7.3 Encryption Schemes in WLANs

Encryption plays a significant part in both the WLAN and LAN environments. For wireless users, encryption is particularly important because the wireless platform is often the easiest port of entry into a network. An attacker can often attack a wireless device and gain access to LAN resources without the victims' ever even being aware they have been exploited. Encryption makes the job of an attacker much more difficult and helps protect the users from such exploits.

7.3.1 AES (FIPS 197)

The Advanced Encryption Standard (AES) [7] supersedes Date Encryption Standard (DES) as the new information protection standard defined by the United States to protect certain levels of federal information and communications. The selection process for an AES algorithm began in 1997, and the new standard was finalized in November 2001. AES is a publicly disclosed encryption algorithm and is unclassified. On January 2, 1997, the U.S. National Institute for Security Technologies (NIST) announced that it was going to develop a new AES to replace the previous DES and called for public submissions for the new AES algorithm. At a minimum, the algorithm would have to implement symmetric key cryptography as a block cipher and support a block size of 128 bits and key sizes of 128, 192, and 256 bits. The AES standard selected by the NIST (Federal Information Processing Standard 197 [FIPS 197]) specifies the Rijndael algorithm, which is a symmetric block cipher that can process data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits. The Rijndael algorithm was submitted by Joan Daemen (Proton World International) and Vincent Rijmen (Katholieke Universiteit Leuven).

AES Evaluation Criteria

The algorithms submitted for consideration were evaluated on three major criteria: security, cost, and algorithm and implementation characteristics, based on the following:

Security : Resistance of the algorithm to cryptanalysis, soundness of its mathematical basis, randomness of the algorithm output, and relative security compared with other candidates
Cost : Licensing requirements, computational speed and efficiency on various platforms, and memory requirements ”speed of the algorithm on a variety of platforms, based on 128-, 192-, and 256-bit keys
Algorithm and implementation characteristics : Flexibility, suitability to hardware and software, and the simplicity (or complexity) of the algorithm

Rijndael is an iterated block cipher, meaning that the initial input block and cipher key undergoe multiple transformation cycles before producing the output. AES was designed to handle additional block sizes and key lengths, but they are not adopted in the FIPS 197. The AES will specify three key sizes: 128, 192, and 256 bits. In decimal terms, this means that there are approximately:

 3.4  1,038 possible 128-bit keys    6.2  1,057 possible 192-bit keys    1.1  1,077 possible 256-bit keys

In comparison, DES keys are 56 bits long, which means there are approximately 7.2 — 1,016 possible DES keys. Thus, there are approximately 10 ²¹ more AES 128-bit keys than DES 56-bit keys.

The AES cipher is based on round operations. Each round has a roundkey of 128 bits and the result of the previous round as input. The round-keys can be precomputed or generated on-the-fly from the input key. Because of its regular structure, it can be implemented efficiently in hardware. Decryption is computed by application of the inverse functions of the round operations. The algorithm is written so that block length and/or key length can easily be extended in multiples of 32 bits, and the system is specifically designed for efficient implementation in hardware or software on a range of processors.

Rijndael is a substitution-linear transformation network with 10, 12, or 14 rounds, depending on the key size. A data block to be encrypted by Rijndael is split into an array of bytes, and each encryption operation is byte-oriented. Rijndael's round function consists of four layers. In the first layer, an eight-by-eight S-box is applied to each byte. The second and third layers are linear mixing layers , in which the rows of the array are shifted and the columns are mixed. In the fourth layer, subkey bytes are XORed into each byte of the array. In the last round, the column mixing is omitted.

The sequence of operations for the round function differs from encryption, which often results in separated encryption and decryption circuits. Computational performance of software implementations often differ between encryption and decryption because the inverse operations performed during the round function are more complex than the corresponding operation for encryption.

7.3.2 Data Encryption Standard

DES has been a worldwide standard for data encryption for more than two decades now. On May 15, 1973, in the U.S. Federal Register, NIST formerly the U.S. National Bureau of Standards) issued a public request for a data encryption algorithm. This request eventually resulted in the DES implementation. DES was officially endorsed by the U.S. government in 1977 as an encryption standard. Current details can be found in the latest official FIPS publication concerning DES. Although it was originally developed by IBM (who holds the patent for DES), it has been extensively studied since its original publication. DES is, without doubt, the best-known and most widely used cryptosystem in the world.

DES is a symmetric cryptosystem. When it is used for communications, both the sender and the receiver must know and share the same secret key. This secret key is used to encrypt and decrypt the message. DES also has other security- related uses. For example, DES can be used on the desktop as a single- user encryption tool for securing files on a hard disk. In a multiuser environment, secure key distribution may be difficult or unwieldily. Using public key cryptography is an ideal solution to this problem. The NIST has recertified DES as an official U.S. government encryption standard every five years since its introduction. DES was last recertified in 1998, but NIST has indicated that it may not recertify DES again. The AES is the new NIST standard on the horizon.

Until 2000, the use of security keys greater in length than 56 bits was illegal in the United States. A software manufacturer who wished to export software using such large security keys risked prosecution under the same laws as an exporter of nuclear materials of weapons grade. Philip K. Zim-mermann, the author of Pretty Good Privacy (PGP), fought a long legal battle to publicize the stupidity of this law, which allowed the commercial secrets of American business to be easily broken into by sophisticated foreign competitors , but made it illegal for it to be used to protect those same American business secrets. Fortunately, this legal loophole has been corrected.

How DES Works

In DES, the plaintext is converted into a sequence of bits (0s and 1s), in blocks of 64 bits apiece, padded with trailing 0s when the message is not an even multiple of 64. For example, encoding of an 8-bit sequence looks as follows :

 00100001 is A    00100010 is B    00100011 is C    00010000 is a blank-space    00010001 is !, etc.

In DES, the 64-bit block, corresponding to plaintext, is entered into the algorithm, and a corresponding 64-bit block, corresponding to ciphertext, is returned by the algorithm. It is a 16-round Feistel cipher and was originally designed for implementation in hardware. Feistel ciphers are a special class of iterated block ciphers where the ciphertext is calculated from the plaintext by repeated application of the same transformation or round function (hence, a Feistel round).

In a Feistel cipher, the text being encrypted is split into two halves . The round function f is applied to one half using a subkey, and the output of f is XORed with the other half. The two halves are then swapped. Each round follows the same pattern, except for the last round where there is no swap. Feistel cipher encryption and decryption are structurally identical, although the subkeys used during encryption at each round are taken in reverse order during decryption. The key length is 56 bits, but because every eighth bit in the 64-bit block is an internal arithmetic check that is not used by the encryption algorithm, the encryption key is expressed as a 64-bit number. The algorithm is considered open , found freely in the public domain, even though it is patented by IBM Corporation. Nowadays, various implementations of DES are in widespread use.

After initial permutation of the plaintext, the block is broken into a left and right half, 32 bits apiece. Then there are 16 rounds of identical operations, in which data is combined within the key. The resulting right and left halves are joined, and a final permutation concludes the calculation.

In DES, the two most fundamental component operations are permutation and XOR (exclusive OR). In a permutation step, the order of the bits in the 64-bit sequence is rearranged, an operation that can easily be reversed . In an XOR step, each bit is subject to the operation x XOR y = z , where z = 1 if x = 1 or y = 1 but not both; whereas z = 0 if both x = 0 and y = 0 or both x = 1 and y = 1. For example:

 011001110000101010110110011100001010101101100111000010101010101  XOR  111100001010001010111111000010100010101111110000101000101010101 --------------------------------------------------------------------      100101111010100000001001011110101000000010010111101010000000000

The XOR operation is likewise easily reversed. If t is the plaintext, k is the key, c is the ciphertext, and t XOR k = c , then c XOR k = t . Both permutation and XOR operations have mathematical properties that ensure the ciphertext is exactly the same size as the plaintext, and each of these operations is reversible. DES consists of a complex sequence of permutations and XORs. For details on the exact working of the DES algorithm, the reader is encouraged to consult the online works of John J. G. Savard [8]. He presents a very good explanation of the process at the detail level.

7.3.3 Triple DES

Triple DES solved some of the deficiencies of DES. Based on the DES algorithm, it is very easy to modify existing software to use Triple DES. It also has the advantage of proven reliability and a longer key length, which eliminates many of the shortcut attacks that can be used to reduce the amount of time it takes to break DES; however, even this more powerful version of DES is believed by many to not be strong enough to adequately protect data anymore.

Triple DES takes three 64-bit keys, for an overall key length of 192 bits. The Triple DES process segments the user-provided key into three subkeys, padding as necessary so they are each 64 bits long. The procedure for encryption is exactly the same as regular DES, but it is repeated three times (which is where we get the name Triple DES). The data is encrypted with the first key, decrypted with the second key, and finally re-encrypted with the third key. This triple-round encryption process causes Triple DES to run three times more slowly than standard DES, but is much more secure if used properly. The procedure for decrypting something is the same as the procedure for encryption, except it is executed in reverse. Like DES, data is encrypted and decrypted in 64-bit chunks . Unfortunately, some weak keys exist: if all three keys, the first and second keys, or the second and third keys are the same, then the encryption procedure is essentially the same as standard DES. This situation is to be avoided because it is the same as using a really slow version of regular DES.

Although the input key for DES is 64 bits long, the actual key used by DES is only 56 bits long. The least significant (right-most) bit in each byte is a parity bit and should be set so that there is always an odd number of 1s in every byte. These parity bits are ignored, so only the seven most significant bits of each byte are used, resulting in a key length of 56 bits. This means that the effective key strength for Triple DES is actually 168 bits because each of the three keys contains 8 parity bits that are not used during the encryption process.

7.3.4 RSA Encryption

The RSA method is a model of elegance and simplicity. Aside from the necessity of obtaining large prime numbers and performing large-integer arithmetic, the RSA encryption concept is simple enough for most people with only a background of college algebra to follow. The major problem with public use of RSA is that it is patented. Before we proceed, let's take a moment to briefly review modulo operations.

Modulo Arithmetic

The term x modulo n , or x mod n , denotes the (whole number) remainder of the division of x by n . Modulo arithmetic is one of the greatest mathematical foundations used in modern cryptography. Modulo arithmetic, or so-called clock arithmetic, is the mathematical method by which we determine, say, that six hours after ten o'clock, it is four o'clock. That is, the ordinary clock is a modulo-12 device, and [(6+10) mod 12] equals 4. Similarly, the second hand and minute hand on the clock are modulo-60 devices, and the military clock is a modulo-24 device. Modulo arithmetic has the advantage that integer arithmetic can be performed on huge integers with absolute accuracy, without the need for having intermediate calculations exceed a predetermined size ”namely, the square of the modulus . The essential steps in asymmetric encryption by the RSA Method are as follows:

 Public key: n = product prime numbers,  p  and  q  .  e  is relatively prime to ((  p  -1)(  q  -1))    Private key:  d  = (  e  -1) mod ((  p  -1)(  q  -1))    Encryption:  c  = (  te  ) mod  n  Decryption:  t  = (  cd  ) mod  n

So we have the following variable representations:

 n is the (public) product.    e is the public (encryption) key.    d is the private (decryption) key.    t is the plaintext.    c is the ciphertext.

After determining prime numbers p and q , the next step is calculating values for n , e , and d . At this point, we may simply discard p and q . The receiver distributes numbers ( n , e ) publicly, but d is kept secret and known only to the receiver. In order to properly decrypt messages, the receiver needs to keep the numbers n and d .