10.1. Problems
The use of a cipher without consideration of the environment in which it is to be used may not provide the security that the user expects. Three examples will make this point clear.
10.1.1. Precomputing the Possible Messages
Simmons discusses the use of a "forward search" to decipher messages enciphered for confidentiality using a public key cryptosystem [830]. His approach is to focus on the entropy (uncertainty) in the message. To use an example from Section 9.1 (page 124), Cathy knows that Alice will send one of two messagesBUY or SELLto Bob. The uncertainty is which one Alice will send. So Cathy enciphers both messages with Bob's public key. When Alice sends the message, Cathy intercepts it and compares the ciphertext with the two he computed. From this, she knows which message Alice sent.
Simmons' point is that if the plaintext corresponding to intercepted ciphertext is drawn from a (relatively) small set of possible plaintexts, the cryptanalyst can encipher the set of possible plaintexts and simply search that set for the intercepted ciphertext. Simmons demonstrates that the size of the set of possible plaintexts may not be obvious. As an example, he uses digitized sound. The initial calculations suggest that the number of possible plaintexts for each block is 232. Using forward search on such a set is clearly impractical, but after some analysis of the redundancy in human speech, Simmons reduces the number of potential plaintexts to about 100,000. This number is small enough so that forward searches become a threat.
This attack is similar to attacks to derive the cryptographic key of symmetric ciphers based on chosen plaintext (see, for example, Hellman's time-memory tradeoff attack [416]). However, Simmons' attack is for public key cryptosystems and does not reveal the private key. It only reveals the plaintext message.
10.1.2. Misordered Blocks
Denning [242] points out that in certain cases, parts of a ciphertext message can be deleted, replayed, or reordered.
|
EXAMPLE:
Consider RSA. As in the example on page 114, take p = 7 and q = 11. Then n = 77 and f(n) = 60. Bob chooses e = 17, so his private key d = 53. In this cryptosystem, each plaintext character is represented by a number from 00 (A) to 25 (Z), and 26 represents a blank.
Alice wants to send Bob the message LIVE (11 08 21 04). She enciphers this message using his public key, obtaining 44 57 21 16, and sends the message. Cathy intercepts it and rearranges the ciphertext: 16 21 57 44. When Bob receives it, he deciphers the message and obtains EVIL.
Even if Alice digitally signed each part, Bob could not detect this attack. The problem is that the parts are not bound to one another. Because each part is independent, there is no way to tell when one part is replaced or added, or when parts are rearranged.
One solution is to generate a cryptographic checksum of the entire message (see Section 8.4) and sign that value. |
10.1.3. Statistical Regularities
The independence of parts of ciphertext can give information relating to the structure of the enciphered message, even if the message itself is unintelligible. The regularity arises because each part is enciphered separately, so the same plaintext always produces the same ciphertext. This type of encipherment is called code book mode, because each part is effectively looked up in a list of plaintext-ciphertext pairs.
10.1.4. Summary
Despite the use of sophisticated cryptosystems and random keys, cipher systems may provide inadequate security if not used carefully. The protocols directing how these cipher systems are used, and the ancillary information that the protocols add to messages and sessions, overcome these problems. This emphasizes that ciphers and codes are not enough. The methods, or protocols, for their use also affect the security of systems.
 |
