You are on page 1of 42




People can eavesdrop, intercept, relay, modify, forge or

inject messages.

Try to fool the targeted receivers that the messages are sent by the
real person.
In vulnerable connection, to depend only on cryptography
mechanisms are inadequate.

We need a mechanism which can enable receiver to verify

that a message indeed come from the claimed source and
has not been altered.
Data integrity is the security service against unauthorized
modification of messages.
Data integrity in modern cryptography is closely related to,
and evolves from error-detection code.
The error-detection code is a procedure for detecting
errors which can be introduced into messages due to fault
in communications.

Using information which has been modified in a malicious way is

at the same risk as using information which contains defects due
to errors introduce in communication or data processing.
Data integrity and error-detection codes are essentially the same.
A transmitter of a message creates a checking value by
encoding some redundancy into the message to be transmitted
and attaches the checking value to the message. A receiver of the
message then verifies the correctness of the message received
using the attached checking value according to a set of rules
agreed with the transmitter.
In Error-detection code: The redundancy is encoded in such a way
that the receiver can use a maximum likelihood detector to
decide which message he should infer as having most likely been
transmitted from the possibly altered codes that were received.
In Data integrity: The redundancy is encoded in such a way that
the attached checking value will be distributed as uniform as
possible to the entire message space of the checking values to
minimize the probability for an attacker to forge a valid checking.


an encryption algorithm, the

cryptographic transformations for achieving
data integrity should also be parameterized
by keys.
Thus, in the usual sense, a correct dataintegrity verification result will also provide
the verifier with the knowledge of the
message source, that is, the principal who had
created the data integrity protection.
However, recently a notion of "data integrity
without source identification" has emerged.
This new notion is important in the study of
public key cryptosystems secure against
adaptive attackers.

A digital signature or digital signature scheme is a mathematical

scheme for demonstrating the authenticity of a digital message
or document.
A valid digital signature gives a recipient reason to believe that
the message was created by a known sender, and that it was not
altered in transit.
Commonly used for software distribution, financial transactions,
and in other cases where it is important to detect forgery or
A digital signature scheme typically consists of three algorithms:

A key generation algorithm that selects a private key uniformly at random

from a set of possible private keys. The algorithm outputs the private key
and a corresponding public key.
A signing algorithm that, given a message and a private key, produces a
A signature verifying algorithm that, given a message, public key and a
signature, either accepts or rejects the message's claim to authenticity.




a multipurpose document developed to be

used primarily over the internet and its used in
either identification or encryption.

Identification :
Proves identity (verifies the sender of the information).
Grant the right to access information or other services online.
Includes insuring the identity of all parties involved in a transaction.

Used in secure web transactions.
Contain the key used to encrypt the data.


the person later deny that he or she send it.

Digital signature has two types Assymetric and Symmetric.

A conventional digital signature uses asymmetric
cryptography to create a tamper-evident seal which enables
determining through a simple test whether data has been
altered since the signature was applied, and also the identity
of the private key that was used to encrypt the signature.
More recently, digital signatures are being created with
symmetric cryptography based upon a key that is derived
from the identity of the user and is known only to a trusted
server that both creates and verifies the signatures and
generates proof of signature certificates when queried to
verify a signature.
Such symmetric digital signatures share a syntax similar to Message
Authentication Codes ("MAC's")
Symmetric digital signatures have additional advantages over
asymmetric digital signatures of being less processer-intensive than
asymmetric digital signatures and thus are more efficient and cheaper
to maintain.

Elgamal signature

ElGalmal is a digital signature scheme which is based on the difficulty of

computing discrete logarithms.

Described by Taher ElGamal in 1984

Not to be confused with ElGamal encryption which was also invented by

Taher ElGamal.

The ElGamal signature scheme allows a third-party to confirm the

authenticity of a message sent over an insecure channel.

Attacks on ElGamal is discovered by Bleichenbacher in 1996.

There are a number of ElGamal-like signature schemes. They are

different in details, but have the same basic idea.

Trapdoor one-way function

A trapdoor function is a function that is easy to compute in one
direction, yet believed to be difficult to compute in the opposite
direction (finding its inverse) without special information, called
the "trapdoor". Examples: RSA and Rabin
Trapdoor functions are widely used in cryptography.

Signcryption is a public-key primitive that simultaneously

performs the functions of both digital signature and encryption.
Offers three frequently used security:

In public key schemes, a traditional method is to digitally sign a

message then followed by an encryption.
It own two problems:

Confidentiality, Authenticity, and Non-repudiation

Low efficiency and High cost of such summation.

Signcryption is a relatively new cryptographic technique that is

supposed to fulfill the functionalities of digital signature and
encryption in a single logical step and can effectively decrease
the computational costs and communication overheads in
comparison with the traditional signature-then-encryption
Signcryption provides the properties of both digital signatures
and encryption schemes in a way that is more efficient than
signing and encrypting separately.

Any signcryption scheme should have the following properties:

Correctness: Any signcryption scheme should be correctly
Efficiency: The computational costs and communication costs of
a signcryption scheme should be smaller than those of the best
known signature-then-encryption schemes with the same
provided functionalities.
Security: A signcryption scheme should simultaneously fulfill the
security attributes of an encryption scheme and those of a digital
Such additional properties mainly include:

Some signcryption schemes provide further attributes such as:

Confidentiality, Unforgeability, Integrity, and Non-repudiation.

Public verifiability and Forward secrecy of message confidentiality while
the others do not provide them.

Such properties are the attributes that are required in many

applications while the others may not require them.


a replacement for DES was needed

have theoretical attacks that can break it

have demonstrated exhaustive key search


use Triple-DES but slow, has small

US NIST issued call for ciphers in 1997
15 candidates accepted in Jun 98
5 were shortlisted in Aug-99
Rijndael was selected as the AES in Oct2000
issued as FIPS PUB 197 standard in Nov2001


key symmetric block cipher

128-bit data, 128/192/256-bit keys
stronger & faster than Triple-DES
active life of 20-30 years (+ archival use)
provide full specification & design details
both C & Java implementations
NIST have released all submissions &
unclassified analyses


security effort for practical cryptanalysis

cost in terms of computational efficiency
algorithm & implementation characteristics




general security
ease of software & hardware implementation
implementation attacks
flexibility (in en/decrypt, keying, other factors)

It is based on Rijndale algorithm.

Use a combination of substitution and a couple of
transpositions approaches together with a keying
Consists of n rounds of the above said
combination, where n depends on the key length
(i.e. unlike DES, the length of AES key varies
amongst 3 types).
Use block encryption where 1 block is a fixed size
of 128 bits.
Use symmetric encryption where the size of a key
can either be 128 bits (still double the size of DES
64 bits of key!!), 192 bits, or 256 bits, where the
number of n rounds are 9, 11 and 13 respectively.


by Rijmen-Daemen in Belgium
has 128/192/256 bit keys, 128 bit data
an iterative rather than feistel cipher

processes data as block of 4 columns of 4 bytes

operates on entire data block in every round


to be:

resistant against known attacks

speed and code compactness on many CPUs
design simplicity


block of 4 columns of 4 bytes is state

key is expanded to array of words
has 9/11/13 rounds in which state undergoes:
byte substitution (1 S-box used on every byte)
shift rows (permute bytes between groups/columns)
mix columns (subs using matrix multipy of groups)
add round key (XOR state with key material)
view as alternating XOR key & scramble data bytes


XOR key material & incomplete last

with fast XOR & table lookup implementation


an iterative rather than feistel cipher

key expanded into array of 32-bit words



four words form round key in each round

4 different stages are used

has a simple structure
only AddRoundKey uses key
AddRoundKey a form of Vernam cipher
each stage is easily reversible
decryption uses keys in reverse order
decryption does recover plaintext
final round has only 3 stages

In AES, the block of 128 bits are treated as

individual 4*4 matrix of bytes (i.e. a total of 16
















Each round in AES consists of 4 steps:(1) Byte Substitution

by substituting each byte in a block based
on a substitution table.

simple substitution of each byte

uses one table of 16x16 bytes containing a
permutation of all 256 8-bit values
each byte of state is replaced by byte
indexed by row (left 4-bits) & column
(right 4-bits)

byte {95} is replaced by byte in row 9

column 5
which has value {2A}


to be resistant to all known

circular byte shift in each


row is unchanged
2nd row does 1 byte circular shift to left
3rd row does 2 byte circular shift to left
4th row does 3 byte circular shift to left

inverts using shifts to right

since state is processed by columns, this
step permutes bytes between the columns

each column is processed separately

each byte is replaced by a value dependent
on all 4 bytes in the column
effectively a matrix multiplication in GF(28)
using prime poly m(x) =x8+x4+x3+x+1

XOR state with 128-bits of the round key

again processed by column (though
effectively a series of byte operations)
inverse for decryption identical


XOR own inverse, with reversed keys

designed to be as simple as possible


form of Vernam cipher on expanded key

requires other stages for complexity / security

takes 128-bit (16-byte) key and expands into

array of 44/52/60 32-bit words
start by copying key into first 4 words
then loop creating words that depend on
values in previous & 4 places back


3 of 4 cases just XOR these together

1st word in 4 has rotate + S-box + XOR round
constant on previous, before XOR 4th back

designed to resist known attacks

design criteria included


part key insufficient to find many more

invertible transformation
fast on wide range of CPUs
use round constants to break symmetry
diffuse key bits into round keys
enough non-linearity to hinder analysis
simplicity of description

AES decryption is not identical to encryption

since steps done in reverse
but can define an equivalent inverse cipher
with steps as for encryption


using inverses of each step

with a different key schedule

works since result is unchanged when


byte substitution & shift rows

swap mix columns & add (tweaked) round key

can efficiently implement on 8-bit CPU


substitution works on bytes using a table of

256 entries
shift rows is simple byte shift
add round key works on byte XORs
mix columns requires matrix multiply in GF(28)
which works on byte values, can be simplified to
use table lookups & byte XORs

can efficiently implement on 32-bit CPU


steps to use 32-bit words

can precompute 4 tables of 256-words
then each column in each round can be
computed using 4 table lookups + 4 XORs
at a cost of 4Kb to store tables

designers believe this very efficient

implementation was a key factor in its
selection as the AES cipher