Making & Breaking Codes &
Ciphers

• Cryptography
– Science of creating codes or ciphers
• Cryptanalysis
– Science of breaking codes and ciphers
AJ 115 2

• Code
– Substitution of words or phrases by others
– Example: Navajo “code talkers” of WW II:
• turtle means tank
• sea turtle means landing craft
• Cipher
– Algorithmic scrambling/unscrambling
– Example: Caesar cipher
• Replace each letter with the letter 3 positions after it in the alphabet (a
 d, b
 e, etc.)
AJ 115 3

• Plaintext
– The unencrypted (readable) message
• Ciphertext
– The encrypted version of the message
• Secure channel
– A communications path safe from eavesdropping
• Insecure channel
– A communications path that may be tapped
AJ 115 4

• Stream cipher acts on one character at a time
– Replaces each character with a different symbol
– Fixed : Each plaintext ‘a’ is always replace by the same ciphertext symbol
• Example: Caesar cipher (‘a’ always replaced by ‘d’)
• Example: rot13 (used to encode “obscene” text)
– Variable : Different occurrences of ‘a’ in the plaintext are replaced with different symbols in the ciphertext
• Example: German Enigma cipher machine of WWII
AJ 115 5

• A stack of code wheels threaded on a central axis
– Could be any length, but typically ~30
– Each had all letters of the alphabet, but no two were identical
• To encrypt a message
– Divide message into blocks = stack size
– Turn wheels so plaintext shows on one row
– Lock the wheels
– Transmit any other row
AJ 115 6

• To decrypt a message
– Set wheels to match the ciphertext for each block
– Lock the wheels
– Look for the one row that contains readable plaintext
• Jefferson’s machine was used, successfully, for almost a century
AJ 115 7

QuickTime™ and a
TIFF (LZW) decompressor are needed to see this picture.
AJ 115 8

• Used by Germany during WW II
– Considered it
“unbreakable”
• Broken in 1940 by
Britain (“Ultra”)
– Team at Bletchley
Park, headed by
Alan M. Turing
QuickTime™ and a
TIFF (Uncompressed) decompressor are needed to see this picture.
AJ 115 9

• Operator typed plaintext message
• 3 rotors scrambled each letter
• Ciphertext character lit up on upper panel
• Rotors turned after every letter
QuickTime™ and a
TIFF (U ncompressed) decompressor are needed to see t his picture.
AJ 115 10

• Lots of similar messages
– Germans sent weather information to U-boats every day, all in same format
• Human error
– Lazy or tired operators re-used rotor settings instead of changing them
– Repeated first 3 characters of message
• Weakness of algorithm
– Would never translate a letter to itself
AJ 115 11

• The “Bombe”
– Computer at Bletchley Park
– Searched thousands of possible Enigma settings, looking for one that yielded readable plaintext
• Captured code books
– Naval vessels carried books of Enigma settings
– British captured U-559 in Sept. 1942
• By 1943, Britain could read intercepted
Enigma messages before the Germans could!
AJ 115 12

• Prior to 1976, all ciphers were “symmetric”
– Used the same key to encrypt and decrypt
• Problem with all old encryption schemes is the key exchange
– Recipient must have the same key as the sender
– How do you transmit a secret key over an insecure channel?
AJ 115 13

• New Directions in Cryptography
– Whitfield Diffie & Martin Hellman, 1976
• Proposed using two keys
– One to encrypt messages (the public key)
– A different key to decrypt (the private key)
– Also known as asymmetric cryptography
• Two keys are related, but one cannot be derived from the other
– Public key can be published
AJ 115 14

• Select two prime numbers, p and q
– Ex: choose p = 11, q = 3
• Compute n = pq , f = ( p -1)( q -1)
– Ex: n = 11 
3 = 33, f = 10

2 = 20
• Choose e , the encryption key, less than n , so that e and f have no common factors
– Ex: choose e = 3
AJ 115 15

• Find d (the decryption key)
– Need ( e  d / f ) to leave a remainder of 1
– Ex: 3  d / 20 leaves remainder 1 if d = 7
• Key pair is (n,e) and (n,d)
– Encryption (public) key is (33, 3)
– Decryption (private) key is (33, 7)
AJ 115 16

• Encrypting a message
– ciphertext = (plaintext) e mod n
– Ex: plaintext = 13
• ciphertext = 13 3 mod 33 = 2197 mod 33 = 19
• Decrypting the message
– plaintext = (ciphertext) d mod n
• plaintext = 19 7 mod 33 = 893871739 mod 33
= 13
AJ 115 17

• Real versions use very large numbers
– Modulus, n , is at least 1024 bits long
• About 340 decimal digits
• So p and q are each about 200 digits long
• Numbers are easy to multiply, but hard to factor
– It’s easy to compute n if you know both p and q
– It’s almost impossible to factor n into p & q
AJ 115 18

• No cipher is 100% unbreakable
– Except “one-time pads,” but they have other problems
• By making the modulus larger, RSA can be made arbitrarily hard to break
– With a 2048-bit modulus, all the computing power in the world would take over 70 years to break one cipher
AJ 115 19

• Asymmetric encryption is S-L-O-W
– Can take even powerful computers 1-2 seconds to encrypt or decrypt a message
• Can be fooled by someone posing as someone else
– If Eve claims to be Bob and publishes
“Bob’s” public key, any messages encrypted with it will be readable by Eve, not Bob
AJ 115 20

• DES (Data Encryption Standard)
– Proposed in 1974 by NSA, IBM
– Symmetric cipher
– Algorithm can be implemented in hardware
• Key very short
– 56 bits long (40-bit key and 16-bit header)
– Could be broken “by force” with enough computing power (which NSA has)
AJ 115 21

• Shortness of key used by DES considered a weakness
• Newer version is “triple-DES” or 3DES
– 136 bits long (120-bit key + 16-bit header)
• AES (Advanced Encryption Standard)
– Uses 128-bit key
• DES, 3DES, and AES are all symmetric
AJ 115 22

• Secure Sockets Layer (SSL)
– Invented by Netscape in 1995
• Uses RSA to exchange a “session key”
– DES, 3DES, or AES key used for that browser session only
• Gets both speed and security
– RSA only used to exchange session key
– Session key expires when user logs out
AJ 115 23

• Overcome “spoofing” attack
– Perform same function as notary public
• Purchase from Certificate Authorities
(CAs)
– VeriSign, Thawte, Comodo, GeoTrust, …
• Contain my public key
• “Signed” by the root certificate
– Located in your browser
AJ 115 24

• Asymmetric cryptography can be used to digitally “sign” documents
– Achieves all purposes of conventional signature (but better):
• Cannot be forged
• Cannot be stolen and re-used
• Cannot be repudiated
• Assume Alice wants to sign a document and send it to Bob. Here goes …
AJ 115 25

1. Alice computes the MD5 (or SHA-1) digest value for the document
2. She encrypts the (document+digest) combination using her own private key
3. She then encrypts the previous message using Bob’s public key and sends Bob the result.
AJ 115 26

1. Bob decrypts the message from Alice using his own private key.
2. He then decrypts the resulting message using Alice’s public key.
3. He isolates the digest value and compares it with the value he computes for the rest of the message.
4. If everything matches, he knows that Alice signed this document.
AJ 115 27

• Can Alice later repudiate her signature?
– No, because only she has her private key
• Can Bob or Eve forge Alice’s signature?
– No, for the same reason
• Can Eve steal Alice’s signature and use it to “sign” a different document?
– No, because then the digest values wouldn’t match
AJ 115 28

• Public-key cryptography allows people to communicate securely even if they have never met
– Necessary for electronic commerce
• Ciphers cannot be made 100% secure, but they can be made arbitrarily secure
– Use longer keys
• Both good guys and bad guys can use this technology
– Cryptanalysis is essentially obsolete
AJ 115 29