The objective of this paper is to give a comprehensive introduction to applied cryptography with an engineer or computer scientist in mind. The emphasis is on the knowledge needed to create practical systems which supports integrity, confidentiality, or authenticity. Topics covered includes an introduction to the concepts in cryptography, attacks against cryptographic systems, key use and handling, random bit generation, encryption modes, and message authentication codes. Recommendations on algorithms and further reading is given in the end of the paper. This paper should make the reader able to build, understand and evaluate system descriptions and designs based on the cryptographic components described in the paper.

[서평]「Applied Cryptography」

This study explores digital business transformation through the lens of four emerging technology fields: artificial intelligence, blockchain, cloud and data analytics (i.e., ABCD). Specifically, the study investigates the operations and value propositions of these distinct but increasingly converging technologies. Due to the dynamic nature of innovation, the potential of this ABCD hybridization, integration, recombination and convergence has yet to be considered. Using a multidisciplinary approach, the findings of the study show wide-reaching and diverse applications among a variety of vertical sectors, presenting exploratory research avenues for future investigation. The study also highlights the practical implications of these new technologies.

/pdf/transforming-business-using-digital-innovations-the-2ok4v8yoac.pdf

Transforming business using digital innovations: the application of AI, blockchain, cloud and data analytics

RC4 has been the most popular stream cipher in the history of symmetric key cryptography. Its internal state contains a permutation over all possible bytes from 0 to 255, and it attempts to generate a pseudo-random sequence of bytes (called keystream) by extracting elements of this permutation. Over the last twenty years, numerous cryptanalytic results on RC4 stream cipher have been published, many of which are based on non-random (biased) events involving the secret key, the state variables, and the keystream of the cipher.

Though biases based on the secret key are common in RC4 literature, none of the existing ones depends on the length of the secret key. In the first part of this paper, we investigate the effect of RC4 keylength on its keystream, and report significant biases involving the length of the secret key. In the process, we prove the two known empirical biases that were experimentally reported and used in recent attacks against WEP and WPA by Sepehrdad, Vaudenay and Vuagnoux in EUROCRYPT 2011. After our current work, there remains no bias in the literature of WEP and WPA attacks without a proof.

In the second part of the paper, we present theoretical proofs of some significant initial-round empirical biases observed by Sepehrdad, Vaudenay and Vuagnoux in SAC 2010.

In the third part, we present the derivation of the complete probability distribution of the first byte of RC4 keystream, a problem left open for a decade since the observation by Mironov in CRYPTO 2002. Further, the existence of positive biases towards zero for all the initial bytes 3 to 255 is proved and exploited towards a generalized broadcast attack on RC4. We also investigate for long-term non-randomness in the keystream, and prove a new long-term bias of RC4.

https://link.springer.com/content/pdf/10.1007%2Fs00145-012-9138-1.pdf

(Non-)Random Sequences from (Non-)Random Permutations--Analysis of RC4 Stream Cipher

In this paper, we present several weaknesses in the stream cipher RC4. First, we present a technique to automatically reveal linear correlations in the PRGA of RC4. With this method, 48 new exploitable correlations have been discovered. Then we bind these new biases in the PRGA with known KSA weaknesses to provide practical key recovery attacks. Henceforth, we apply a similar technique on RC4 as a black box, i.e. the secret key words as input and the keystream words as output. Our objective is to exhaustively find linear correlations between these elements. Thanks to this technique, 9 new exploitable correlations have been revealed. Finally, we exploit these weaknesses on RC4 to some practical examples, such as the WEP protocol. We show that these correlations lead to a key recovery attack on WEP with only 9800 encrypted packets (less than 20 seconds), instead of 24200 for the best previous attack.

/pdf/discovery-and-exploitation-of-new-biases-in-rc4-1ug682phob.pdf

Discovery and exploitation of new biases in RC4

In this paper, the RC4 Key Scheduling Algorithm (KSA) is theoretically studied to reveal non-uniformity in the expected number of times each value of the permutation is touched by the indices i, j. Based on our analysis and the results available in literature regarding the existing weaknesses of RC4, few additional layers over the RC4 KSA and RC4 Pseudo-Random Generation Algorithm (PRGA) are proposed. Analysis of the modified cipher (we call it RC4) shows that this new strategy avoids existing weaknesses of RC4.

/pdf/analysis-of-rc4-and-proposal-of-additional-layers-for-better-8ckvz1y69a.pdf

Analysis of RC4 and Proposal of Additional Layers for Better Security Margin.

Finding an internal state of RC4 stream cipher

The paper introduces an abstraction in form of general conditions for cryptanalytic managing of the information about the current state of the RC4 stream cipher. The general conditions based strategy is used to favor more promising values that should be assigned to unknown entries in the RC4 table. The estimated complexity of the cryptanalytic attack is lower than the best published result although the RC4 remains a quite secure cipher in practice.

/pdf/reducing-the-state-space-of-rc4-stream-cipher-35kz4sf880.pdf

Reducing the State Space of RC4 Stream Cipher

Upravljanje kvalitetom u hotelijerstvu

An analysis of chain characteristics in the cryptanalytic TMTO method

This paper describes the ongoing process of developing a virtual lab for different introductory computing courses based on the ACM-IEEE Computer Science Curricula. The laboratory is designed as a 3D virtual collaborative system with carefully developed instructional sequences covering different, often overlapping teaching subjects. The central object to every lab is a composite model of PC whose basic components are suitable for teaching computer architecture, programming, and operating systems courses. The same PC model is also used in conjunction with other composite 3D models of hardware for networking and net-centered courses. The 3D computing lab that we develop offers two advantages. First, composite component model it applies helps students gain a complete understanding of computing technology through interleaving problems viewed from different perspectives. Second, by following students' activities and progress, instructors can easily identify the most difficult teaching concepts and modify their syllabi accordingly.

Violeta Tomašević

Papers

Finding an internal state of RC4 stream cipher

Reducing the State Space of RC4 Stream Cipher

Upravljanje kvalitetom u hotelijerstvu

An analysis of chain characteristics in the cryptanalytic TMTO method

Development of modular virtual lab for introductory computing courses