|
|
1 | (44) |
|
1.1 Introduction: Some Simple Cryptosystems |
|
|
1 | (25) |
|
|
3 | (4) |
|
1.1.2 The Substitution Cipher |
|
|
7 | (1) |
|
|
8 | (4) |
|
1.1.4 The Vigenère Cipher |
|
|
12 | (1) |
|
|
13 | (6) |
|
1.1.6 The Permutation Cipher |
|
|
19 | (2) |
|
|
21 | (5) |
|
|
26 | (13) |
|
1.2.1 Cryptanalysis of the Affine Cipher |
|
|
27 | (2) |
|
1.2.2 Cryptanalysis of the Substitution Cipher |
|
|
29 | (3) |
|
1.2.3 Cryptanalysis of the Vigenère Cipher |
|
|
32 | (4) |
|
1.2.4 Cryptanalysis of the Hill Cipher |
|
|
36 | (1) |
|
1.2.5 Cryptanalysis of the LFSR Stream Cipher |
|
|
37 | (2) |
|
|
39 | (1) |
|
|
39 | (6) |
|
|
45 | (28) |
|
|
45 | (1) |
|
2.2 Elementary Probability Theory |
|
|
46 | (2) |
|
|
48 | (6) |
|
|
54 | (5) |
|
|
56 | (3) |
|
2.5 Properties of Entropy |
|
|
59 | (3) |
|
2.6 Spurious Keys and Unicity Distance |
|
|
62 | (5) |
|
2.7 Product Cryptosystems |
|
|
67 | (3) |
|
|
70 | (1) |
|
|
70 | (3) |
|
3 Block Ciphers and the Advanced Encryption Standard |
|
|
73 | (46) |
|
|
73 | (1) |
|
3.2 Substitution-Permutation Networks |
|
|
74 | (5) |
|
|
79 | (10) |
|
3.3.1 The Piling-up Lemma |
|
|
80 | (2) |
|
3.3.2 Linear Approximations of S-boxes |
|
|
82 | (2) |
|
3.3.3 A Linear Attack on an SPN |
|
|
84 | (5) |
|
3.4 Differential Cryptanalysis |
|
|
89 | (6) |
|
3.5 The Data Encryption Standard |
|
|
95 | (7) |
|
|
95 | (5) |
|
|
100 | (2) |
|
3.6 The Advanced Encryption Standard |
|
|
102 | (7) |
|
|
103 | (5) |
|
|
108 | (1) |
|
|
109 | (4) |
|
|
113 | (1) |
|
|
114 | (5) |
|
4 Cryptographic Hash Functions |
|
|
119 | (42) |
|
4.1 Hash Functions and Data Integrity |
|
|
119 | (2) |
|
4.2 Security of Hash Functions |
|
|
121 | (8) |
|
4.2.1 The Random Oracle Model |
|
|
122 | (1) |
|
4.2.2 Algorithms in the Random Oracle Model |
|
|
123 | (4) |
|
4.2.3 Comparison of Security Criteria |
|
|
127 | (2) |
|
4.3 Iterated Hash Functions |
|
|
129 | (11) |
|
4.3.1 The Merkle-Damgård Construction |
|
|
131 | (6) |
|
4.3.2 The Secure Hash Algorithm |
|
|
137 | (3) |
|
4.4 Message Authentication Codes |
|
|
140 | (5) |
|
4.4.1 Nested MACs and HMAC |
|
|
141 | (3) |
|
4.4.2 CBC-MAC and Authenticated Encryption |
|
|
144 | (1) |
|
4.5 Unconditionally Secure MACs |
|
|
145 | (8) |
|
4.5.1 Strongly Universal Hash Families |
|
|
148 | (3) |
|
4.5.2 Optimality of Deception Probabilities |
|
|
151 | (2) |
|
|
153 | (2) |
|
|
155 | (6) |
|
5 The RSA Cryptosystem and Factoring Integers |
|
|
161 | (72) |
|
5.1 Introduction to Public-key Cryptography |
|
|
161 | (2) |
|
|
163 | (10) |
|
5.2.1 The Euclidean Algorithm |
|
|
163 | (4) |
|
5.2.2 The Chinese Remainder Theorem |
|
|
167 | (3) |
|
|
170 | (3) |
|
|
173 | (5) |
|
|
174 | (4) |
|
|
178 | (9) |
|
5.4.1 Legendre and Jacobi Symbols |
|
|
179 | (3) |
|
5.4.2 The Solovay-Strassen Algorithm |
|
|
182 | (4) |
|
5.4.3 The Miller-Rabin Algorithm |
|
|
186 | (1) |
|
5.5 Square Roots Modulo n |
|
|
187 | (2) |
|
|
189 | (12) |
|
5.6.1 The Pollard p — 1 Algorithm |
|
|
189 | (2) |
|
5.6.2 The Pollard Rho Algorithm |
|
|
191 | (3) |
|
5.6.3 Dixon's Random Squares Algorithm |
|
|
194 | (5) |
|
5.6.4 Factoring Algorithms in Practice |
|
|
199 | (2) |
|
|
201 | (10) |
|
|
201 | (1) |
|
5.7.2 The Decryption Exponent |
|
|
202 | (5) |
|
5.7.3 Wiener's Low Decryption Exponent Attack |
|
|
207 | (4) |
|
5.8 The Rabin Cryptosystem |
|
|
211 | (4) |
|
5.8.1 Security of the Rabin Cryptosystem |
|
|
213 | (2) |
|
5.9 Semantic Security of RSA |
|
|
215 | (10) |
|
5.9.1 Partial Information Concerning Plaintext Bits |
|
|
215 | (3) |
|
5.9.2 Optimal Asymmetric Encryption Padding |
|
|
218 | (7) |
|
5.10 Notes and References |
|
|
225 | (1) |
|
|
226 | (7) |
|
6 Public-key Cryptography and Discrete Logarithms |
|
|
233 | (48) |
|
6.1 The ElGamal Cryptosystem |
|
|
233 | (3) |
|
6.2 Algorithms for the Discrete Logarithm Problem |
|
|
236 | (10) |
|
|
236 | (2) |
|
6.2.2 The Pollard Rho Discrete Logarithm Algorithm |
|
|
238 | (3) |
|
6.2.3 The Pohlig-Hellman Algorithm |
|
|
241 | (3) |
|
6.2.4 The Index Calculus Method |
|
|
244 | (2) |
|
6.3 Lower Bounds on the Complexity of Generic Algorithms |
|
|
246 | (4) |
|
|
250 | (4) |
|
|
254 | (13) |
|
6.5.1 Elliptic Curves over the Reals |
|
|
255 | (2) |
|
6.5.2 Elliptic Curves Modulo a Prime |
|
|
257 | (4) |
|
6.5.3 Properties of Elliptic Curves |
|
|
261 | (1) |
|
6.5.4 Point Compression and the ECIES |
|
|
262 | (3) |
|
6.5.5 Computing Point Multiples on Elliptic Curves |
|
|
265 | (2) |
|
6.6 Discrete Logarithm Algorithms in Practice |
|
|
267 | (1) |
|
6.7 Security of ElGamal Systems |
|
|
268 | (6) |
|
6.7.1 Bit Security of Discrete Logarithms |
|
|
268 | (4) |
|
6.7.2 Semantic Security of ElGamal Systems |
|
|
272 | (1) |
|
6.7.3 The DM-le-Hellman Problems |
|
|
273 | (1) |
|
|
274 | (1) |
|
|
275 | (6) |
|
|
281 | (42) |
|
|
281 | (3) |
|
7.2 Security Requirements for Signature Schemes |
|
|
284 | (3) |
|
7.2.1 Signatures and Hash Functions |
|
|
286 | (1) |
|
7.3 The ElGamal Signature Scheme |
|
|
287 | (5) |
|
7.3.1 Security of the ElGamal Signature Scheme |
|
|
289 | (3) |
|
7.4 Variants of the ElGamal Signature Scheme |
|
|
292 | (7) |
|
7.4.1 The Schnorr Signature Scheme |
|
|
293 | (1) |
|
7.4.2 The Digital Signature Algorithm |
|
|
294 | (3) |
|
7.4.3 The Elliptic Curve DSA |
|
|
297 | (2) |
|
7.5 Provably Secure Signature Schemes |
|
|
299 | (8) |
|
7.5.1 One-time Signatures |
|
|
299 | (5) |
|
|
304 | (3) |
|
7.6 Undeniable Signatures |
|
|
307 | (6) |
|
|
313 | (4) |
|
|
317 | (1) |
|
|
318 | (5) |
|
8 Pseudo-random Number Generation |
|
|
323 | (30) |
|
8.1 Introduction and Examples |
|
|
323 | (4) |
|
8.2 Indistinguishability of Probability Distributions |
|
|
327 | (9) |
|
8.2.1 Next Bit Predictors |
|
|
330 | (6) |
|
8.3 The Blum-Blum-Shub Generator |
|
|
336 | (8) |
|
8.3.1 Security of the BBS Generator |
|
|
339 | (5) |
|
8.4 Probabilistic Encryption |
|
|
344 | (5) |
|
|
349 | (1) |
|
|
350 | (3) |
|
9 Identification Schemes and Entity Authentication |
|
|
353 | (40) |
|
|
353 | (3) |
|
9.2 Challenge-and-Response in the Secret-key Setting |
|
|
356 | (11) |
|
9.2.1 Attack Model and Adversarial Goals |
|
|
361 | (2) |
|
9.2.2 Mutual Authentication |
|
|
363 | (4) |
|
9.3 Challenge-and-Response in the Public-key Setting |
|
|
367 | (4) |
|
|
367 | (1) |
|
9.3.2 Public-key Identification Schemes |
|
|
368 | (3) |
|
9.4 The Schnorr Identification Scheme |
|
|
371 | (7) |
|
9.4.1 Security of the Schnorr Identification Scheme |
|
|
374 | (4) |
|
9.5 The Okamoto Identification Scheme |
|
|
378 | (5) |
|
9.6 The Guillou-Quisquater Identification Scheme |
|
|
383 | (4) |
|
9.6.1 Identity-based Identification Schemes |
|
|
386 | (1) |
|
|
387 | (1) |
|
|
388 | (5) |
10 Key Distribution |
|
393 | (36) |
|
|
393 | (4) |
|
10.2 Diffie-Hellman Key Predistribution |
|
|
397 | (2) |
|
10.3 Unconditionally Secure Key Predistribution |
|
|
399 | (7) |
|
10.3.1 The Blom Key Predistribution Scheme |
|
|
399 | (7) |
|
10.4 Key Distribution Patterns |
|
|
406 | (8) |
|
10.4.1 Fiat-Naor Key Distribution Patterns |
|
|
409 | (1) |
|
10.4.2 Mitchell-Piper Key Distribution Patterns |
|
|
410 | (4) |
|
10.5 Session Key Distribution Schemes |
|
|
414 | (10) |
|
10.5.1 The Needham-Schroeder Scheme |
|
|
415 | (1) |
|
10.5.2 The Denning-Sacco Attack on the NS Scheme |
|
|
416 | (1) |
|
|
417 | (4) |
|
10.5.4 The Bellare-Rogaway Scheme |
|
|
421 | (3) |
|
10.6 Notes and References |
|
|
424 | (1) |
|
|
424 | (5) |
11 Key Agreement Schemes |
|
429 | (28) |
|
|
429 | (1) |
|
11.2 Diffie-Hellman Key Agreement |
|
|
429 | (9) |
|
11.2.1 The Station-to-station Key Agreement Scheme |
|
|
431 | (1) |
|
|
432 | (4) |
|
11.2.3 Known Session Key Attacks |
|
|
436 | (2) |
|
11.3 MTI Key Agreement Schemes |
|
|
438 | (6) |
|
11.3.1 Known Session Key Attacks on MTI/A0 |
|
|
441 | (3) |
|
11.4 Key Agreement Using Self-certifying Keys |
|
|
444 | (4) |
|
11.5 Encrypted Key Exchange |
|
|
448 | (2) |
|
11.6 Conference Key Agreement Schemes |
|
|
450 | (3) |
|
11.7 Notes and References |
|
|
453 | (2) |
|
|
455 | (2) |
12 Public-key Infrastructure |
|
457 | (24) |
|
12.1 Introduction: What is a PKI |
|
|
457 | (4) |
|
12.1.1 A Practical Protocol: Secure Socket Layer |
|
|
459 | (2) |
|
|
461 | (3) |
|
12.2.1 Certificate Life-cycle Management |
|
|
463 | (1) |
|
|
464 | (7) |
|
12.3.1 Strict Hierarchy Model |
|
|
464 | (2) |
|
|
466 | (1) |
|
12.3.3 The Web Browser Model |
|
|
467 | (1) |
|
12.3.4 Pretty Good Privacy |
|
|
468 | (3) |
|
|
471 | (1) |
|
12.4.1 Alternatives to PKI |
|
|
471 | (1) |
|
12.5 Identity-based Cryptography |
|
|
472 | (7) |
|
12.5.1 The Cocks Identity-based Encryption Scheme |
|
|
473 | (6) |
|
12.6 Notes and References |
|
|
479 | (1) |
|
|
480 | (1) |
13 Secret Sharing Schemes |
|
481 | (36) |
|
13.1 Introduction: The Shamir Threshold Scheme |
|
|
481 | (5) |
|
13.1.1 A Simplified (t, t) -threshold Scheme |
|
|
485 | (1) |
|
13.2 Access Structures and General Secret Sharing |
|
|
486 | (10) |
|
13.2.1 The Monotone Circuit Construction |
|
|
488 | (5) |
|
13.2.2 Formal Definitions |
|
|
493 | (3) |
|
13.3 Information Rate and Construction of Efficient Schemes |
|
|
496 | (17) |
|
13.3.1 The Vector Space Construction |
|
|
498 | (7) |
|
13.3.2 An Upper Bound on the Information Rate |
|
|
505 | (4) |
|
13.3.3 The Decomposition Construction |
|
|
509 | (4) |
|
13.4 Notes and References |
|
|
513 | (1) |
|
|
514 | (3) |
14 Multicast Security and Copyright Protection |
|
517 | (40) |
|
14.1 Introduction to Multicast Security |
|
|
517 | (1) |
|
14.2 Broadcast Encryption |
|
|
518 | (13) |
|
14.2.1 An Improvement using Ramp Schemes |
|
|
528 | (3) |
|
|
531 | (8) |
|
14.3.1 The Blacklisting Scheme |
|
|
533 | (1) |
|
14.3.2 The Naor-Pinkas Re-keying Scheme |
|
|
534 | (3) |
|
14.3.3 Logical Key Hierarchy |
|
|
537 | (2) |
|
14.4 Copyright Protection |
|
|
539 | (9) |
|
|
540 | (2) |
|
14.4.2 Identifiable Parent Property |
|
|
542 | (2) |
|
|
544 | (4) |
|
14.5 Tracing Illegally Redistributed Keys |
|
|
548 | (4) |
|
14.6 Notes and References |
|
|
552 | (1) |
|
|
552 | (5) |
Further Reading |
|
557 | (4) |
Bibliography |
|
561 | (22) |
Index |
|
583 | |