Building blocks

• Exclusive or
  • Description
  • A few properties of XOR
  • Bitwise XOR
  • One-time pads
  • Attacks on “one-time pads”
    • Not using truly random data
    • Reusing the “one-time” pad
    • Crib-dragging
  • Remaining problems
• Block ciphers
  • Description
  • AES
    • A closer look at Rijndael
      • Key schedule
      • SubBytes
      • ShiftRows
      • MixColumns
      • AddRoundKey
  • DES and 3DES
  • Remaining problems
• Stream ciphers
  • Description
  • A naive attempt with block ciphers
    • Visual inspection of an encrypted stream
    • Encryption oracle attack
    • Decrypting a block using the oracle
    • Conclusion
  • Block cipher modes of operation
  • CBC mode
  • Attacks on CBC mode with predictable IVs
  • Attacks on CBC mode with the key as the IV
  • CBC bit flipping attacks
  • Padding
    • Padding with zeroes (or some other pad byte)
    • PKCS#5/PKCS#7 padding
  • CBC padding attacks
    • Decrypting the first byte
    • Discovering the padding length
    • Decrypting one byte
    • Decrypting subsequent bytes
  • Native stream ciphers
  • RC4
    • An in-depth look at RC4
    • The key scheduling algorithm
    • The pseudorandom generator
    • Attacks
  • Salsa20
  • Native stream ciphers versus modes of operation
  • CTR mode
  • Stream cipher bit flipping attacks
  • Authenticating modes of operation
  • Remaining problems
• Key exchange
  • Description
  • Abstract Diffie-Hellman
  • Diffie-Hellman with discrete logarithms
  • Diffie-Hellman with elliptic curves
  • Remaining problems
• Public-key encryption
  • Description
  • Why not use public-key encryption for everything?
  • RSA
    • Encryption and decryption
    • Breaking RSA
    • Implementation pitfalls
      • PKCSv1.5 padding
      • Salt
    • OAEP
  • Elliptic curve cryptography
  • Remaining problem: unauthenticated encryption
• Hash functions
  • Description
  • MD5
  • SHA-1
  • SHA-2
    • Attacks on SHA-2
  • Keccak and SHA-3
  • Password storage
    • Hash functions to the rescue
    • Rainbow tables
    • Salts
    • Modern attacks on weak password systems
    • So where do we go from here?
  • Length extension attacks
  • Hash trees
  • Remaining issues
• Message authentication codes
  • Description
    • Secure MACs
    • Why does a MAC take a secret key?
  • Combining MAC and message
    • Authenticate-then-encrypt
    • Authenticate-and-encrypt
  • A naive attempt with hash functions
    • Breaking prefix-MAC
    • Variants
  • HMAC
  • One-time MACs
    • Re-using and
  • Carter-Wegman MAC
  • Authenticated encryption modes
    • AEAD
  • OCB mode
  • GCM mode
    • Authentication
• Signature algorithms
  • Description
  • RSA-based signatures
    • PKCS#1 v1.5
    • PSS
  • DSA
    • Parameter generation
    • Key generation
    • Signing a message
    • Verifying a signature
    • The trouble with
  • ECDSA
  • Repudiable authenticators
• Key derivation functions
  • Description
  • Password strength
  • PBKDF2
  • bcrypt
  • scrypt
  • HKDF
    • A closer look at HKDF
      • The extraction phase
      • The expansion phase
• Random number generators
  • Introduction
  • True random number generators
    • Radioactive decay
    • Shot noise
    • Nyquist noise
  • Cryptographically secure pseudorandom generators
  • Yarrow
  • Blum Blum Shub
  • Dual_EC_DRBG
    • Background
    • A quick overview of the algorithm
    • Issues and question marks
    • Aftermath
  • Mersenne Twister
    • An in-depth look at the Mersenne Twister
    • The initialization function
    • The state regeneration function
    • The tempering function
    • Cryptographic security