Chapter 1 Introduction

1.1 Opinions, Products

1.2 Roadmap to the Book

1.3 Terminology

1.4 Notation

1.5 Cryptographically Protected Sessions

1.6 Active and Passive Attacks

1.7 Legal Issues

    1.7.1 Patents

    1.7.2 Government Regulations

1.8 Some Network Basics

    1.8.1 Network Layers

    1.8.2 TCP and UDP Ports

    1.8.3 DNS (Domain Name System)

    1.8.4 HTTP and URLs

    1.8.5 Web Cookies

1.9 Names for Humans

1.10 Authentication and Authorization

    1.10.1 ACL (Access Control List)

    1.10.2 Central Administration/Capabilities

    1.10.3 Groups

    1.10.4 Cross-Organizational and Nested Groups

    1.10.5 Roles

1.11 Malware: Viruses, Worms, Trojan Horses

    1.11.1 Where Does Malware Come From?

    1.11.2 Virus Checkers

1.12 Security Gateway

    1.12.1 Firewall

    1.12.2 Application-Level Gateway/Proxy

    1.12.3 Secure Tunnels

    1.12.4 Why Firewalls Don't Work

1.13 Denial-of-Service (DoS) Attacks

1.14 NAT (Network Address Translation)

    1.14.1 Summary

Chapter 2 Introduction to Cryptography

2.1 Introduction

    2.1.1 The Fundamental Tenet of Cryptography

    2.1.2 Keys

    2.1.3 Computational Difficulty

    2.1.4 To Publish or Not to Publish

    2.1.5 Earliest Encryption

    2.1.6 One-Time Pad (OTP)

2.2 Secret Key Cryptography

    2.2.1 Transmitting Over an Insecure Channel

    2.2.2 Secure Storage on Insecure Media

    2.2.3 Authentication

    2.2.4 Integrity Check

2.3 Public Key Cryptography

    2.3.1 Transmitting Over an Insecure Channel

    2.3.2 Secure Storage on Insecure Media

    2.3.3 Authentication

    2.3.4 Digital Signatures

2.4 Hash Algorithms

    2.4.1 Password Hashing

    2.4.2 Message Integrity

    2.4.3 Message Fingerprint

    2.4.4 Efficient Digital Signatures

2.5 Breaking an Encryption Scheme

    2.5.1 Ciphertext Only

    2.5.2 Known Plaintext

    2.5.3 Chosen Plaintext

    2.5.4 Chosen Ciphertext

    2.5.5 Side-Channel Attacks

2.6 Random Numbers

    2.6.1 Gathering Entropy

    2.6.2 Generating Random Seeds

    2.6.3 Calculating a Pseudorandom Stream from the Seed

    2.6.4 Periodic Reseeding

    2.6.5 Types of Random Numbers

    2.6.6 Noteworthy Mistakes

2.7 Numbers

    2.7.1 Finite Fields

    2.7.2 Exponentiation

    2.7.3 Avoiding a Side-Channel Attack

    2.7.4 Types of Elements used in Cryptography

    2.7.5 Euclidean Algorithm

    2.7.6 Chinese Remainder Theorem

2.8 Homework

Chapter 3 Secret Key Cryptography

3.1 Introduction

3.2 Generic Block Cipher Issues

    3.2.1 Blocksize, Keysize

    3.2.2 Completely General Mapping

    3.2.3 Looking Random

3.3 Constructing a Practical Block Cipher

    3.3.1 Per-Round Keys

    3.3.2 S-boxes and Bit Shuffles

    3.3.3 Feistel Ciphers

3.4 Choosing Constants

3.5 Data Encryption Standard (DES)

    3.5.1 DES Overview

    3.5.2 The Mangler Function

    3.5.3 Undesirable Symmetries

    3.5.4 What's So Special About DES?

3.6 3DES (Multiple Encryption DES)

    3.6.1 How Many Encryptions?

    3.6.1.1 Encrypting Twice with the Same Key

    3.6.1.2 Encrypting Twice with Two Keys

    3.6.1.3 Triple Encryption with Only Two Keys

3.6.2 Why EDE Rather Than EEE?

3.7 Advanced Encryption Standard (AES)

    3.7.1 Origins of AES

    3.7.2 Broad Overview

    3.7.3 AES Overview

    3.7.4 Key Expansion

    3.7.5 Inverse Rounds

    3.7.6 Software Implementations of AES

3.8 RC4

3.9 Homework

Chapter 4 Modes of Operation

4.1 Introduction

4.2 Encrypting a Large Message

    4.2.1 ECB (Electronic Code Book)

    4.2.2 CBC (Cipher Block Chaining)

        4.2.2.1 Randomized ECB

        4.2.2.2 CBC

        4.2.2.3 CBC Threat—Modifying Ciphertext Blocks

    4.2.3 CTR (Counter Mode)

        4.2.3.1 Choosing IVs for CTR Mode

    4.2.4 XEX (XOR Encrypt XOR)

    4.2.5 XTS (XEX with Ciphertext Stealing)

4.3 Generating MACs

    4.3.1 CBC-MAC

        4.3.1.1 CBC Forgery Attack

    4.3.2 CMAC

    4.3.3 GMAC

        4.3.3.1 GHASH

        4.3.3.2 Transforming GHASH into GMAC

4.4 Ensuring Privacy and Integrity Together

    4.4.1 CCM (Counter with CBC-MAC)

    4.4.2 GCM (Galois/Counter Mode)

4.5 Performance Issues

4.6 Homework

Chapter 5 Cryptographic Hashes

5.1 Introduction

5.2 The Birthday Problem

5.3 A Brief History of Hash Functions

5.4 Nifty Things to Do with a Hash

    5.4.1 Digital Signatures

    5.4.2 Password Database

    5.4.3 Secure Shorthand of Larger Piece of Data

    5.4.4 Hash Chains

    5.4.5 Blockchain

    5.4.6 Puzzles

    5.4.7 Bit Commitment

    5.4.8 Hash Trees

    5.4.9 Authentication

    5.4.10 Computing a MAC with a Hash

    5.4.11 HMAC

    5.4.12 Encryption with a Secret and a Hash Algorithm

5.5 Creating a Hash Using a Block Cipher

5.6 Construction of Hash Functions

    5.6.1 Construction of MD4, MD5, SHA-1 and SHA-2

    5.6.2 Construction of SHA-3

5.7 Padding

    5.7.1 MD4, MD5, SHA-1, and SHA2-256 Message Padding

    5.7.2 SHA-3 Padding Rule

5.8 The Internal Encryption Algorithms

    5.8.1 SHA-1 Internal Encryption Algorithm

    5.8.2 SHA-2 Internal Encryption Algorithm

5.9 SHA-3 f Function (Also Known as KECCAK-f)

5.10 Homework

Chapter 6 First-Generation Public Key Algorithms

6.1 Introduction

6.2 Modular Arithmetic

    6.2.1 Modular Addition

    6.2.2 Modular Multiplication

    6.2.3 Modular Exponentiation

    6.2.4 Fermat's Theorem and Euler's Theorem

6.3 RSA

    6.3.1 RSA Algorithm

    6.3.2 Why Does RSA Work?

    6.3.3 Why Is RSA Secure?

    6.3.4 How Efficient Are the RSA Operations?

        6.3.4.1 Exponentiating with Big Numbers

        6.3.4.2 Generating RSA Keys

        6.3.4.3 Why a Non-Prime Has Multiple Square Roots of One

        6.3.4.4 Having a Small Constant e

        6.3.4.5 Optimizing RSA Private Key Operations

    6.3.5 Arcane RSA Threats

        6.3.5.1 Smooth Numbers

        6.3.5.2 The Cube Root Problem

    6.3.6 Public-Key Cryptography Standard (PKCS)

        6.3.6.1 Encryption

        6.3.6.2 The Million-Message Attack

        6.3.6.3 Signing

6.4 Diffie-Hellman

    6.4.1 MITM (Meddler-in-the-Middle) Attack

    6.4.2 Defenses Against MITM Attack

    6.4.3 Safe Primes and the Small-Subgroup Attack

    6.4.4 ElGamal Signatures

6.5 Digital Signature Algorithm (DSA)

    6.5.1 The DSA Algorithm

    6.5.2 Why Is This Secure?

    6.5.3 Per-Message Secret Number

6.6 How Secure Are RSA and Diffie-Hellman?

6.7 Elliptic Curve Cryptography (ECC)

    6.7.1 Elliptic Curve Diffie-Hellman (ECDH)

    6.7.2 Elliptic Curve Digital Signature Algorithm (ECDSA)

6.8 Homework

Chapter 7 Quantum Computing

7.1 What Is a Quantum Computer?

    7.1.1 A Preview of the Conclusions

    7.1.2 First, What Is a Classical Computer?

    7.1.3 Qubits and Superposition

        7.1.3.1 Example of a Qubit

        7.1.3.2 Multi-Qubit States and Entanglement

    7.1.4 States and Gates as Vectors and Matrices

    7.1.5 Becoming Superposed and Entangled

    7.1.6 Linearity

        7.1.6.1 No Cloning Theorem

    7.1.7 Operating on Entangled Qubits

    7.1.8 Unitarity

    7.1.9 Doing Irreversible Operations by Measurement

    7.1.10 Making Irreversible Classical Operations Reversible

    7.1.11 Universal Gate Sets

7.2 Grover's Algorithm

    7.2.1 Geometric Description

    7.2.2 How to Negate the Amplitude of |k⟩

    7.2.3 How to Reflect All the Amplitudes Across the Mean

    7.2.4 Parallelizing Grover's Algorithm

7.3 Shor's Algorithm

    7.3.1 Why Exponentiation mod n Is a Periodic Function

    7.3.2 How Finding the Period of ax mod n Lets You Factor n

    7.3.3 Overview of Shor's Algorithm

    7.3.4 Converting to the Frequency Graph—Introduction

    7.3.5 The Mechanics of Converting to the Frequency Graph

    7.3.6 Calculating the Period

    7.3.7 Quantum Fourier Transform

7.4 Quantum Key Distribution (QKD)

    7.4.1 Why It's Sometimes Called Quantum Encryption

    7.4.2 Is Quantum Key Distribution Important?

7.5 How Hard Are Quantum Computers to Build?

7.6 Quantum Error Correction

7.7 Homework

Chapter 8 Post-Quantum Cryptography

8.1 Signature and/or Encryption Schemes

    8.1.1 NIST Criteria for Security Levels

    8.1.2 Authentication

    8.1.3 Defense Against Dishonest Ciphertext

8.2 Hash-based Signatures

    8.2.1 Simplest Scheme – Signing a Single Bit

    8.2.2 Signing an Arbitrary-sized Message

    8.2.3 Signing Lots of Messages

    8.2.4 Deterministic Tree Generation

    8.2.5 Short Hashes

    8.2.6 Hash Chains

    8.2.7 Standardized Schemes

        8.2.7.1 Stateless Schemes

8.3 Lattice-Based Cryptography

    8.3.1 A Lattice Problem

    8.3.2 Optimization: Matrices with Structure

    8.3.3 NTRU-Encryption Family of Lattice Encryption Schemes

        8.3.3.1 Bob Computes a (Public, Private) Key Pair

        8.3.3.2 How Bob Decrypts to Find m

        8.3.3.3 How Does this Relate to Lattices?

    8.3.4 Lattice-Based Signatures

        8.3.4.1 Basic Idea

        8.3.4.2 Insecure Scheme

        8.3.4.3 Fixing the Scheme

    8.3.5 Learning with Errors (LWE)

        8.3.5.1 LWE Optimizations

        8.3.5.2 LWE-based NIST Submissions

8.4 Code-based Schemes

    8.4.1 Non-cryptographic Error-correcting Codes

        8.4.1.1 Invention Step

        8.4.1.2 Codeword Creation Step

        8.4.1.3 Misfortune Step

        8.4.1.4 Diagnosis Step

    8.4.2 The Parity-Check Matrix

    8.4.3 Cryptographic Public Key Code-based Scheme

        8.4.3.1 Neiderreiter Optimization

        8.4.3.2 Generating a Public Key Pair

        8.4.3.3 Using Circulant Matrices

8.5 Multivariate Cryptography

    8.5.1 Solving Linear Equations

    8.5.2 Quadratic Polynomials

    8.5.3 Polynomial Systems

    8.5.4 Multivariate Signature Systems

        8.5.4.1 Multivariate Public Key Signatures

8.6 Homework

Chapter 9 Authentication of People

9.1 Password-based Authentication

    9.1.1 Challenge-Response Based on Password

    9.1.2 Verifying Passwords

9.2 Address-based Authentication

    9.2.1 Network Address Impersonation

9.3 Biometrics

9.4 Cryptographic Authentication Protocols

9.5 Who Is Being Authenticated?

9.6 Passwords as Cryptographic Keys

9.7 On-Line Password Guessing

9.8 Off-Line Password Guessing

9.9 Using the Same Password in Multiple Places

9.10 Requiring Frequent Password Changes

9.11 Tricking Users into Divulging Passwords

9.12 Lamport's Hash

9.13 Password Managers

9.14 Web Cookies

9.15 Identity Providers (IDPs)

9.16 Authentication Tokens

    9.16.1 Disconnected Tokens

    9.16.2 Public Key Tokens

9.17 Strong Password Protocols

    9.17.1 Subtle Details

    9.17.2 Augmented Strong Password Protocols

    9.17.3 SRP (Secure Remote Password)

9.18 Credentials Download Protocols

9.19 Homework

Chapter 10 Trusted Intermediaries

10.1 Introduction

10.2 Functional Comparison

10.3 Kerberos

    10.3.1 KDC Introduces Alice to Bob

    10.3.2 Alice Contacts Bob

    10.3.3 Ticket Granting Ticket (TGT)

    10.3.4 Interrealm Authentication

    10.3.5 Making Password-Guessing Attacks Difficult

    10.3.6 Double TGT Protocol

    10.3.7 Authorization Information

    10.3.8 Delegation

10.4 PKI

    10.4.1 Some Terminology

    10.4.2 Names in Certificates

10.5 Website Gets a DNS Name and Certificate

10.6 PKI Trust Models

    10.6.1 Monopoly Model

    10.6.2 Monopoly plus Registration Authorities (RAs)

    10.6.3 Delegated CAs

    10.6.4 Oligarchy

    10.6.5 Anarchy Model

    10.6.6 Name Constraints

    10.6.7 Top-Down with Name Constraints

    10.6.8 Multiple CAs for Any Namespace Node

    10.6.9 Bottom-Up with Name Constraints

        10.6.9.1 Functionality of Up-Links

        10.6.9.2 Functionality of Cross-Links

    10.6.10 Name Constraints in PKIX Certificates

10.7 Building Certificate Chains

10.8 Revocation

    10.8.1 CRL (Certificate Revocation list

    10.8.2 Online Certificate Status Protocol (OCSP)

    10.8.3 Good-Lists vs. Bad-Lists

10.9 Other Information in a PKIX Certificate

10.10 Issues with Expired Certificates

10.11 DNSSEC (DNS Security Extensions)

10.12 Homework

Chapter 11 Communication Session Establishment

11.1 One-way Authentication of Alice

    11.1.1 Timestamps vs. Challenges

    11.1.2 One-Way Authentication of Alice using a Public Key

11.2 Mutual Authentication

    11.2.1 Reflection Attack

    11.2.2 Timestamps for Mutual Authentication

11.3 Integrity/Encryption for Data

    11.3.1 Session Key Based on Shared Secret Credentials

    11.3.2 Session Key Based on Public Key Credentials

    11.3.3 Session Key Based on One-Party Public Keys

11.4 Nonce Types

11.5 Intentional MITM

11.6 Detecting MITM

11.7 What Layer?

11.8 Perfect Forward Secrecy

11.9 Preventing Forged Source Addresses

    11.9.1 Allowing Bob to Be Stateless in TCP

    11.9.2 Allowing Bob to Be Stateless in IPsec

11.10 Endpoint Identifier Hiding

11.11 Live Partner Reassurance

11.12 Arranging for Parallel Computation

11.13 Session Resumption/Multiple Sessions

11.14 Plausible Deniability

11.15 Negotiating Crypto Parameters

    11.15.1 Suites vs. à la Carte

    11.15.2 Downgrade Attack

11.16 Homework

Chapter 12 IPsec

12.1 IPsec Security Associations

    12.1.1 Security Association Database

    12.1.2 Security Policy Database

    12.1.3 IKE-SAs and Child-SAs

12.2 IKE (Internet Key Exchange Protocol)

12.3 Creating a Child-SA

12.4 AH and ESP

    12.4.1 ESP Integrity Protection

    12.4.2 Why Protect the IP Header?

    12.4.3 Tunnel, Transport Mode

    12.4.4 IPv4 Header

    12.4.5 IPv6 Header

12.5 AH (Authentication Header)

12.6 ESP (Encapsulating Security Payload)

12.7 Comparison of Encodings

12.8 Homework

Chapter 13 SSL/TLS and SSH

13.1 Using TCP

13.2 StartTLS

13.3 Functions in the TLS Handshake

13.4 TLS 1.2 (and Earlier) Basic Protocol

13.5 TLS 1.3

13.6 Session Resumption

13.7 PKI as Deployed by TLS

13.8 SSH (Secure Shell)

    13.8.1 SSH Authentication

    13.8.2 SSH Port Forwarding

13.9 Homework

Chapter 14 Electronic Mail Security

14.1 Distribution Lists

14.2 Store and Forward

14.3 Disguising Binary as Text

14.4 HTML-Formatted Email

14.5 Attachments

14.6 Non-cryptographic Security Features

    14.6.1 Spam Defenses

14.7 Malicious Links in Email

14.8 Data Loss Prevention (DLP)

14.9 Knowing Bob's Email Address

14.10 Self-Destruct, Do-Not-Forward,

14.11 Preventing Spoofing of From Field

14.12 In-Flight Encryption

14.13 End-to-End Signed and Encrypted Email

14.14 Encryption by a Server

14.15 Message Integrity

14.16 Non-Repudiation

14.17 Plausible Deniability

14.18 Message Flow Confidentiality

14.19 Anonymity

14.20 Homework

Chapter 15 Electronic Money

15.1 ECASH

15.2 Offline eCash

    15.2.1 Practical Attacks

15.3 Bitcoin

    15.3.1 Transactions

    15.3.2 Bitcoin Addresses

    15.3.3 Blockchain

    15.3.4 The Ledger

    15.3.5 Mining

    15.3.6 Blockchain Forks

    15.3.7 Why Is Bitcoin So Energy-Intensive?

    15.3.8 Integrity Checks: Proof of Work vs. Digital Signatures

    15.3.9 Concerns

15.4 Wallets for Electronic Currency

15.5 Homework

Chapter 16 Cryptographic Tricks

16.1 Secret Sharing

16.2 Blind Signature

16.3 Blind Decryption

16.4 Zero-Knowledge Proofs

    16.4.1 Graph Isomorphism ZKP

    16.4.2 Proving Knowledge of a Square Root

    16.4.3 Noninteractive ZKP

16.5 Group Signatures

    16.5.1 Trivial Group Signature Schemes

        16.5.1.1 Single Shared Key

        16.5.1.2 Group Membership Certificate

        16.5.1.3 Multiple Group Membership Certificates

        16.5.1.4 Blindly Signed Multiple Group Membership Certificates

    16.5.2 Ring Signatures

    16.5.3 DAA (Direct Anonymous Attestation)

    16.5.4 EPID (Enhanced Privacy ID)

16.6 Circuit Model

16.7 Secure Multiparty Computation (MPC)

16.8 Fully Homomorphic Encryption (FHE)

    16.8.1 Bootstrapping

    16.8.2 Easy-to-Understand Scheme

16.9 Homework

Chapter 17 Folklore

17.1 Misconceptions

17.2 Perfect Forward Secrecy

17.3 Change Encryption Keys Periodically

17.4 Don't Encrypt without Integrity Protection

17.5 Multiplexing Flows over One Secure Session

    17.5.1 The Splicing Attack

    17.5.2 Service Classes

    17.5.3 Different Cryptographic Algorithms

17.6 Using Different Secret Keys

    17.6.1 For Initiator and Responder in Handshake

    17.6.2 For Encryption and Integrity

    17.6.3 In Each Direction of a Secure Session

17.7 Using Different Public Keys

    17.7.1 Use Different Keys for Different Purposes

    17.7.2 Different Keys for Signing and Encryption

17.8 Establishing Session Keys

    17.8.1 Have Both Sides Contribute to the Master Key

    17.8.2 Don't Let One Side Determine the Key

17.9 Hash in a Constant When Hashing a Password

17.10 HMAC Rather than Simple Keyed Hash

17.11 Key Derivation

17.12 Use of Nonces in Protocols

17.13 Creating an Unpredictable Nonce

17.14 Compression

17.15 Minimal vs. Redundant Designs

17.16 Overestimate the Size of Key

17.17 Hardware Random Number Generators

17.18 Put Checksums at the End of Data

17.19 Forward Compatibility

    17.19.1 Options

    17.19.2 Version Numbers

        17.19.2.1 Version Number Field Must Not Move

        17.19.2.2 Negotiating Highest Version Supported

        17.19.2.3 Minor Version Number Field

Glossary

Math

M.1 Introduction

M.2 Some definitions and notation

M.3 Arithmetic

M.4 Abstract Algebra

M.5 Modular Arithmetic

    M.5.1 How Do Computers Do Arithmetic?

    M.5.2 Computing Inverses in Modular Arithmetic

        M.5.2.1 The Euclidean Algorithm

        M.5.2.2 The Chinese Remainder Theorem

    M.5.3 How Fast Can We Do Arithmetic?

M.6 Groups

M.7 Fields

    M.7.1 Polynomials

    M.7.2 Finite Fields

        M.7.2.1 What Sizes Can Finite Fields Be?

        M.7.2.2 Representing a Field

M.8 Mathematics of Rijndael

    M.8.1 A Rijndael Round

M.9 Elliptic Curve Cryptography

M.10 Rings

M.11 Linear Transformations

M.12 Matrix Arithmetic

    M.12.1 Permutations

    M.12.2 Matrix Inverses

        M.12.2.1 Gaussian Elimination

M.13 Determinants

    M.13.1 Properties of Determinants

        M.13.1.1 Adjugate of a Matrix

    M.13.2 Proof: Determinant of Product is Product of Determinants

M.14 Homework

Bibliography

9780136643609   TOC    8/2/2022