1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
#+title: AES Encryption
#+date: <2018-11-28>
#+description: A beginner's guide to AES encryption.
* Basic AES
If you're not familiar with encryption techniques,
[[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard][AES]] is
the *Advanced Encryption Standard*. This specification was established
by the National Institute of Standards and Technology, sub-selected from
the Rijndael family of ciphers (128, 192, and 256 bits) in 2001.
Furthering its popularity and status, the US government chose AES as
their default encryption method for top-secret data, removing the
previous standard which had been in place since 1977.
AES has proven to be an extremely safe encryption method, with 7-round
and 8-round attacks making no material improvements since the release of
this encryption standard almost two decades ago.
#+begin_quote
Though many papers have been published on the cryptanalysis of AES, the
fastest single-key attacks on round-reduced AES variants [20, 33] so far
are only slightly more powerful than those proposed 10 years ago
[23,24].
- [[http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf][Bogdonav,
et al.]]
#+end_quote
* How Secure is AES?
In theory, AES-256 is non-crackable due to the massive number of
combinations that can be produced. However, AES-128 is no longer
recommended as a viable implementation to protect important data.
A semi-short
[[http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html][comic
strip]] from Moserware quickly explains AES for the public to
understand. Basically AES encrypts the data by obscuring the
relationship between the data and the encrypted data. Additionally, this
method spreads the message out. Lastly, the key produced by AES is the
secret to decrypting it. Someone may know the method of AES, but without
the key, they are powerless.
To obscure and spread the data out, AES creates a
substitution-permutation network. Wikipedia has a wonderful
[[https://upload.wikimedia.org/wikipedia/commons/thumb/c/cd/SubstitutionPermutationNetwork2.png/468px-SubstitutionPermutationNetwork2.png][example
of an SP network]] available. This network sends the data through a set
of S boxes (using the unique key) to substitute the bits with another
block of bits. Then, a P box will permutate, or rearrange, the bits.
This is done over and over, with the key being derived from the last
round. For AES, the key size specifies the number of transformation
rounds: 10, 12, and 14 rounds for 128-bit, 192-bit, and 256-bit keys,
respectively.
* The Process
1. *KeyExpansion*: Using
[[https://en.m.wikipedia.org/wiki/Advanced_Encryption_Standard][Rijndael's
key schedule]], the keys are dynamically generated.
2. *AddRoundKey*: Each byte of the data is combined with this key using
bitwise xor.
3. *SubBytes*: This is followed by the substitution of each byte of
data.
4. *ShiftRows*: Then, the final three rows are shifted a certain number
of steps, dictated by the cipher.
5. *MixColumns*: After the rows have been shifted, the columns are mixed
and combined.
This process does not necessarily stop after one full round. Steps 2
through 5 will repeat for the number of rounds specified by the key.
However, the final round excludes the MixColumns step. As you can see,
this is a fairly complex process. One must have a solid understanding of
general mathematic principles to fully understand how the sequence works
(and to even attempt to find a weakness).
According to research done by Bogdanov et al., it would take billions of
years to brute force a 126-bit key with current hardware. Additionally,
this brute force attack would require storing 2^{88} bits of data!
However, there are a few different attacks that have been used to show
vulnerabilities with the use of this technology. Side-channel attacks
use inadvertent leaks of data from the hardware or software, which can
allow attackers to obtain the key or run programs on a user's hardware.
Please note that this is not something you should run out and try to
implement in your =Hello, World!= app after only a few hours of
research. While AES (basically all encryption methods) is extremely
efficient in what it does, it takes a lot of time and patience to
understand. If you're looking for something which currently implements
AES, check out the
[[https://www.bouncycastle.org/documentation.html][Legion of the Bouncy
Castle]] for Java implementations of cryptographic algorithms.
* Why Does Encryption Matter?
There are limitless reasons to enable encryption at-rest or in-transit
for various aspects of your digital life. You can research specific
examples, such as
[[https://arstechnica.com/tech-policy/2018/12/australia-passes-new-law-to-thwart-strong-encryption/][Australia
passes new law to thwart strong encryption]]. However, I will simply
list a few basic reasons to always enable encryption, where feasible:
1. Privacy is a human right and is recognized as a national right in
some countries (e.g.,
[[https://www.law.cornell.edu/wex/fourth_amendment][US Fourth
Amendment]]).
2. "Why not?" Encryption rarely affects performance or speed, so there's
usually not a reason to avoid it in the first place.
3. Your digital identity and activity (texts, emails, phone calls,
online accounts, etc.) are extremely valuable and can result in
terrible consequences, such as identity theft, if leaked to other
parties. Encrypting this data prevents such leaks from ruining lives.
4. Wiping or factory-resetting does not actually wipe all data from the
storage device. There are methods to read data from the physical
disks/boards inside devices.
5. Corporations, governments, and other nefarious groups/individuals are
actively looking for ways to collect personal information about
anyone they can. If someone's data is unencrypted, that person may
become a target due to the ease of data collection.
*Read More:*
- [[http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf][Federal
Information Processing Standards Publication 197]]
|
