密码学从整体上看集合特性

CollegeofComputerScienceandElectronic 群环域 对于加法y=x1+x2+x3+….+xn，哪怕我们不知道于是对于加性系统，我们（大体上）可以预计它的可靠性与稳定性（期 和故障概率预计它运行时性能的随机波动 噪声对于乘性系统 须承认 intextalphabettociphertextdoesnot intextletters’ intextletters’doesnot intextthecryptographicstrengthoflettersubstitutionandpermutationcouldbeweakenedbylinguisticsknowledgetheideasofsubstitutionandpermutationaretwoContentofthisIntrotostreamRandomnumbergeneratorsOne-TimePadLinearfeedbackshiftregistersTrivium:amodernstream

Chapter2ofUnderstandingCryptographybyChristofPaarandJanContentofthisIntrotostreamRandomnumbergeneratorsOne-TimePadLinearfeedbackshiftregistersTrivium:amodernstream

Chapter2ofUnderstandingCryptographybyChristofPaarandJan StreamCiphersintheFieldof Symmetric Block StreamStreamCipherswereinventedin1917byGilbert

Chapter2ofUnderstandingCryptographybyChristofPaarandJan Mr.VernamandhisAT&TBellEveryletter=5XOR/2-modular

Chapter2ofUnderstandingCryptographybyChristofPaarandJanthesetis{0,0+0=0mod1+0=1mod0+1=1mod1+1=0mod StreamCiphervs.BlockStreamEncryptbitsUsuallysmallandfast! commoninembeddeddevices(e.g.,A5/1forGSMphones)BlockAlwaysencryptafullblock(severalArecommonforInternet

Chapter2ofUnderstandingCryptographybyChristofPaarandJan StreamCipher:PerformancecomparisonofsymmetricciphersKeyRC4(streamSource:Zhaoetal.,AnatomyandPerformanceofSSLProcessing,ISPASS

Chapter2ofUnderstandingCryptographybyChristofPaarandJan EncryptionandDecryptionwithStreamintextxi,ciphertextyiandkeystreamsiconsistofindividualEncryptionanddecryptionaresimpleadditionsmodulo2(akaEncryptionanddecryptionarethesameEncryption:yi=esi(xi)=xi+simodDecryption:xi=esi(yi)=yi+simod

xi,yi,si

Chapter2ofUnderstandingCryptographybyChristofPaarandJansupposexisonebit y=x+smoddistributionisp(y=0)=p(y=1)=0.5 Synchronousvs.AsynchronousStreamSecurityofstreamcipherdependsentirelyonthekeystreamsiShouldberandom,i.e.,Pr(si=0)=Pr(si=1)=MustbereproduciblebysenderandSynchronousStreamKeystreamdependonlyonthekey(andpossiblyaninitializationvectorAsynchronousStreamKeystreamdependsalsoontheciphertext(dottedfeedback

Chapter2ofUnderstandingCryptographybyChristofPaarandJan WhyisModulo2AdditionaGoodEncryptionModulo2additionisequivalenttoXORForperfectlyrandomkeystreamsi,eachciphertextoutputbithasa50%chancetobe0or1 GoodstatisticpropertyforInvertingXORissimple,sinceitisthesameXOR000011101110

Chapter2ofUnderstandingCryptographybyChristofPaarandJanWhywewantciphertextbitstobeequal-likelydistributedover{0,1}? RC4,WEPandOtherRonaldLinnRivest(MITEECSRC1(notRC2RC3(crackedindesignRC4(crackedonlimitedIVchoices,andcausedseveresecurityvulnerabilitiesforWLAN)RC5(1994-present,ingoodRC6(1995-present,candidatefor

Chapter1ofUnderstandingCryptographybyChristofPaarandJan GSMencryptionanditsA5/11987,EuropeandU.S.(debateonkeyA5/21989,weaker,exportMorethan5billionusersrelyonthemtoprotectvoice 1994algorithm1999reverse2003degrade2009rainbowtable2010turn-off ,wehaveNOGSM

Chapter1ofUnderstandingCryptographybyChristofPaarandJan CopacabanaCost-OptimizedParallelCodeBreaker~10,000Anykeysize<64couldbecrackedin

Chapter1ofUnderstandingCryptographybyChristofPaarandJanContentofthisIntrotostreamRandomnumbergeneratorsOne-TimePadLinearfeedbackshiftregistersTrivium:amodernstream

Chapter2ofUnderstandingCryptographybyChristofPaarandJan RandomnumbergeneratorsTruePseudorandomSecure

Chapter2ofUnderstandingCryptographybyChristofPaarandJan TrueRandomNumberGeneratorsBasedonphysicalrandomprocesses:coinflip ,dicerolling,semiconductornoise,radioactivedecay,mousemovement,clockjitterofdigitalcircuitsOutputstreamsishouldhavegoodstatisticalPr(si=0)=Pr(si=1)=50%(oftenachievedbypost-OutputcanneitherbepredictednorbeTypicallyusedforgenerationofkeys,nonces(usedonly-oncevalues)andformanyotherpurposes

Chapter2ofUnderstandingCryptographybyChristofPaarandJan PseudorandomNumberGeneratorGeneratesequencesfrominitialseedTypically,outputstreamhasgoodstatisticalOutputcanbereproducedandcanbepredictedOftencomputedinarecursiveway:s0=Example:Example:rand()functioninANSIs0si+1modMostPRNGshavebadcryptographic

Chapter2ofUnderstandingCryptographybyChristofPaarandJan yzingaSimpleSimpleSimplePRNG:LinearCongruentialS0=Si+1=ASi+BmodunknownA,BandS0asSizeofA,BandSitobe100300bitofoutputareknown,i.e.S1,S2andS2=AS1+BmodmS3=AS2+Bmod…directlyrevealsAandB.AllSicanbecomputedBadcryptographicpropertiesduetothelinearityofmost

Chapter2ofUnderstandingCryptographybyChristofPaarandJan CryptographicallySecurePseudorandomNumberGenerator(CSPRNG)SpecialPRNGwithadditionalOutputmustbeunpredictablewhentheseedvalueisMoreprecisely:Givennconsecutivebitsofoutputsi,thefollowingoutputbitscannotbepredicted(inpolynomialNeededincryptography,inparticularforstreamRemark:Therearealmostnootherapplicationsthatneedunpredictability,whereasmany,many(technical)systemsneedPRNGs.

Chapter2ofUnderstandingCryptographybyChristofPaarandJan MoreaboutRSASecurID(70%globalmarket,宝令，QQ2012Pentagonreverseengineering&algorithmicattackthesam