Authenticated Signatory Made Easy

Authenticated signatory

okay suppose there was a bad guy who wanted to read what was written in this letter back in the olden days they could simply steam open the envelope but now imagine that this letter is an electronic communication encrypted with a modern cipher there's really no chance that you're going to be able to unlock or open the envelope so what do you do well one thing you could do is just throw the letter away and replace it with a new letter in this video we're going to talk about message authentication modern encryption gives us something that we really need in our daily communications confidentiality but remember there are two other really important properties integrity and authenticity if you haven't already done so go back and check out our videos about block ciphers hash functions and semantic security all right suppose alice sends a message to bob over the internet and that message is intercepted by a man in the middle because alice is using strong encryption the man in the middle won't be able to read what she's saying but what if instead of trying to read the bits the man in the middle changes the bits of the message what effect does this have in this video we're going to explore this issue and the implications how important is message integrity really at first glance it may seem like some error correction issue in fact as we're going to see message integrity is so important that without it we can't even guarantee confidentiality if alice were to say encrypt a photo and send it to bob and along the way the man in the middle modified some of the bits as we saw in our encryption video it would corrupt the plain text so bob would end up with a garbled looking image let's start by looking at the effects of message modification if a man in the middle were to flip a bit of the cipher text what effect is that going to have on the plain text well if we're using a one-time pad the effects are very straightforward flipping a bit of the cipher text will have the effect of flipping that associated bit in the plain text so the one-time pad provides no inherent message integrity but that's okay because we don't use the one-time pad anyway all right now let's see what happens in a block cipher in counter mode counter mode is a lot like the one time pad except that the pad is being generated by encrypting a counter using a block cipher like the one time pad this result is then xored with the message to create the ciphertext so again if a man in the middle were to flip one bit of the ciphertext it would have the effect of flipping that bit in the plain text things are a little bit different in the cipher block chaining mode of operation if you flip one bit of the ciphertext it will affect all of the bits in that block flipping each bit with 50 chance as per the avalanche effect so by flipping a single bit you're basically destroying the entire plaintext block however because cipher block chaining feeds the ciphertext forward into the next block flipping one bit of the ciphertext has the effect of flipping one bit of the plaintext in the next block so in each of these cases flipping a bit of the ciphertext has the effect of flipping a bit in the plaintext so what this means is that the attacker has a way to make linear modifications to the plaintext without knowing the key and this is a vulnerability the attacker can exploit now you might be saying so what if a man in the middle starts flipping ciphertext bits it's going to mess up the plain text and bob's going to notice right well before we dive into the practice let's look at the theory let's look at the adaptive chosen ciphertext attack the cpa2 game as it turns out if there's no message integrity we can win the cca2 game recall in the cca2 game the guesser picks two messages any two messages they'd like and they submit it to the challenger the challenger flips a coin the outcome of that coin toss selects one of the two messages to encrypt now if the challenger is using a block cipher in cipher block chaining mode they would pick a random initialization vector and send the ciphertext and iv back to the guesser now recall in the cca2 game the guesser is allowed to make decryption queries after receiving the challenge ciphertext the only catch is they cannot submit the challenged ciphertext itself but what they can do is submit modified versions of the challenge ciphertext anything that's just different so why not just stick a random block at the end of the message and submit that to the challenger the challenger looks and sees that it's not identical to the challenge ciphertext and agrees to decrypt it and here's the trick changing ciphertext blocks later on in the message has no effect on blocks earlier in the message so when the challenger decrypts this query the last plaintext block will decrypt to something random but it doesn't matter the point is the first plaintext block will be identical to what the challenge ciphertext had encrypted the challenger will send this two-block plaintext back to the guesser and the guesser will look at the first block and that will represent the plaintext that was chosen the guesser always wins this system is not secure under adaptive chosen ciphertext attack okay so you can win the cca2 game if there's no message integrity so what how likely is this to be a problem in practice how likely is it that bob is just going to start decrypting things that he receives on the internet and sending them back to people not really likely right well not so fast in practice no bob is not going to just start decrypting things for random strangers however eve is smart in practice she's going to be able to provoke bob into revealing information kind of like a poker tell she's going to be able to slowly and methodically collect these little bits of information and put them together into something useful but before i can show you how this works let me start by telling you about something called padding as we saw in previous videos block ciphers work on fixed length blocks so what happens if your plain text message does not evenly divide the block length and if the last block of the plaintext is smaller than the block length of the cipher we're going to have to do something so for example imagine that you were using aes which has a 16 byte block but you only wanted to encrypt an 11 byte message what do you do now the first temptation might just be to add five more bytes of zeros to the end but what happens if the plain text itself consisted of zeros we need some kind of unambiguous way that bob can recognize what's message and what's padding and remove the padding well one way we can do it is to use a padding standard called pkcs number seven it works like this first determine how many bytes of padding your plain text needs we'll call this number n add n bytes of padding and the n bytes are each going to be the number n so if we needed five bytes of padding we're going to add five bytes of the number five when bob decrypts this message and sees the padding he knows exactly how to remove it and the deal is we always add padding that way it's unambiguous so what happens if our plaintext is a multiple of 16 we don't need to add padding but remember our deal we always add padding so what we can do is add an additional block of just padding 16 bytes of the number 16. okay so what happens if you decrypt a message and discover that the padding is wrong what should you do okay imagine that alice and bob are communicating alice sends a valid ciphertext to bob but along the way eve swaps out the valid ciphertext for just some random garbage cipher text bob decrypts this cipher text and gets a random looking plain text the last byte is not valid what should he do he's going to have to behave differently somehow the difference might be overt bob returns an error message to alice or it might not be so overt simply bob takes different amounts of time to handle valid versus invalid messages but as it turns out eve is going to be able to exploit this eve is going to find out one way or another whether or not the padding was valid and she's going to be able to use this information to her advantage whether he means to or not bob essentially is going to behave like a padding oracle eve hands bob ciphertext and bob tells her whether or not the plaintext padding was correct now you might be saying well you know who cares if eve can figure out if padding is valid or not the problem is padding oracles can be turned into decryption oracles let's see how this works in cbc mode if eve modifies the last byte of the second last block of ciphertext that modification will wind its way into the last byte of the plaintext eve doesn't know the last byte of the plaintext but she can indirectly infer it by whether or not the padding is correct essentially eve is going to be able to brute force the last byte of the plaintext by modifying the last byte of the second last block of ciphertext she's going to make a guess about what that plaintext bite is and she's going to modify the ciphertext in such a way that if her guess is right it will result in a plain text with valid padding she's going to create this modified message send it to bob and then observe whether or not he reacted as though the padding was correct if the padding wasn't correct she's going to modify her guess and send another cipher text to bob she's going to repeat this over and over again until she finds a modification that bob doesn't react negatively towards once she's confident she's figured out the last bite of the plain text she'll repeat this attack again on the second last bite once she has that information she'll repeat the attack for the third last bite and so on until she's recovered the entire message so eve is going to be able to figure out a plaintext bite in approximately 255 queries so in a 16 byte aes block eve is going to have to make on the order of about 4 000 decryption queries 4 000 queries is actually less than it might seem and real implementations of this attack can recover an entire plaintext block in a few seconds recovering the plaintext of a single block would be enough to recover the authentication token for a website that you're visiting allowing the attacker to log in as you so we need to figure out some way to stop padding oracles after decades of padding oracle attacks there's really no point to experiment with trying to make the software not reveal this information the attacker will be able to tell that difference one way or another so what if there was a way that decryption itself never actually went through if the cipher text wasn't somehow valid and what if it was hard to decide whether a particular cipher text was valid without knowledge of a key this brings us to something called message authentication codes the idea is we're not just going to encrypt the message we're also going to apply some kind of authentication mark or stamp or seal of approval and the idea is we're going to make it cryptographically difficult for someone without knowledge of this key to apply a similar stamp or seal of approval then if eve tries to swap out a valid ciphertext for one that she injects herself it will be missing this stamp or seal of approval and bob will be able to detect it and just ignore the plaintext so if we return to our eavesdropping game the idea is we were just trying to make it hard to recover a plain text given a cipher text now in the chosen plain text attack game recall the guesser has the ability to make encryption queries so the way that we defeated the chosen plaintext attack was we allowed a single plain text to go to many possible ciphertexts so if the guesser could make an encryption query this time that doesn't matter because the next time that same plaintext gets encrypted it'll map to some other value well with the chosen ciphertext attack the way that we're going to defeat it is for not every ciphertext to be valid in fact we'll set it up so that the overwhelming majority of ciphertext are not valid and the only way that you can find one that is is to know the key like encryption message authentication codes are a family of three functions the first function is a key generation function just like encryption it accepts the security parameter and produces a random k bit key also similar to encryption the message authentication code signing function will accept some arbitrary length message and a key but unlike the encryption function it will produce a short fixed length output called the mac tag the verify function accepts an arbitrary length message the mac key and a mac tag and it will output a single bit either yes this message matches this mac tag for this key or no it doesn't now you'll notice that the message authentication code sign function produces a fixed length output we've already looked at functions that produce fixed length output in cryptography hash functions in fact we can use hash functions as a building block for message authentication codes one thing hash functions don't have natively is a way to incorporate a key we can't just take the key and stick it at the front of the message and then hash it otherwise there are attacks and we can't take the key and just stick it at the end of the message and hash it because there are other attacks but what we can do is take the key and stick it at the front of the message and hash that and take that result and stick the message in front of it and hash that to create our mac tag this construction is known as a hash-based message authentication code or hmac okay so we have these message authentication codes how are they applied to messages do we map the plain text do we map the ciphertext how does it work well there's actually several different ways we can approach this one common approach is the encrypt then mac approach the idea is you create a cipher text from a plain text and then you apply the mac function to the ciphertext itself notice that the encryption key and the mac key are different and independently generated from one another otherwise certain attacks exist encrypt then mac as a configuration is actually widely used in tls today but another approach is the mac then encrypt configuration where the mac function is applied to the plain text to produce the mac tag and then the plain text with the mac tag are all encrypted to produce the ciphertext in this configuration the ciphertext containing the encrypted plaintext and mac tag are sent over the internet remember if eve tries to modify the cipher text she's going to end up modifying the plaintext somehow this will introduce a mismatch between the plain text and the associated mac tag and when bob verifies the plain text against the mac tag they won't match okay so let's apply this idea back to our chosen ciphertext attack game once again the guesser picks two messages and sends it to the challenger the challenger flips a coin picks one of the messages and then creates the challenge ciphertext from it the challenge ciphertext is returned to the guesser now the guesser is free to make decryption queries remember they can't ask for the challenge ciphertext itself to be decrypted but they can modify it somehow and ask for that to be decrypted imagine that the challenge ciphertext was 0 1 1 1. the guesser could try to create a trivial modification to the ciphertext by appending a block in this example we'll append the block 0 0. but remember the second block of the challenge ciphertext contains the encrypted mac tag so if the guesser attaches another ciphertext block to the end of this ciphertext and submits it to the challenger when the challenger goes to decrypt they're going to take the first two blocks of the plain text and put it into the mac verify function they're going to take the last block of the plain text and interpret it as the mac tag and then they're going to use the mac key to see if those two plain text blocks were consistent with that mac tag now in this two-bit example they're going to have a one in four chance of hitting the jackpot but if it was a 128-bit cipher they would have a vanishingly small chance of finding the right tag and that means the challenger is going to reject the decryption query because the ciphertext was invalid and because the guesser isn't going to be able to come up with a valid ciphertext they're not going to be able to see a valid decryption and therefore they're not going to be able to squeek out any information about what the challenge plaintext was so this is how we defeat the adaptive chosen ciphertext attack game now let's go back to our padding oracle example the idea is that bob is not even going to look at the plain text unless the mac tag was valid and therefore he's not even going to look at the padding to see whether it was valid or not and this makes eve's life much harder without message authentication codes approximately 1 out of 256 randomly chosen ciphertext are going to have valid padding but with message authentication codes that probability goes way down okay so let's take our encryption and message authentication and put it together into one package called authenticated encryption once again we're going to have a family of three functions the key generation function is going to accept a security parameter and this time it's going to produce an encryption key and a mac key the encryption function is going to accept a plain text and the encryption and mac keys and produce a ciphertext an initialization vector and a mac tag and finally the decryption function is going to accept a ciphertext a mac tag an initialization vector and the two keys now here's where the magic comes into play the decryption function will only ever return a plain text if the mac tag is valid otherwise it will simply produce an error authenticated encryption is going to protect developers by making all the hard design choices for them the cipher the cipher mode of operation the message authentication code the mac configuration and what to do if something goes wrong all of these things will be handled for you inside of one convenient api all right let's look at an example one of the most commonly used forms of authenticated encryption is something called aes gcm now this is the aes block cipher and it is being used in counter mode it's also using a message authentication code based on multiplying numbers in galwa fields called g hash and finally the g hash mac is being applied in an encrypt then mac configuration aes gcm is used all over the internet next time you go online click on the padlock icon and see if you can see what cipher it's using okay so we learned an interesting lesson in this video confidentiality is extremely important but without message integrity we can't have confidentiality so the way that we win the chosen ciphertext attack game is with message authentication codes all right that's it for now if you enjoyed this video don't forget to hit like and subscribe and we'll see you next time