Extracting and Managing Keys from QKD to Enhance Cryptographic Techniques for File Encryption (Lab)

HellasQCI Third Training Event, Crete, 04-05 September 2024 Extracting and Managing Keys from QKD to Enhance Cryptographic Techniques for File Encryption (Lab) Dr. Homer Papadopoulos, NCSRD Antonis Korakis, NCSRD Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Contents ✓Symmetric key Cryptography ✓Public/symmetric key Cryptography ✓Hashing, Digital Signatures and Certificates ✓Demo: Communicate with QKD and GET keys Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Who we are –NCSR Demokritos –Syndesis Ltd Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Key Cryptography Cryptography is the science of securing information by transforming it into a format that is unreadable to anyone except those who have the key to decrypt it. The primary goals of cryptography are: 1.Confidentiality: Ensuring that information is only accessible to those who are authorized to view it. 2.Integrity: Protecting information from being altered by unauthorized parties during transmission. 3.Authentication: Verifying the identity of the parties involved in communication. 4.Non-repudiation: Ensuring that a party cannot deny the authenticity of their signature on a document or the sending of a message. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Symmetric Key Cryptography (AES) oSecret-Key DecryptionoSecret-Key Encryption There are multiple chipper modes are available in AES: •ECB mode: Electronic Code Book mode •CBC mode: Cipher Block Chaining mode •CFB mode: Cipher Feedback mode •OFB mode: Output FeedBack mode •CTR mode: Counter mode •GCM mode: Galois/Counter mode Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Symmetric encryption schemes Feature OTP ChaCha20 AES Security Level Information -Theoretic Computational Computational Authentication Not inherent, requires additional mechanisms (MAC, digital signature) Not inherent, often used with Poly1305 for authenticated encryption Not inherent, often used with GCM or CBC -MAC for authenticated encryption Key Management Impractical for long messages Practical, with a shorter key Practical, with standardized key lengths eg 256 bits Performance High key management overhead Fast and efficient Efficient, but can be complex to implement correctly Common Use Cases Highly sensitive, lowvolume communications (e.g., diplomatic, military messages). Eg for one page of 1000 characters there is need for a key length of 8.000 bit Real -time communications, secure communications (e.g., TLS 1.3) Data encryption , secure communications (e.g., HTTPS, VPNs) A stream cipher can be considered a "pseudo-One-Time Pad" (pseudo-OTP) because it mimics the functionality of the One-Time Pad (OTP) in a practical way, using a pseudorandom number generator (PRNG) to create a keystream rather than relying on a truly random, one-time-use key. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Symmetric Key Cryptography (AES) Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Symmetric Cryptography Weaknesses: •The secure distribution of the key •Trust problem - Authentication Symmetric Key Cryptography (AES) Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Public or Asymmetric Key Cryptography (Public-Private Key) Step B: Users maintain key-pairs and exchange public keys Step A : Generate public-private keys Step C : Public key encryption decryption Step D : Hybrid Encryption https://betterprogramming.pub/an-introduction-to-public-key-cryptography-3ea0cf7bf4ba Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Demo of Encrypt - Decrypt Encrypt and digital sign Message Bob Public Key to encrypt the Message Alice Private Key to sign the message Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Demo of Encrypt - Decrypt Decrypt and Verify the Sender Encrypted Signed Message Bob Private Key to Decrypt the Message Alice Public Key to Verify the Sender Base64 to PNG Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Cryptography - Certificates •Public-Private Key cryptorgraphy is not enough since : •The complexity in large systems with numerous public keys can lead to security risks, such as untrusted keys being mistakenly accepted. •Need for Trust since public-private key pairs alone do not verify the identity of the key owner, leading to security breaches if the wrong entities are trusted. •Attackers can intercept communications and substitute fake public keys, leading to Man-in-the-Middle attacks. •Need for standard methods eg to replace compromised keys or ensure that expired keys are no longer used. Therefore the new concept of Certificates can address these problems by providing a trusted mechanism for verifying identities, preventing attacks, managing keys at scale, revoking compromised keys, and ensuring compliance with security standards. Certificates can be used in smart cards, IoT, SSL/TLS protocols etc. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Certificate-Based Authentication (CBA) uses digital certificates to verify the identity of users, devices, or machines, enhancing security beyond traditional methods. Certificate Authorities (CAs) are trusted entities that issue Digital Certificates, which are electronic documents used to prove the ownership of a public-private key pair. The popular digital certificate X.509 includes the below elements: •The public key •The user or device’s name •The name of the Certificate Authority (CA) that issued the certificate •The date from which the certificate is valid •The expiry date of the certificate •The version number of the certificate data •A serial number Cryptography - Certificates Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Cryptography - Certificates Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 One-way SSL / Server Certificate Authentication In one-way SSL authentication (Server Certificate Authentication), only the client validates the server; the server does not verify the client application. When implementing one-way SSL authentication, the server application shares its public certificate with the client. Two-way SSL/ Client Authentication In two-way SSL authentication, the client application verifies the identity of the server application, and then the server application verifies the identity of the client application. Both parties share their public certificates, and then validation is performed. Two-way SSL authentication works with a mutual handshake by exchanging the certificates. Similar to Encryptor-QKD handshake Cryptography - Certificates Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Cryptography with Certificates -examples 1.A client requests access to a protected resource in the server. 2.The server presents its certificate to the client. 3.The client here verifies the server’s certificate. 4.If successful, the client sends its certificate to the server. 5.The server verifies the client’s credentials. 6.If successful, the server gives access to the protected resource in the server. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Main Concept of a QKD network architecture Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 https://www.etsi.org/deliver/etsi_gs/QKD/001_099/014/01.01.01_60/gs_qkd014v010101p.pdf IDQ QKD solution for a point-to-point deployment KMS plays two roles as Consumer and Provider to Provider and Consumer respectively. That is, KMS is seen as Consumer when collecting keys from Provider and as Provider when dispensing keys to Consumer. Main Concept of a QKD network architecture Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Access a QKD device REQUEST A UNIQUE 256bit key from the QKD KMS ➢ Encryptor sends an authorized (via SSL Certificate) https post request (in JSON format) to the QKD’s ETSI REST Interface requesting a 256bit key. ➢curl -sS --cert server_crt.pem --key server_key.pem --cacert ca_crt.pem -k https://[Alice<MEIP]/api/v1/keys/[Bob SAE]/enc_keys?size=256 ➢curl -sS --cert server_crt.pem --key server_key.pem --cacert ca_crt.pem-khttps://192.168.0.4/api/v1/keys/192.168.0.1/enc_keys?size=256 ➢ QKD accepts the authorized request from the Encryptor and returns a 256bit key (base64 format) together with the corresponding QKD Key ID (in JSON format). ➢ Encryptor can use the received QKD 256bit key for synchronous encryption. ETSI REST Protocol 256bit key request with QKD key ID Encryptor QKD QKD Key ID, 256bit key (base64 format) We use QKD technology to provide keys to encryptors (ETSI 014) to facilitate network communication. 1.A client eg encryptor HSM, Raspberry pi etc requests access to a protected resource eg QKD keys. 2.The server here the QKD KMS server presents its certificate to the client - encryptor. 3.The client encryptor here verifies the server’s certificate QKD KMS system. 4.If successful, the client –encryptor sends its certificate to the server -QKD. 5.The server-QKD verifies the client’s-encryptor credentials. 6.If successful, the server-QKD grants access to the protected resource -Keys requested by the client-encryptor. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Install the App: QKD ETSI Simulator • Open the folder QKDETSIClient • Execute QKDETSIClient.exe Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Get new encryption keys from the QKD •Select the Get new QKD key option from the dropdown menu •Select Certificate: Click the browse button to select the appropriate certificate (.pfx file). The .pfx file is located in the application’s folder (ETSIA.pfx) •Enter QKD Details: Master QKD Name: Enter the name of the Master QKD (e.g., Alice). Slave QKD Name: Enter the name of the Slave QKD (e.g., Bob). •Key Length: Enter the desired key length (maximum 1024 bits). •Number of Keys: Enter the number of keys you want to request (up to 10). •Submit Request: Press the Submit Request button. •The application will communicate with the QKD simulator and retrieve the requested keys in base64 format. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 •Select the Get QKD key by ID option from the dropdown menu •Select Certificate: Click the browse button to select the appropriate certificate (.pfx file). The .pfx file is located in the application’s folder (ETSIA.pfx) •Enter QKD Details: Master QKD Name: Enter the name of the QKD that will request the key (e.g., Bob). Slave QKD Name: Enter the name of the QKD that originally created the key (e.g., Alice). •Enter Key ID(s): Enter the QKD key ID(s) of the requested keys. •Submit Request: Press the Submit Request button. •The application will communicate with the QKD simulator and retrieve the requested keys in base64 format. Requesting Key by ID from Slave QKD Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Simulator for Encryption Methods Download the required files • Download EncryptionMethods.zip • Unzip EncryptionMethods.zip to your device • Execute EncryptionMethods.exe Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Use the QKD keys to encrypt data •Entering Keys and Message: Enter the two 256-bit keys in base64 format (QKD Key 1 and QKD Key 2). •Type your message into the plaintext textarea. •Encrypting the Message: After entering the keys and message, press the Encrypt button. The application will encrypt the message using the following four algorithms: AES 256 CBC, AES 256 GCM, One Time Pad,ChaCha20Poly1305 Viewing Encrypted Message: The encrypted message will be displayed in the designated area for each encryption algorithm. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Use the QKD keys to decrypt data •Entering Encrypted Message and Keys: Enter the encrypted message and the corresponding encryption keys, into the respective fields. •Decrypting the Message: Press the Decrypt button. The application will decrypt the message and display the plaintext. Dr. Homer Papadopoulos, Antonis Korakis, NCSRD HellasQCI Third Training Event, Crete, 04-05 September 2024 Thank you Dr. Homer Papadopoulos, NCSRD Antonis Korakis, NCSRD