Guidelines for Answering Cryptography Questions and Discussion of Three Cryptographic Designs

General Guidance

The following guidance apply to all questions. Specific guidance to each question are given within the question.

• In all questions, marks are awarded for the quality of your discussion and justification of your assumptions, choices, and conclusions.

• In some questions, you are expected to research your answers and to cite appropriate external sources if required; it is not sufficient to use only the module notes. References must be listed at the end of the document and do not count towards page limits.

• You may need to make assumptions about a business scenario or design in order to propose solutions; this is acceptable provided any such assumptions are explicitly and clearly stated, the assumptions are required for your analysis, and there is no evidence contradicting the assumptions in the given material.

• Appropriate use of visual aids, e.g., figures and tables, is encouraged. Any such aids must be closely relevant to the text and act as  complementary material to make your writing more reader-friendly. They must be of good quality and made by the student, i.e., not digitally copied, e.g., screen captured, from other sources. They do not count towards page limits.

• Answers must be prepared on A4 paper with margins of size at least 2cm, use standard fonts (e.g., Times New Roman or Arial) with font size 11 or larger, and be in single-column format.

• The IEEE style of citation and referencing must be used to cite papers or other sources used.

• As standard in modern cryptography, all algorithms are public knowledge.

• The provided arguments should be succinct and logical.

In a certain network protocol, each datagram consists of a 256-bit header and a 256-bit payload. An organisation decides to store hashed datagrams for analytic purposes. These hash values need to be calculated on resource-limited devices that can only process data in 256-bit chunks.

Thankfully, the devices have hardware implementations of the following cryptographic algorithms:

• SHACAL, a block cipher with 256-bit keys, 256-bit input blocks, and 256-bit outputs, and

• H, a secure internal hash function with 256-bit inputs and 128-bit outputs.

Since the internal hash function H cannot process entire datagrams, it is necessary to design a hashing method that can compute datagram hashes based on the internally implemented algorithms. The engineers come up with the following designs for hashing datagrams:

(i) [5 Marks] The organisation needs to develop a program that looks at the stored datagram hash values and for any two hashed datagrams reliably distinguishes if the original datagrams were identical or not. Identify the security requirement on datagram hashing in this case, and justify your answer.

(ii) [12 Marks] Consider the three candidate designs A, B, and C above. For each design, discuss whether or not it satisfies the security requirement identified in part (i). In each case provide a convincing argument or an attack to support your answer.

• Now assume that beside calculating datagram hash values, the devices are to transmit the datagrams to a central monitoring platform over a public network. The devices apply a message-authentication code MAC to hashed datagrams and send the following information to
the monitoring platform.

• Assume that the MAC used is secure and its key K is securely pre-shared between a device and the monitoring platform. Since datagrams are not required to remain confidential, no encryption is used, and the above information is sent in the clear over the network. Hence, the network
communication might be observed, blocked, or modified by third parties. The monitoring platform performs MAC verification upon receiving any communication, and only accepts the incoming communication if MAC verification succeeds.

(iii) [5 Marks] The authenticity and integrity of the received communication are important to the monitoring platform. In other words, the platform needs to make sure any communication it accepts is indeed from the device and that the information has not been tampered with in transit. Identify the security requirement on the MAC component for the above protocol to provide authenticity and integrity guarantees. Justify your answer by discussing attacks that may arise in practice.

(iv) [8 Marks] Consider Designs B and C only. For each design, discuss if the required goals of authenticity and integrity are met when used in the protocol above. In each case, provide a convincing argument or an attack to support your answer.

Your answer to this question must not exceed 2 sides of A4 in total. This does not include code and any further supplementary information presented in appendices.

• Two law firms, who used to exchange signed contracts manually, are deciding to “go digital.” Their requirement is that any document sent from one firm (say, firm A) to the other (say, firm B) needs to be legally binding; that is, in case of a dispute, firm B should be able to prove to a court that a document has been sent to them from firm A in its exact form. In other words, if firm A sends a document to firm B, then firm A should not be able to later deny sending the document.

• The firms are looking to adopt a cryptographic solution to satisfy their requirement. They were advised to adopt a (nationally or internationally) standardised solution. Due to the nature of the documents, the firms require that the solution they adopt is secure for up to 5 years. The firms are based in the United States and the European Union; hence they were advised to follow the NIST 2020 and ECRYPT-CSA 2018 recommendations for security levels and key sizes.

(i) [4 Marks] Identify the security property required by the firms and the cryptographic primitive that would provide this property.

(ii) [4 Marks] Propose a standardised scheme to be adopted by the firms, citing the specific standard recommending the algorithm.

(iii) [8 Marks] Considering the duration requirement of the firms, recommend a level of security for the firms that satisfies both the NIST 2020 and ECRYPT-CSA 2018 recommendations, and briefly justify your answer. Determine the recommended key sizes and hash digest lengths for the scheme proposed in part (ii).

(iv) [4 Marks] Considering the proposed solution, explain what preparations need to be made in terms of generating and sharing cryptographic information between the two firms before the proposed algorithm can be used for exchanging documents in a trustworthy manner.

Your answer to this question must not exceed 2 sides of A4 in total. This does not include code and any further supplementary information presented in appendices.

Read the following papers and write a summary of your understanding.

• “Ron was wrong, Whit is right” by Lenstra et al. presented at Crypto 2012.

• “Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices” by Heninger et al. presented at USENIX Security 2012.

Your summary must cover at least the following topics: some of the main vulnerabilities discussed in these papers, the original cause(s) of these vulnerabilities, the security consequences of these vulnerabilities, some of the main findings of the above papers in their surveys of keys in the wild, some of the main lessons from these works for you as a future security practitioner.

Good marks will be given to well-structured summaries that provide reasonable coverage and demonstrate a good overall understanding of the vulnerabilities, their causes and consequences, and practical lessons learned. You do not need to understand all the technical details such as
the mathematics of the more sophisticated attacks.

Your answer to this question must not exceed 2 sides of A4 in total. This does not include code and any further supplementary information presented in appendices