download issue 24 here - Help Net Security

acronyms without researching their underpinnings.
Since all IT decisions come down to
dollars and sense versus functionality, this
scenario turned into a “risk analysis” exercise
centered on how likely it was that a hypothetical
attacker had the means to “crack” 3DES
and yet not be capable of getting through
AES. Then, comparing that difference in
probability to the implied “loss” that would be
realized in the event of a breach, in an effort
to justify the additional cost.
The result of this exercise was that 3DES was
more than sufficient since we had calculated it
was more likely (from a probabilistic standpoint)
that the equipment would be stolen,
physical security compromised, and the information
easily removed from the internal
systems without needing to crack one encryption
key. This result was disliked greatly by the
IT staff, but liked immensely by the accounting
department who now felt they saved quite a
bit of money.
Since this will not be an overview on how to
develop risk scenario calculations, weʼll focus
on trying to educate our fellow IT professionals
on why BOTH algorithms are great, but if
one costs more money, either can be used so
one can save money. In the process, we will
hopefully clear up some misunderstandings
about their inherent differences and advantages
in different situations.
In an effort to bridge the gap between the
“newbie” IT professional and the seasoned
expert, we will offer some definitions where
appropriate. Our goal is simply this – to come
away with a better understanding of the differences
amongst encryption algorithms and
where they fit in todayʼs business computing
environment.
Data Encryption Standard, 3DES, and
Advanced Encryption Standard
To begin, let us quickly come up to speed on
some points: “Cryptology” is essentially defined
as the making and breaking of secret
codes. It consists of two parts: cryptography,
which is the development and use of codes;
and, cryptanalysis, which is the breaking of
the codes. These two aspects go hand in
hand as the cryptanalysis confirms (or negates)
the strength of the algorithms them-
selves. Once shown to have vulnerabilities,
the algorithms tend to get stronger via improved
cryptographic mathematics (usually).
Please keep in mind that this “cat and mouse”
game between code creators and code
breakers is not new, by ANY means. Cryptography
was very popular even during the time
of Julius Caesar since the security of a message
delivered by a human could NOT be secured
simply by trusting the human. In fact,
recall the Hundred Years War between France
and England. At that time, the cryptanalysts
were ahead of the cryptographers. France believed
the Vigenère cipher to be unbreakable.
The British, of course, cracked that code. No
algorithm is truly unbreakable. Hence, the security
of entire nations sometimes rests on the
strength of encryption codes! But, let us return
from our digression.
Put simply, a “cipher” is an algorithm for performing
encryption and decryption. With a
substitution cipher, one letter is substituted for
another to encrypt a message. In simplest
form, the number of letters in the output
equals that of the input. One of the shortcomings
of this simple cipher is its vulnerability to
frequency analysis.
If a message has 15 B's, for example, and B
is replaced by L, the ciphertext would still contain
15 Ls. As the message lengthens, it becomes
more and more vulnerable to frequency
analysis because the message would
retain the frequency patters found in the language,
even though the characters are different.
Polyalphabetic ciphers were invented to make
up for the shortcomings of the substitution cipher.
The Vigenère cipher is an example. It
encrypts using a series of different Caesar ciphers
based on the letters of a keyword. This
makes it invulnerable to frequency analysis.
National security dictated the need to create
DES, which was adopted by the National Institute
of Standards and Technology in 1977,
and later approved by the American National
Standards Institute in 1981 (ANSI X3.92). It is
defined as a “Block Cipher” because it handles
data in 64 bit “blocks.” This means eight
bytes, since one byte [historically] equals
eight bits. Within this 64-bit block, 56 bits are
www.insecuremag.com 52