cmc/cleberg.net

  1#+date:        [2018-11-28 Wed 00:00:00]
  2#+title:       AES Encryption
  3#+description: Let's learn about AES encryption, its method, and how it can be used.
  4#+slug:        aes-encryption
  5#+filetags:    :security:
  6
  7* Basic AES
  8
  9If you're not familiar with encryption techniques, the Advanced Encryption
 10Standard ([[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard][AES]]) is a specification for encryption of electronic data. The
 11National Institute of Standards and Technology established this specification,
 12sub-selected from the Rijndael family of ciphers (128, 192, and 256 bits)
 13in 2001. Furthering its popularity and status, the US government chose AES as
 14their default encryption method for top-secret data, removing the previous
 15standard which had been in place since 1977.
 16
 17AES has proven to be a safe encryption method, with 7-round and 8-round attacks
 18making no material improvements since the release of this encryption standard
 19almost two decades ago.
 20
 21#+begin_quote
 22Though many papers have been published on the cryptanalysis of AES, the fastest
 23single-key attacks on round-reduced AES variants [20, 33] so far are only
 24slightly more powerful than those proposed 10 years ago [23,24].
 25
 26- [[http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf][Bogdanov, et al.]]
 27#+end_quote
 28
 29* How Secure is AES?
 30
 31In theory, AES-256 (AES using a 256-bit key) is non-crackable due to the massive
 32number of combinations that can the encryption process can produce. However,
 33AES-128 is no longer recommended as a viable implementation to protect important
 34data due the 128-bit key's short length.
 35
 36A semi-short [[http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html][comic strip]] from Moserware quickly explains AES for the public to
 37understand. Basically, AES encrypts the data by obscuring the relationship
 38between the data and the encrypted data. Additionally, this method spreads the
 39message out. Lastly, the key produced by AES is the secret to decrypting it.
 40Someone may know the method of AES, but without the key, they are powerless.
 41
 42To obscure and spread the data out, AES creates a substitution-permutation
 43network. Wikipedia has a wonderful [[https://upload.wikimedia.org/wikipedia/commons/thumb/c/cd/SubstitutionPermutationNetwork2.png/468px-SubstitutionPermutationNetwork2.png][example of an SP network]] available. This
 44network sends the data through a set of S boxes (using the unique key) to
 45substitute the bits with another block of bits. Then, a P box will permute, or
 46rearrange, the bits. This is performed numerous times, with the last round
 47deriving the key. For AES, the key size specifies the number of transformation
 48rounds: 10, 12, and 14 rounds for 128-bit, 192-bit, and 256-bit keys,
 49respectively.
 50
 51* The Process
 52
 531. *KeyExpansion*: Using [[https://en.m.wikipedia.org/wiki/Advanced_Encryption_Standard][Rijndael's key schedule]], the keys are dynamically
 54   generated.
 552. *AddRoundKey*: The process combines each byte of the data with the generated
 56   key(s) using bitwise xor.
 573. *SubBytes*: Next, the process substitutes each byte of data.
 584. *ShiftRows*: Then, the process shifts the final three rows a specific number
 59   of steps, dictated by the cipher.
 605. *MixColumns*: Finally, the process mixes and combines the columns into the
 61   final data for this round of processing.
 62
 63This process does not necessarily stop after one full round. Steps 2 through 5
 64will repeat for the number of rounds specified by the key. However, the final
 65round excludes the MixColumns step. As you can see, this is a fairly complex
 66process. One must have a solid understanding of general mathematical principles to
 67fully understand how the sequence works (and to even attempt to find a
 68weakness).
 69
 70According to research done by Bogdanov et al., it would take billions of years
 71to brute force a 126-bit key with current hardware. Additionally, this brute
 72force attack would require storing 2^{88} bits of data! However, people have
 73shown different attacks displaying vulnerabilities with the use of this
 74technology. Side-channel attacks use inadvertent leaks of data from the hardware
 75or software, which can allow attackers to obtain the key or run programs on a
 76user's hardware.
 77
 78Please note that this is not something you should run out and try to implement
 79in your =Hello, World!= application after only hours of research. While AES
 80(basically all encryption methods) is efficient in what it does, it takes a lot
 81of time and patience to understand. If you're looking for something which
 82currently implements AES, check out the [[https://www.bouncycastle.org/documentation.html][Legion of the Bouncy Castle]] for Java
 83implementations of cryptographic algorithms.
 84
 85* Why Does Encryption Matter?
 86
 87There are limitless reasons to enable encryption at-rest or in-transit for
 88aspects of your digital life. You can research specific examples, such as
 89[[https://arstechnica.com/tech-policy/2018/12/australia-passes-new-law-to-thwart-strong-encryption/][Australia passes new law to thwart strong encryption]]. However, I will simply
 90list basic reasons to always enable encryption, where feasible:
 91
 921. Privacy is a human right and some countries recognize it as a national right
 93   (e.g., [[https://www.law.cornell.edu/wex/fourth_amendment][US Fourth Amendment]]).
 942. "Why not?" Encryption rarely affects performance or speed, so there's usually
 95   not a reason to avoid it in the first place.
 963. Your digital identity and activity (texts, emails, phone calls, online
 97   accounts, etc.) are valuable and can result in consequences, such as identity
 98   theft, if leaked to other parties. Encrypting this data prevents such leaks
 99   from ruining lives.
1004. Wiping or factory-resetting does not actually wipe all data from the storage
101   device. There are methods to read data from the physical disks/boards inside
102   devices.
1035. Corporations, governments, and other groups or individuals are actively
104   looking for ways to collect personal information about anyone they can. If
105   someone's data is not encrypted, that person may become a target due to the
106   ease of data collection.
107
108* Read More
109
110- [[http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf][Federal Information Processing Standards Publication 197]]