密码学基础教程：第二版

需积分: 10 5 浏览量更新于2024-07-18 收藏 3.31MB PDF 举报

"An Introduction to Cryptography - 2nd Edition by Mohamed Barakat, Christian Eder, Timo Hanke" 本书《密码学入门》是第二版，由Mohamed Barakat, Christian Eder和Timo Hanke合著，于2018年9月20日发布。这本书起源于2017年夏季在凯泽斯劳滕大学所教授的课程的讲义，主要基于Mohamed Barakat和Timo Hanke的原有讲义[BH12]。书中还参考了其他权威资料，如[Buc04, Sch95, MVO96]。第一版的讲义源自Timo Hanke在2010年夏季学期在亚琛工业大学教授的"Kryptographie"课程，后来由Mohamed Barakat在2010/11冬季学期他在凯泽斯劳滕大学的"Cryptography"课程中进行了修订和扩展，并翻译成了英文。在这个过程中，他们还参考了Michael Cuntz, Florian Heß, Gerhard Hiß和Jürgen Müller等人授课的讲义，对作者们表示感谢。书中特别提及，作者Mohamed Barakat感谢课程中的学生提供有益的评论和问题，特别是感谢Henning Kopp的诸多贡献。这本《密码学入门》详细介绍了密码学的基础知识，可能涵盖了密码学的基本原理、加密算法、数字签名、散列函数、公钥基础设施（PKI）、认证协议和密码学在网络安全中的应用等内容。读者可以期待学习到如何使用密码技术来保护数据的机密性、完整性和真实性，以及如何验证信息的来源。此外，书中可能还会讨论现代密码学的挑战，例如量子计算对现有加密方法的影响，以及密码学的最新发展和标准。对于对密码学感兴趣的初学者或希望深入了解网络安全基础的人而言，这本书提供了丰富的知识和深入的见解，是理解这个领域的重要参考资料。

CHAPTER 2. BASIC CONCEPTS

3. E

being a multivalued map is no problem as long as Equation 2.1 holds. It ensures that even

if the encryption leads to a set of ciphertexts this set is in the preimage of corresponding

decryption algorithm. Moreover, it follows that the multivalued map E

is injective for all

e ∈ K .

4. In particular, we often assume that both, E and D, are families of maps, in particular, E is a

family of injective maps P → C. Moreover, it then holds by construction that

∀d ∈ K

′

κ(d)

◦D

= id

∀e ∈ K D

−1

(e)

◦E

= id

□

Example 2.19. Recall Example 1.1:

1. We can describe Caesar’s cryptosystem via

= Σ

= Σ = P = C = K = K

′

= {A,..., Z}

∼

Z/26Z, and

: P → C, m 7→ (m + k) mod 26,

ℓ

: C → P , c 7→ ( c −ℓ) mod 26.

In other words: E

= D

−k

and thus E

is a map for all k ∈ K .

2. The Vigenère cryptosystem now generalizes the Caesar one to: We still have Σ

= Σ

∼

Z/26Z and K = K

′

, but now P = C = K = Σ

|k|

for a key k. In our example we have

k = “SECRET” = (18, 4, 2, 17, 4, 19) ∈ (Z/26Z)

Thus we can assume P , C ⊂ Σ

(if the texts are longer we can cut them in blocks of length

6) and we can apply E and D component wise:

: P → C, m 7→ (m + k) mod 26 = (m

+ k

,..., m

+ k

) mod 26,

ℓ

: C → P , c 7→ ( c −ℓ) mod 26 = ( c

−ℓ

,..., c

−ℓ

) mod 26.

Again it holds that E

= D

−k

and thus E

is a map for all k ∈ K .

□

Deﬁnition 2.20. A cipher

is an algorithm for performing encryption or decryption. If we have a

cryptosystem, the corresponding cipher is given by E resp. D (implicitly also the keyspaces K or

′

resp. κ). In the following we use the terms cryptosystem and cipher synonymously to each

other.

There are two main categories of ciphers in terms of key handling: If κ is feasible then K and

′

need to be kept secret and the cipher is called symmetric. Otherwise the cipher is called

asymmetric. We also call a cryptosystem symmetric resp. asymmetric if its corresponding cipher

is symmetric resp. asymmetric. An asymmetric cryptosystem is also called a public key cryp-

tosystem as K can be made public without weakening the secrecy of the “private” key set K

′

for

decryption. The elements of K are then called public keys, those of K

′

are called private keys.

□

Some authors also write cypher, in German it stands for Chiffre.

2.3. INVESTIGATING SECURITY MODELS

Remark 2.21. Implementations of symmetric cryptosystems are more efﬁcient than those of asym-

metric cryptosystems. Thus, asymmetric ciphers are in general only used for exchanging the needed

private keys in order to start a secure communication via a symmetric cipher. □

Example 2.22. Both, Ceasar’s and Vigenère’s cryptosystem, are symmetric ones as encryption by

the key k is decrypted with the key −k. □

In the early days of cryptography the systems resp. ciphers were kept secret.

Doing so is no longer

possible nowadays and also has the disadvantage that no research on the security of a cryptosystem

kept secret can be done. Thus, the following principle is widely accepted in cryptology:

Principle 2.23 (Kerckhoff, 1883). The cryptographic strength of a cryptosystem should not depend

on the secrecy of the cryptosystem, but only on the secrecy of the decryption key. □

In other words: The attacker always knows the cryptosystem.

2.3 Investigating Security Models

Deﬁnition 2.24. For a given cryptosystem Π we deﬁne the following security properties:

1. Π has onewayness (OW) if it is infeasbile for an attacker to decrypt an arbitrary ciphertext.

2. Π has indistinguishability (IND) if it is infeasible for an attacker to associate a given cipher-

text to one of several known plaintexts.

3. Π has non-malleability (NM) if it is infeasible for an attacker to modify a given ciphertext in

a way such that the corresponding plain text is sensible in the given language resp. context.

□

Remark 2.25. It is known that NM ⇒ IND ⇒ OW. □

Deﬁnition 2.26.

1. An active attack on a cryptosystem is one in which the attacker actively changes the com-

munication by, for example, creating, altering, replacing or blocking messages.

2. A passive attack on a cryptosystem is one in which the attacker only eavesdrops plaintexts

and ciphertexts. In contrast to an active attack the attacker cannot alter any messages she/he

sees.

□

In this lecture we are mostly interested in passive attacks. Some attack scenarios we might consider

are presented in the following:

Deﬁnition 2.27.

1. The attacker receives only ciphertexts: ciphertext-only attack (COA).

Security by obscurity.

CHAPTER 3. MODES OF CIPHERS

with 3! elements. Now we could, for example, encrypt the plaintext (v

, v

) = (1, 0, 1) ∈ Σ

via

π = (1 2 3): E

((1,0,1)) = (v

, v

) = (0, 1, 1). □

For a symmetric block cipher one can increase the level of security to multiple applications of the

the cipher:

Remark 3.4. Let E and D represent a symmetric block cipher of block size n, w.l.o.g. we assume

′

= K . An easy way to increase its security is to apply the so-called triple encryption: Take

three keys k

, k

∈ K . Then one can encrypt a plaintext p ∈ P via



(p)



=: c ∈ C.

There are three different settings for the keys:

1. If k

= k

the above encryption is equivalent to E

(p).

2. If k

= k

and k

is different, then the key size is doubled to 2 · n.

3. If all three keys are different the key size tripled to 3 · n.

So why not applying 100 keys to increase security? The problem is the increasing time for encryp-

tion and decryption that makes it no longer practical at some point.

Clearly, if the encryption functions itself would generate a (small) group then applying the en-

cryption resp. decryption several times would not give any advantage in terms of security. For

example, take the data encryption standard (DES) encryption function (cf. Section 6.2): It has

encryption functions, for each 56 bit key one. Still, we have





possible permutations.

It is shown by Campell and Wiener that the set of DES encryption functions is not closed under

composition, i.e., they do not build a group. In other words, there exist keys k

and k

such that

DES

◦ DES

= DES

for all keys k. It follows that the number of permutations of the form

DES

◦DES

is much larger than the number of permutations of type DES

. □

Until now we always considered that our plaintexts have the same size as the key. Clearly, in gen-

eral, one wants to encrypt longer documents or texts. For this problem there are several different

modes one can apply block ciphers.

3.2 Modes of Block Ciphers

Let us assume in this section that Σ = Z/2Z, block size is n ∈ N

and the key spaces K

′

= K are

the same. We switch between representations of plaintexts: For example let n = 3, then we can

identify all natural numbers between 0 and 7. So we can represent 0 binary as 000 or (0, 0, 0) ∈

(Z/2Z)

, or 5 as 101 or (1,0, 1).

We further assume that there is some magic that randomly resp. pseudo randomly and uniformly

distributed chooses a key k ∈ K .

The idea of applying three different keys and not only two comes from the so-called meet-in-the-middle attacks

which allows attacking two key encryptions with nearly the same runtime as one key encryption (but with a bigger space

complexity.

More on randomness later, here we keep it simple and out of our way.

剩余144页未读，继续阅读

fishmonger

粉丝: 1
资源: 12

密码学基础教程：第二版

An Introduction to Statistical Inference and Data Analysis

An Introduction to Mathematical Optimal Control Theory-Notes v2.0.pdf

密码学介绍 An Introduction to Cryptography

An Introduction To Cryptography

An Introduction to Cryptography 2nd Edition

Privacy and Authentication An introduction to cryptography

An Introduction to Cryptography - 2nd Edition - 2007

An Introduction to Number Theory with Cryptography

SUMS47 Codes An Introduction to Information Communication and Cryptography.zip

An Introduction to Number Theory with Cryptography(2nd) 无水印原版pdf

最新资源