set made up of a private key and a public key. Anything encrypted with the private key can be decrypted with the public key, and anything encrypted with the public key can be decrypted with the private key. Only you should have a copy of your private key, but anyone can have your public key because it's, well, public. If someone encrypts traffic with your public key, it doesn't matter to you because only you can decrypt it.

So, you're probably thinking, if I have a message to send to Jane, I want to encrypt it. I can't encrypt it with my public key, because she doesn't have my private key to decrypt it. So I'll encrypt it with my private key, and she can decrypt it with my public key. Right? Not quite, but this is a really common mistake. Sure, Jane can decrypt the message with your public key. But so can anyone else. What you need to do is encrypt the message with Jane's public key, so that only Jane's private key (which only Jane should have) can decrypt it.

So, the RSA algorithm says this:

• Take two large prime numbers.
• When multiplied together, they have a product N.
• Find two numbers E and D, such that:
• When E is multiplied by D, that should be equal to one mod (p-1)(q-1).
• What this boils down to is that E and N have to be relatively prime.
• They can't share any common components.

8 and 9 are relatively prime. When broken down as much as possible,

8 = 2 x 2 x 2
9 = 3 x 3

Nothing in common.

8 and 20 are not relatively prime.

8 = 2 x 2 x 2
20 = 2 x 2 x 5

They have 2 in common, so they're not relatively prime.

If E and D are chosen correctly, then let's make C the ciphertext and P the plaintext.

C = M to the E power mod N
M = C to the D power mod N

So, something encrypted with N and E (the public key) can be solved for M -- decrypted into the plaintext. Something encrypted with N and D (the private key) can be solved for the ciphertext C. And since E and D fit together in a defined mathematical relationship as above, you cannot automatically deduce one from the other, but can encrypt and decrypt. The beauty of the modulus is that it's a one way operation. You know what the remainder is, but you'll have to try brute-forcing it to figure out whether it's C multiplied by one with a remainder of three, by two with a remainder of three... by forty thousand with a remainder of three... [grin] That takes a lot of time.

If you want to see an example of this worked out with numbers, there's a clear one at http://math.kennesaw.edu/maa/talks/RSAEncryptionAlgorithm.htm

So, back to our original point. Being able to quickly determine whether a number is prime -- what effect does that have on all this? Well, one of the weakest points about RSA and other public key algorithms is that their large prime numbers are only probably prime. It's really hard to tell whether a number with eight zillion digits is actually prime or not -- you have to try dividing it by every prime number up to half of its value or so. That's very time consuming. Since those of us that use PGP, etc., don't want to wait too long for our keys to be generated, the RSA algorithm picks values for P and Q that are very likely to be prime, but that's not known for certain.

If those numbers aren't actually prime, then there may be different solutions for the equations other than the ones that are supposed to work. So, someone might be able to decrypt a message without having the matching key -- they'd just need a matching key, if there were more than one. (That's what could happen if P and Q aren't prime.) If the new algorithm can determine whether P and Q are really prime and they're not for a given key pair, that could lead to a weakness in RSA. But if that's the case, RSA and other algorithm authors could modify their software to use the new algorithm to ensure that P and Q really are prime, and that would defeat that sort of attack.

There's a lot of sound and fury at the moment about this article, and many people are freaking out about it, but I don't think it's anything to worry about. Mathematicians haven't fully satisfied themselves yet that it's a good tester for primes -- I don't think we'll be seeing exploit code in the near future.

Lectures for Computer Security

Information on cryptography useful collection of links:

• Technical papers
  • Kerckhoffs' principles
  • Online technical reports
  • Steganography papers
  • Crypto protocol papers
  • Theory of Cryptography library
  • Conference list
  • NDSS '96
  • IBM Cyberjournal
  • Nice description of Kerberos
  • Nifty paper on Authentication
  • Draft paper on anonymity, etc.
  • Hugo's SKEME
  • Hugo's security analysis of his new MD5 MAC
  • A huge factoring report
  • Official GOST standard, translated to English
  • TEA block cipher
  • Some AU tech reports
  • Quantum cryptography
  • key lengths
  • Some factoring papers I need to read, from AMS: [1] [2] [3] and some more crypto papers I need to read: [1] [2] [3] [4]
  • New triple-DES mode from Coppersmith et. al. old
  • Papers online, from 1996 SCN (Italy)
  • Papers online, from Sweden
  • DES in FPGA's: SAC'98, a UK implementation
  • SOBER
  • Baran on security and secrecy
• Other notes and documents
  • sci.crypt FAQ
  • DVD CSS revealed and broken
  • Many technical crypto docs
  • A beautiful set of lecture notes for an advanced algorithms course
  • Cellphone security stuff
  • GSM MoU documents
  • GSM direction finder
  • NSA handbook for new NSA employees
  • The Hacker Crackdown
  • PGP User's Guide
  • Handbook of Applied Cryptography
  • Microsoft's crypto API spec
  • Aegean press
  • Colin Plumb reading list
  • A note on WWW browsers & privacy
  • Ross Anderson on ATM technology
  • Crypto clip art
  • Crypto notes on many ciphers
  • PGP statistics
  • Schneier's Skipjack info
  • Some untested documents on PKZIP cracking: [1] [2] [3] [4] [and lots o' links]
  • ARJ encryption, broken
  • Stuff on RNGs
  • Papers on LLL
  • Cybersecrecy, UK TV program
  • How to implement DES
  • If you ever have to implement x509...
  • STS improved Diffie-Hellman protocol summary
  • FIX, a banking protocol
  • SIGABA and other naval classical crypto information
  • Peter Meyer's intro to crypto
  • A paper on Enigma and attacks on it
  • Lattice crypto

[Oct 20, 2002] Crypto++ Library 5.0 - a Free C++ Class Library of Cryptographic Schemes

[Oct 20, 2002] Speed Comparison of Popular Crypto Algorithms

Here are speed benchmarks for some of the most popular hash algorithms and symmetric and asymmetric ciphers. All were coded in C++ or ported to C++ from C implementations, compiled with Microsoft Visual C++ 6.0 SP4 (optimize for speed, blend code generation), and ran on a Celeron 850MHz processor under Windows 2000 SP 1. Two assembly routines were used for multiple-precision addition and subtraction.

Algorithm	Bytes Processed	Time Taken	Megabytes(2^20 bytes)/Second
CRC-32	1073741824	8.682	117.945
Adler-32	2147483648	6.970	293.831
MD2	8388608	11.276	0.709
MD5	1073741824	10.165	100.738
SHA-1	536870912	10.565	48.462
SHA-256	268435456	10.345	24.746
SHA-512	67108864	7.761	8.246
HAVAL (pass=3)	536870912	7.922	64.630
HAVAL (pass=4)	536870912	12.337	41.501
HAVAL (pass=5)	268435456	7.090	36.107
Tiger	268435456	10.325	24.794
RIPE-MD160	268435456	8.332	30.725
Panama Hash (little endian)	1073741824	7.401	138.360
Panama Hash (big endian)	1073741824	11.797	86.802
MDC/MD5	268435456	9.884	25.900
Luby-Rackoff/MD5	67108864	8.402	7.617
DES	134217728	9.945	12.871
DES-XEX3	134217728	11.716	10.925
DES-EDE3	33554432	6.740	4.748
IDEA	134217728	11.286	11.341
RC2	33554432	7.912	4.044
RC5 (r=16)	536870912	12.988	39.421
Blowfish	134217728	7.091	18.051
Diamond2	67108864	11.086	5.773
Diamond2 Lite	67108864	9.403	6.806
3-WAY	201326592	12.728	15.085
TEA	134217728	12.799	10.001
SAFER (r=8)	67108864	10.565	6.058
GOST	134217728	12.829	9.977
SHARK (r=6)	268435456	12.878	19.879
CAST-128	134217728	7.090	18.054
CAST-256	134217728	9.995	12.806
Square	268435456	7.801	32.816
SKIPJACK	67108864	12.017	5.326
RC6	268435456	7.871	32.524
MARS	268435456	8.503	30.107
Rijndael	268435456	8.442	30.325
Twofish	268435456	9.974	25.667
Serpent	134217728	10.505	12.185
ARC4	536870912	8.122	63.039
SEAL	1073741824	8.672	118.081
WAKE	1073741824	13.029	78.594
Panama Cipher (little endian)	1073741824	8.512	120.301
Panama Cipher (big endian)	536870912	7.091	72.204
Sapphire	134217728	12.868	9.947
MD5-MAC	1073741824	12.078	84.782
XMACC/MD5	1073741824	11.096	92.286
HMAC/MD5	1073741824	10.254	99.863
CBC-MAC/RC6	268435456	8.713	29.381
DMAC/RC6	268435456	8.642	29.623
BlumBlumShub 512	524288	10.766	0.046
BlumBlumShub 1024	262144	12.668	0.020
BlumBlumShub 2048	65536	8.903	0.007

[Oct 20, 2002] Cryptographic Algorithms -- discussion of several popular algorithms

[Aug 3, 2002] Useful links

• Service de cryptographie et de sécurité informatique du Département d'Informatique de l'Université Libre de Bruxelles
• Crypto law survey by Bert-Jaap Koops
• Digital signature law survey by Simone van der Hof
• Crypto link farm by Peter Gutmann

O'Reilly Java Center -- News -- An Interview with Jonathan Knudsen

Java Cryptography -- Sample chapter Authentication

The first challenge of building a secure application is authentication. Let's look at some examples of authentication from everyday life:

• At an automated bank machine, you identify yourself using your bank card. You authenticate yourself using a personal identification number (PIN). The PIN is a shared secret, something that both you and the bank know. Presumably, you and the bank are the only ones who know this number.
• When you use a credit card, you identify yourself with the card. You authenticate yourself with your signature. Most store clerks never check the signature; in this situation, possession of the card is authentication enough. This is true when you order something over the telephone, as well; simply knowing the credit card number is proof of your identity.
• When you rent a movie at a video store, you prove your identity with a card or by saying your telephone number.

Authentication is tremendously important in computer applications. The program or person you communicate with may be in the next room or on another continent; you have none of the usual visual or aural clues that are helpful in everyday transactions. Public key cryptography offers some powerful tools for proving identity.

In this chapter, I'll describe three cryptographic concepts that are useful for authentication:

• Message digests produce a small "fingerprint" of a larger set of data.
• Digital signatures can be used to prove the integrity of data.
• Certificates are used as cryptographically safe containers for public keys.

A common feature of applications, especially custom-developed "enterprise" applications, is a login window. Users have to authenticate themselves to the application before they use it. In this chapter, we'll examine several ways to implement this with cryptography.[1] In the next section, for instance, I'll show two ways to use a message digest to avoid transmitting a password in cleartext from a client to a server. Later on, we'll use digital signatures instead of passwords.

Index of -~timtas-aes

About: aesutil is a small library and command line program to encrypt or decrypt data using the Rijndael algorithm in CBC mode.

Changes: A Windows port of the commandline utility, and better option handling.

Recommended Links

Ten most useful resources:

1. International Association for Cryptologic Research
2. Cryptography Pointers by Helger Lipmaa.(Finland)
3. Counterpane Labs Index of Crypto Papers Available Online
4. Ronald L. Rivest Cryptography and Security
5. Cryptography and Information Security Group (CIS Group)
   • CIS Publications
   • CIS Theses
6. Cryptography Resources
7. UCL Crypto Group
8. NetAction's Guide to Encryption

Directories and Portals

• Open Directory - Science Math Applications Communication Theory Cryptography Algorithms
• Open Directory - Computers Algorithms Pseudorandom Numbers
• Google Directory - Science Math Applications Communication Theory Cryptography Algorithms
• Yahoo! Computers and Internet Security and Encryption Cryptography
• Cryptography, Encryption and Stenography

Best metalink collections:

• Cryptography and Security (Rivest)
• Cypher and Crypto Bookmarks

Associations and public organizations

• American Cryptogram Association
• Center for democracy and technology
• IACR - International Association for Cryptological Research
• EFF DES Cracker Project

Government:

• The National Security Agency
• FIPS 46-2 - (DES), Data Encryption Standard
• DES Encryption
• Triple DES Encryption
• Computer Security Resource Center - NIST

People:

• Rivest
  • Ron Rivest's Home Page at MIT
  • Ron Rivest's Chaffing and Winnowing Paper
  • Ron Rivest's Links to Cryptography
• Rijndael Page - K.U. Leuven
• Ciphers By Ritter Cryptography and Technology
• Andrew Odlyzko's Home Page - University of Minnesota
• Richard Pinch's Home Page
• Richard Pinch's Research Page

Companies:

• RSA Labs Home Page
• IBM Research Network Security Group - Projects
• SSH - Tech Corner - Cryptographic Algorithms
• HP Labs Mathematics, Cryptography and Security Group, Bristol
• Counterpane Systems - Bruce Schneier
  • Counterpane Labs Index of Crypto Papers Available Online
  • Publications by Bruce Schneier
  • Self-Study Course in Block Cipher Cryptanalysis      (Bruce Schneier)

Prime numbers and random number generators:

• Prime numbers
• Random number generation

Etc:

• Crypto Glossary and Dictionary
• Basic Introduction to Cryptography
• Cryptography Introduction - SSH (Finland)
• Cryptography A-Z
• Cryptography Lectures (Australian Defence Force Academy)
• Cryptography Tutorial - Peter Gutmann, University of Auckland
• Security Related Links (SIRENE Researchers)
• Monark's Crypto
• Cryptography (University of British Columbia)
• Grabbe's Crypto Number Theory
• Microsoft Research - Cryptography Group
• Crypto Call for Papers, Conferences, links
• Journal of Cryptology
• McCurley's Whirlwind Tour of Cryptology
• McCurley's List of Cryptography Researchers
• Report on the Risks of Key Recovery
• Security in Clinical Information Systems
• On The Limits of Steganography
• Computer Security Group - University of Cambridge
• Dorothy Denning's Home page - Georgetown University
• Neil Johnson's Steganography Page
• Neil Johnson's Steganalysis page
• Computer Security Research Centre - London School of Economics
• The Biometric Consortium
• Biometrics - tutorial links
• Biometric Imaging - State of Connecticut
• Iris Recognition
• Iris Scanning
• Secure Internet Programming Laboratory - Princeton University
• COAST Project - Purdue University
• Shortcut to Cryptography
• Microsoft Security Advisor Program
• Tutorial on Elliptic Curve Cryptography - Certicom
• Jim Reeds' VMS Page
• Cylink Corporation
• Crypto Questions and Answers - RSA Laboratories
• Cryptography's Role in Securing the Information Society - NRC/CSTB
• Crypto and Security Link Farm - Peter Gutmann, University of Auckland
• IBM Zurich Security Research Group
• Timeline of Cryptography
• Cryptome
• The ISAAC Security and Encryption Group at UC Berkeley
• GSM Cloning - ISAAC Security Group, UC Berkeley
• Smart Card Alliance
• Cipher - Newsletter of the IEEE TC on Security and Privacy
• Computer Security Group at UC Davis
• SIRENE Home Page
• CITI - University of Michigan
• A Cryptographic Compendium
• Steganography Info and Archive
• Crypto links - Bellare, UCSD
• Research in Cryptography - Bellare, UCSD
• InfoWar - Information Warfare
• Crypto Law Survey
• Information Warfare - IASIW
• HMG Secure E-mail
• Modern Cryptography book - Oded Goldreich
• Ciphers by Ritter
• Introduction to Quantum Cryptoanalysis
• CCNY Computer Security course, Spring 1999
• UCL/DICE Crypto Group
• Cryptosoft - Security and Privacy Related Links
• Handbook of Applied Cryptography
• MIT Cryptography and Information Security Group
• A Bibliography of Quantum Cryptography
• Cryptographic Resources - Cryptography Research Inc.
• Digital Watermarking
• COSIC - K.U. Leuven
• AES - NIST
• Arithmetica Key Exchange - MSRI talk by M. Anshel
• Cryptography and Braid Groups
• Cryptology - Helger Lipmaa, Helsinki University of Technology
• Paul Garrett's Cryptography Page
• Cryptography and Information Security Research Group - ETH
• Cryptography and Information Security Group - University of Bristol
• New Key Agreement Protocols in Braid Group Cryptography - M. Anshel
• Neal Wagner's Page - University of Texas, San Antonio
• An Algebraic Method for Public-Key Cryptography - M. Anshel
• IACR Cryptography Preprint Archive
• Centre for Applied Cryptographic Research - University of Waterloo
• Center for Secure Information Systems - George Mason University
• Bill Moore's Cryptography Mini-Tutorial
• Cryptography and Encryption  -- just links
• Shortcut to Cryptography  -- just links
• Diffie-Hellman Key Exchange    (JAVA DEMO - FUN)
• Yenta - saving encrypted state to disk
• Encryptions programs - Python!
• The SDSC Encryption/Authentication (SEA) System
• Polymorphic Cipher (includes Best Possible Privacy etc)
• Legal status of cryptographic usage - country by country listings
• Practical Cryptosystems and their strength
• Smartcards
• Quantum Computing and Cryptography at Los Alamos
• Cryptology
• Authors of articles on Cryptography
• Cryptography Research
• Cryptography Links (outside North America)
• Popular Cryptography
• Practical attacks on PGP
• Quantum Computing and Cryptography Tutorials from Oxford
• Cryptography Timeline
• NSA Museum
• Ciphers by Ritter
• DNA Computing - including references to Adelman's work
• Molecular Computation of Solutions to Combinatorial Problems  by Leonard Adleman
• A Bibliography of Molecular Computation and Splicing Systems
• Links from The Mandala Centre
• Cryptography Resources  Canadian site URL:  http://www.scs.carleton.ca/~csgs/resources/crypt.html
• Ronald L. Rivest Cryptography and Security
• Cryptanalysis
• D.O.E. SysWorks
• Cryptography
• Cryptography Research, Inc.
• The Center for Democracy and Technology Cryptography Page
• The Crypto Policy Archive at the Electronic Privacy Information Center (EPIC)
• John Gilmore's Cryptography Export Control Archives
• Crypto.com is Matt Blaze's Cryptography information Web site
• DigiCrime, Inc., a full-service criminal computer hacking organization
• International Association for Cryptologic Research (IACR)
• The North American Cryptography Archives
• Paul Leyland's cryptography FTP archive
• The Public Key Cryptography Standards (PKCS) Archive at RSADSI
• Quadralay's Cryptography Archive
• Vince Cate's Cryptorebel/Cypherpunk Page

FAQs and References

• The Cryptography FAQ  (Sci.crypt FAQ )
• RSA Labs Cryptography FAQ
• Cryptography References (part 10 of the sci.crypt FAQ)
• Counterpane's Index of Cryptography Papers Online
• The Snake Oil FAQ (Snake Oil Warning Signs: Encryption Software to Avoid)
• The sci.crypt.research newsgroup FAQ
• RFC 1851 - Use of DES with triple encryption
• Glossary of Encryption Terms

Tutorials

*****  Cryptology an excellent introduction into cryptology

***** SSH - Tech Corner - Cryptographic Algorithms  a very good intro text. The best I found on the WEB.

Lecture notes on cryptography

[packet storm]. - http--packetstormsecurity.org

Counterpane Labs Self-Study Course in Block Cipher Cryptanalysis

CRYPTOGRAPHY MINI-TUTORIAL.

Cryptography tutorial from Australia (Peter Gutman)

Cryptography

The Cryptography API, or How to Keep a Secret

Learning about Cryptography by Terry Ritter

Basic

• VB Helper Tutorial Cryptography -- basic

• Cryptography Tutorial, Math 4 ME 2000 Programming Workshop  -- very basic

Encryption and Security Tutorial

Certicom - Online Tutorial

Welcome to the Elliptic Curve Cryptosystem Classroom. This site provides an intuitive introduction to Elliptic Curves and how they are used to create a secure and powerful cryptosystem. The first three sections introduce and explain the properties of elliptic curves. A background understanding of abstract algebra is required, much of which can be found in the Background Algebra section. The next section describes the factor that makes elliptic curve groups suitable for a cryptosystem though the introduction of the Elliptic Curve Discrete Logarithm Problem (ECDLP). The last section brings the theory together and explains how elliptic curves and the ECDLP are applied in an encryption scheme. This classroom requires a JAVA enabled browser for the interactive elliptic curve experiments and animated examples.

Elliptic curves as algebraic/geometric entities have been studied extensively for the past 150 years, and from these studies has emerged a rich and deep theory. Elliptic curve systems as applied to cryptography were first proposed in 1985 independently by Neal Koblitz from the University of Washington, and Victor Miller, who was then at IBM, Yorktown Heights.

Many cryptosystems often require the use of algebraic groups. Elliptic curves may be used to form elliptic curve groups. A group is a set of elements with custom-defined arithmetic operations on those elements. For elliptic curve groups, these specific operations are defined geometrically. By introducing more stringent properties to the elements of a group, such as limiting the number of points on such a curve, creates an underlying field for an elliptic curve group. In this classroom, elliptic curves are first examined over real numbers in order to illustrate the geometrical properties of elliptic curve groups. Thereafter, elliptic curves groups are examined with the underlying fields of F_p (where p is a prime) and F₂m (a binary representation with 2^m elements).

Quantum Cryptography Tutorial

Cryptography for encryption, signatures and authentication

Cryptography -- mainly PGP related...

Magazines

• Crypto-gram is a monthly email newletter published by Bruce Schneier
• CrytpoBytes, a technical newsletter on cryptography from RSA Laboratories

eBooks

• Applied Cryptography (2nd Ed.) by Bruce Schneier (includes an errata sheet)
• Handbook of Applied Cryptography by Alfred Menezes, Paul van Oorschot and Scott Vanstone

• Sample Chapters 

  CRC Press has generously given us permission to make all chapters available for free download.
  Please read this copyright notice before downloading any of the chapters.

  • Chapter 1 - Overview of Cryptography (48 pages)
    Postscript file, 554k; Pdf file, 343k.
  • Chapter 2 - Mathematics Background (38 pages)
    Postscript file, 472k; Pdf file, 301k.
  • Chapter 3 - Number-Theoretic Reference Problems (46 pages)
    Postscript file, 543k; Pdf file, 397k.
  • Chapter 4 - Public-Key Parameters (36 pages)
    Postscript file, 497k; Pdf file, 331k.
  • Chapter 5 - Pseudorandom Bits and Sequences (22 pages)
    Postscript file, 330k; Pdf file, 206k.
  • Chapter 6 - Stream Ciphers (32 pages)
    Postscript file, 484k; Pdf file, 274k.
  • Chapter 7 - Block Ciphers (60 pages)
    Postscript file, 783k; Pdf file, 491k.
  • Chapter 8 - Public-Key Encryption (36 pages)
    Postscript file, 434k; Pdf file, 303k.
  • Chapter 9 - Hash Functions and Data Integrity (61 pages)
    Postscript file, 690k; Pdf file, 482k.
  • Chapter 10 - Identification and Entity Authentication (40 pages)
    Postscript file, 444k; Pdf file, 316k.
  • Chapter 11 - Digital Signatures (64 pages)
    Postscript file, 748k; Pdf file, 526k.
  • Chapter 12 - Key Establishment Protocols (53 pages)
    Postscript file, 532k; Pdf file, 400k.
  • Chapter 13 - Key Management Techniques (48 pages)
    Postscript file, 536k; Pdf file, 340k.
  • Chapter 14 - Efficient Implementation (44 pages)
    Postscript file, 547k; Pdf file, 371k.
  • Chapter 15 - Patents and Standards (27 pages)
    Postscript file, 296k; Pdf file, 212k.
  • Appendix - Bibliography of Papers from Selected Cryptographic Forums (40 pages)
    Postscript file, 363k; Pdf file, 331k.
  • References (52 pages)
    Postscript file, 521k; Pdf file, 459k.
  • Index (26 pages)
    Postscript file, 236k; Pdf file, 160k.

• Building in Big Brother: The Cryptographic Policy Debate edited by Lance Hoffman

Recommended Papers

• Counterpane Labs Publications Publications - Bruce Schneier
• Cryptography with Dynamical Systems

  Dynamical systems are often described as ``unpredictable" or ``complex" as aspects of their behavior may bear a cryptic relationship with the simple evolution laws which define them. Some theorists work to quantify this complexity in various ways. Others try to turn the cryptic nature of dynamical systems to a practical end: encryption of messages to preserve their secrecy. Here some previous efforts to engineer cryptosystems based on dynamical systems are reviewed, leading up to a detailed proposal for a cellular automaton cryptosystem.

  Cryptosystems constructed from cellular automaton primitives can be implemented in simply constructed massively parallel hardware. They can be counted on to deliver high encryption/decryption rates at low cost. In addition to these practical features, cellular automaton cryptosystems may help illuminate some foundational issues in both dynamical systems theory and cryptology, since each of these disciplines rests heavily on the meanings given to the intuitive notion of complexity.

• Chaffing and Winnowing: Confidentiality without Encryption by Ron Rivest
• Computer Generated Random Numbers by David W. Deley
• The Crypto Anarchist Manifesto by Tim C. May
• Diceware for Passphrase Generation and Other Cryptographic Applications by Arnold G. Reinhold
• The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability by David Chaum, J. Cryptology (1988)
• The Magic Words are Squeamish Ossifrage by D. Atkins, M. Graff, A. Lenstra, and P. Leyland
  (This document is in PostScript format only.)
• The Mathematical Guts of RSA Encryption by Francis Litterio
• One-Time Pad FAQ
• Online Cash Checks by David Chaum
• P=?NP Doesn't Affect Cryptography by Arnold G. Reinhold
• Survey on PGP Passphrase Usage by Arnold G. Reinhold
• TEMPEST in a Teapot by Grady Ward (1993)
• Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms by David Chaum, Communications of the ACM
• Why Are One-Time Pads Perfectly Secure? by Fran Litterio
• Why Cryptography is Harder Than It Looks by Bruce Schneier
• Cryptanalysis of RSA with private key d less than N