Show page

Differences

This shows you the differences between two versions of the page.

--- sasc:laboratoare:08 [2016/04/26 02:02]
sergiu.costea [Exercise 2 - Birthday attack]
+++ sasc:laboratoare:08 [2017/04/24 17:27] (current)
dan.dragan
@@ Line 1: / Line 1: @@
-===== Lab 08 - MACs =====
+===== Lab 08 - MACs, Hashes, OpenSSL =====
-In this lab we'll do some exercises with Message Authentication Codes.
+==== Exercise 1 - Timing attack ====
-==== Exercise 1 - Existential Unforgeability ====
+In this exercise you will perform a timing attack against CBC-MAC.
-==== Exercise 2 - Birthday attack ====
+You are given access to a CBC-MAC $\mathsf{Verify}$ oracle, which tests whether the received tag matches the one computed using the secret key. Timing attacks exploit naive equality comparisons between the received and computed MACs (for example, the comparison is done byte by byte; more checks means more latency).
-In this exercise you will perform a Birthday attack on SHA256.
+Your task is to produce a forged tag for the message 'Hristos a inviat' without knowing the key. Do this by iterating through all possible values for a specific byte; when the oracle's latency for a certain value seems larger than the rest, it suggests that the equality test returned True and the oracle passed to the next byte.
-Your goal is to find two messages, $M_1$ and $M_2$, such that for the first **four** bytes $\mathsf{SHA256}(M_1) = \mathsf{SHA256}(M_2)$.
+Try to start by finding the first byte and checking your result with the timing attack.
-The collision will be $32$ bits long, which means you will need $2^{16}$ random messages in your attack. Note that the attack is not guaranteed to succeed; on average, two iterations of the attack are required to find a collision.
+You can use ''time.clock()'' before and after each oracle query to measure its runtime.
-<file python birthday.py>
+<note important>
+The oracle's latency is subject to noise; for the best results, you may need to run each query multiple times (try 30) and compute the mean latency.
+</note>
+TODO1: Implement the CBC-MAC function.
+<note>
+To check your implementation of CBC-MAC is correct, verify that this (plaintext,tag) verifies fine:
+plaintext = 'Placinta de mere'
+tag = '07d2771038d62b94fce106cff957da0f'  (in hex, you need to apply decode to get a bytestream)
+</note>
+TODO2: Implement the MAC time verification attack and obtain the desired MAC without knowing the key.
+<note>
+Try to print the resulting tag in hex (with tag.encode(hex)). It should start with 51 and end with 81.
+</note>
+<file python timing.py>
 import sys
+import random
 import string
+import time
+import itertools
+import operator
 import base64
+from Crypto.Cipher import AES
 from Crypto.Hash import SHA256
-def raw2hex(raw):
+def slow_foo():
-    return raw.encode('hex')
+    p = 181
+    k = 2
+    while k < p:
+        if p % k == 0:
+            return
+        k += 1
+def aes_enc(k, m):
+  """
+  Encrypt a message m with a key k in ECB mode using AES as follows:
+  c = AES(k, m)
+  Args:
+    m should be a bytestring multiple of 16 bytes (i.e. a sequence of characters such as 'Hello...' or '\x02\x04...')
+    k should be a bytestring of length exactly 16 bytes.
+  Return:
+    The bytestring ciphertext c
+  """
+  aes = AES.new(k)
+  c = aes.encrypt(m)
-def hex2raw(hexstring):
+  return c
-    return base64.b16decode(hexstring)
-hexdigits = '0123456789ABCDEF'
+def aes_dec(k, c):
+  """
+  Decrypt a ciphertext c with a key k in ECB mode using AES as follows:
+  m = AES(k, c)
-def hash(message):
+  Args:
-    h = SHA256.new()
+    c should be a bytestring multiple of 16 bytes (i.e. a sequence of characters such as 'Hello...' or '\x02\x04...')
-    h.update(message)
+    k should be a bytestring of length exactly 16 bytes.
-    return h.digest()
+  Return:
+    The bytestring message m
+  """
+  aes = AES.new(k)
+  m = aes.decrypt(c)
+  return m
+def aes_enc_cbc(k, m, iv):
+  """
+  Encrypt a message m with a key k in CBC mode using AES as follows:
+  c = AES(k, m)
+  Args:
+    m should be a bytestring multiple of 16 bytes (i.e. a sequence of characters such as 'Hello...' or '\x02\x04...')
+    k should be a bytestring of length exactly 16 bytes.
+    iv should be a bytestring of length exactly 16 bytes.
+  Return:
+    The bytestring ciphertext c
+  """
+  aes = AES.new(k, AES.MODE_CBC, iv)
+  c = aes.encrypt(m)
+  return c
+def aes_dec_cbc(k, c, iv):
+  """
+  Decrypt a ciphertext c with a key k in CBC mode using AES as follows:
+  m = AES(k, c)
+  Args:
+    c should be a bytestring multiple of 16 bytes (i.e. a sequence of characters such as 'Hello...' or '\x02\x04...')
+    k should be a bytestring of length exactly 16 bytes.
+    iv should be a bytestring of length exactly 16 bytes.
+  Return:
+    The bytestring message m
+  """
+  aes = AES.new(k, AES.MODE_CBC, iv)
+  m = aes.decrypt(c)
+  return m
+def aes_cbc_mac(k, m):
+  """
+  Compute a CBC-MAC of message m with a key k using AES as follows:
+  t = AES-CBC-MAC(k=(k1,k2), m),
+  where k1 is used for the raw-CBC operation and k2 is used for the final
+  encryption.
+  k1 and k2 are derived from k as follows:
+  [k1|k2] = SHA256(k | "CBC MAC keys")
+  Note: the IV for CBC in this case will be 0.
+  Args:
+    m should be a bytestring multiple of 16 bytes (i.e. a sequence of characters such as 'Hello...' or '\x02\x04...')
+    k should be a bytestring of length exactly 16 bytes.
+  Return:
+    The bytestring MAC t, of 16 bytes.
+  """
+  #Require good size
+  m = m.ljust(16)
+  k = k.ljust(16)
+  #Derive the keys for raw-CBC and for the final tag
+  #[k1 | k2] = SHA256(k + "CBC MAC keys")
+  #Get the MAC:
+  #1 - Do aes-CBC with k1 and iv=0, then keep only last block (last 16 bytes) of encryption
+  #2 - Perform another AES encryption (simple, without CBC) on the last block from #1 using k2
+  #t = tag
+  t = 16*'\x00'
+  return t
+def verify(message, tag):
+  key = 'Cozonace si oua '
+  # Get correct tag
+  goodtag = aes_cbc_mac(key, message)
+  # Compare tags
+  for i in range(16):
+    # Artificially extend byte comparison duration
+    slow_foo()
+    if tag[i] != goodtag[i]:
+      return False
+  return True
 def main():
-    # Try to find a collision on the first 4 bytes (32 bits)
+  message = 'Hristos a inviat'
-    # Step 1. Generate 2^16 different random messages
-    # Step 2. Compute hashes
-    # Step 3. Check if there exist two hashes that match in the first
-    # four bytes.
-    # Step 3a. If a match is found, print the messages and hashes
-    # Step 3b. If no match is found, repeat the attack with a new set
-    # of random messages
-    pass
+  # Step 1. Iterate through all possible first byte values, and call the
+  # Verify oracle for each of them
+  tag = 16*'\x00'
+  verify(message, tag)
-if __name__ == "__main__":
+  # Step 2. Store the byte that caused the longest computation time
-    main()
-</file>
+  # Step 3. Continue the operation for each byte (except the last)
-==== Exercise 3 - Timing attack ====
-In this exercise you will perform a timing attack against HMAC.
+  # Step 4. Guess the last byte, and query the oracle with the complete tag
+  mytag = '???'
+  result = verify(message, mytag)
+  if result == True:
+    print "Found tag: " + mytag
-You are given access to an HMAC $\mathsf{Verify}$ oracle, which tests whether the received HMAC matches the one computed using the secret key. Timing attacks exploit naive equality comparisons between the received and computed HMACs (for example, the comparison is done byte by byte; more checks means more latency).
+if __name__ == "__main__":
+  main()
+</file>
-Your task is to produce a forged tag for the message 'Test' without knowing the key. Do this by iterating through all possible values for a specific byte; when the oracle's latency for a certain value seems larger than the rest, it suggests that the equality test returned True and the oracle passed to the next byte.
+==== Exercise 2 ====
-Try to start by finding the first byte and checking your result with the TA.
+In this first exercise we'll see how to compute hashes using the OpenSSL command line interface.
-You can use ''time.clock()'' before and after each oracle query to measure its runtime.
+You can interact with the OpenSSL utilities in two ways:
+  * directly from bash, by using the ''openssl'' command followed by the desired command and parameters
+  * from the OpenSSL console, by using the ''openssl'' command without additional arguments. You can close the console by calling ''quit'' or ''exit''.
-<note important>
+If the manual pages are correctly installed, you can consult the documentation via ''man <command_name>'' (e.g. ''man md5'').
-The oracle's latency is subject to noise; for the best results, you will need to run each query multiple times (try at least 30) and compute the mean latency.
-</note>
-<file python timing.py>
-import sys
-import random
-import string
-import time
-import itertools
-import operator
-import base64
-from Crypto.Hash.HMAC import HMAC
+Hashes are often used to check the integrity of downloaded files. We will now use OpenSSL to compute the MD5 and SHA-1 hashes of this page.
-def raw2hex(raw):
+Download this page by running:
-    return raw.encode('hex')
+<code>
+linux$ wget http://ocw.cs.pub.ro/courses/sasc/laboratoare/09 -O sasc.html
+</code>
-def hex2raw(hexstring):
-    return base64.b16decode(hexstring)
+Use OpenSSL to compute the MD5 and SHA-1 hashes of the newly downloaded file; print the output in hexadecimal.
-def slow_foo():
+To check your results, you can use ''md5sum'' or ''sha1sum'' as an alternative way of computing the same hashes.
-    p = 181
-    k = 2
-    while k < p:
-        if p % k == 0:
-            return
-        k += 1
+==== Exercise 3 ====
-def verify(message, tag):
+In this second exercise we'll use the command line to compute an HMAC, with SHA-1 as the hashing algorithm.
-    k = '0123456789ABCDEF'
-    # Use MD5 for HMAC
+Recall from the lecture that for HMAC to be secure, we need to sample a random key $k \gets \mathcal{K}$.
-    digest = HMAC(k, message).digest()
-    for i in range(16):
+We can generate random bytes using ''openssl rand''. To compute HMACs, check the documentation for ''openssl dgst''.
-        # Artificially expand byte comparison duration
-        slow_foo()
-        if tag[i] != digest[i]:
-            return False
-    return True
+For this exercise, use OpenSSL commands to:
+  - generate a 16 byte random key
+  - use the key to compute the SHA-1 HMAC of the page downloaded in the previous exercise
-hexdigits = '0123456789ABCDEF'
+==== Exercise 4 ====
+In this exercise you will implement the Birthday attack on SHA-1 from the previous lab using OpenSSL. The goal is to obtain a collision in the first four bytes of the hash.
-def main():
+In contrast to previous labs, this time we'll use C. You can implement the attack from scratch, or start from our {{:sasc:laboratoare:birthday.tar.gz|archive here}}.
-    message = 'Test'
-    # Step 1. Iterate through all possible first byte values, and call the
+To compute a digest, you might find the code below useful:
-    # Verify oracle for each of them
-    # Step 2. Store the byte which caused the longest computation time
+<code C>
+    SHA_CTX context;
+    SHA1_Init(&context);
+    SHA1_Update(&context, buffer, length);
+    SHA1_Final(md, &context); /* md must point to at least 20 bytes of valid memory */
+</code>
-    # Step 3. Continue the operation for each byte (except the last)
+<note important>
+To compile using OpenSSL you will need to install the development version of the library which includes the header files.
-    # Step 4. Guess the last byte, and query the oracle with the complete tag
+Download the library from https://www.openssl.org/source/old/1.0.1/openssl-1.0.1f.tar.gz, and unpack it.
-    mytag = '???'
-    result = verify(message, mytag)
-    if result == True:
-        print mytag
+Open the unpacked folder from bash, and run the following commands:
+<code bash>
+linux$ ./config --prefix=/home/student/local --openssldir=/home/student/local/openssl
+linux$ make
+linux$ make install_sw
+</code>
-if __name__ == "__main__":
+To fix the makefile using the new paths, change the variables at the start with the ones below:
-    main()
+<code makefile>
-</file>
+LDFLAGS=-L/home/student/local/lib -lcrypto
+CFLAGS=-Wall -g -I/home/student/local/include
+</code>
+</note>