Hello, my name is Dan Boneh, and I'd like to welcome you to my course on cryptography
that I'll be teaching at Stanford University this quarter. This quarter, I'm experimenting
with recording the lectures and having the students watch the lectures online.
In fact, anyone is welcome to watch the lectures, and join the course.
This is an experiment, so we'll see how it goes. My goals for this
course are basically to teach you how cryptographic primitives work.
But more importantly I'd like to teach you how to use cryptographic primitives correctly
and reason about the security of your constructions. We will see various
abstractions of cryptographic primitives, and we'll do some security proofs.
My goal is that by the end of the course you'll be able to reason about the security of cryptographic
constructions and be able to break ones that are not secure.
Now I'd like to say a few words on how I would like you to take the class. First of all,
I'm a big believer in taking notes as you listen to the lectures. So I would really
encourage you to summarize and take notes in your own words of the material that's being presented.
Also I should mention that on the videos, I'm able to go much faster
than I would go in a normal classroom. And so I would encourage you to
periodically pause the video and think about the material that's being covered
and not move forward until the material is clear in your mind. Also from time to time,
the video will pause and pop-up questions will come up.
These are intended to kinda help you along with the material, and I would really encourage you to answer
those questions by yourselves rather than skip them. Usually the questions
are about the material that has just been covered, and so it shouldn't be too difficult to answer
the questions. So I would really encourage you to do them rather than skip them.
Now, by now I'm sure everybody taking the class knows that cryptography is used
everywhere computers are. It's a very common tool that's used to protect data.
For example, web traffic is protected using a protocol called HTTPS.
Wireless traffic, for example, Wi-Fi traffic is protected using the, WPA2
protocol, that's part of 801.11i. Cell phone traffic is protected
using an encryption mechanism in GSM. Bluetooth traffic is protected using cryptography,
and so on. We're gonna see how these various systems work. In fact, we're gonna
cover SSL, and in fact, even 802.11i in quite a bit of detail. And you'll see how
these system work in practice. Cryptography is also used for protecting files
that are stored on disc by encrypting them. So if the disc is stolen,
the files are not compromised. It's also used for content protection. For example
when you buy DVDs and Blu-Ray disks, the movies on these disks are encrypted, in
particular DVD uses a system called CSS, the Content Scrambling System, CSS, and
Blu-Ray uses a system called AACS. We'll talk about how CSS and AACS work.
It turns out that CSS is a fairly easy system to break.
And we'll talk about how, we'll do some cryptanalysis and actually show how to break encryption that's used in CSS.
Cryptography is also used for user authentication and in many, many, many
other applications that we'll talk about in the next segments. Now I wanna go back
to secure communication, and talk about the case where, here, we have a laptop
trying to communicate with a web server. This is a good time to also introduce our friends,
Alice and Bob, who are gonna be with us throughout the quarter. Essentially Alice
is trying to communicate securely with Bob. Here Alice is on the laptop and Bob
is on the server. The protocol that's used to do that is called HTTPS, but in fact,
the actual protocol is called SSL. Sometimes it's called TLS.
And the goals of these protocols is to basically make sure that as this data travels across the
network, an attacker first of all can't eavesdrop on this data. Second of all, an
attacker can't modify the data while it's in the network. So no eavesdropping and no tampering.
Now as I said the protocol that's used to secure web traffic called TLS
actually consists of two parts. The first part is called the handshake protocol
where Alice and Bob talk with one another and at the end of the handshake
handshake basically a shared secret key appears between the two of them. So both
Alice and Bob know this secret key, but an attacker looking at the conversation has
no idea what the key K is. Now, the way you established your secret key, the way
you do the handshake, is using public key cryptography techniques, which we're gonna talk
about in the second part of the course. Now once Alice and Bob have the shared key,
you can use this key to communicate securely by properly
encrypting data between them. And in fact this is gonna be the first part of the course,
which is essentially once the two sides have a shared secret key, how do they use
that secret key to encrypt and protect data that goes back and forth between them?
Now, as I said, another application of cryptography is to protect
files on disk. So, here you have a file that happens to be encrypted, so that even
if the disk is stolen, an attacker can't actually read the contents in the file.
And, if an attacker tries to modify the data on disk, the data in the file while
it's on disk, when Alice tries to decrypt this file, that will be detected, and
she'll then basically ignore the contents of the file. So we have both confidentiality
confidentiality and integrity for files stored on disk. Now I want to make a minor philosophical
point, that in fact storing encrypted files on disk is very much the same
as protecting communication between Alice and Bob. In particular, when you
store files on disk, it's basically Alice who stores the file today wants to read
the file tomorrow. So rather than communicating between two parties Alice and Bob,
in the case of a stored disk encryption, it's Alice today who is
communicating with Alice tomorrow. But really the two scenarios, secure
communications, and secure files, are kind of philosophically the same. Now, the
building block for securing traffic is what's called symmetric encryption
systems. And we're gonna talk, in the first half of the course extensively about
symmetric encryption systems. So in a symmetric encryption system, basically, the two parties,
Alice and Bob, share a secret key k, which the attacker does not
know. Only they know the secret key k. Now, they're gonna use a cipher which
consists of these two algorithms, E and D. E is called an encryption algorithm and D
is called the decryption algorithm. The encryption algorithm takes the message and
the key as inputs, and produces a corresponding ciphertext. And the
decryption algorithm does the opposite. It takes the ciphertext as input along with the key
key and produces the corresponding message. Now, a very important point that
I would like to stress. I'm only gonna say this once now and never again, but it is an
extremely important point. And that is: that the algorithms E and D, the actual
encryption algorithms are publicly known. Adversary knows exactly how they work. The
only thing that's kept secret is the secret key k. Other than that
everything else is completely public and it's really important to realize that you
should only use algorithms that are public because those algorithms have been
peer-reviewed by a very large community of hundreds of people for many, many, many years,
and these algorithms only begin to be used once this community has shown that
they cannot be broken, essentially. So in fact, if somebody comes to you and says, hey, I have a proprietary
cipher that you might want to use, the answer usually should be that
you stick to standards, to standard algorithms, and not use a proprietary
cipher. In fact, there are many examples of proprietary ciphers that, as soon as
they were reverse engineered, they were easily broken by simple analysis.
Now, even in the simple cases of symmetric encryption which we're gonna discuss
in the first half of the course, there are actually two cases that we're gonna discuss in turn.
The first, is when every key is only used to encrypt a
single message, we call these one time keys. Okay. So for example, when you
encrypt email messages, it's very common that every single email is encrypted using
a different symmetric key. Yeah? Different symmetric cipher key. Because the key is
used to encrypt only one message there are actually fairly efficient and simple ways of
encrypting messages using these one time keys and we'll discuss those actually
in the next module. Now there are many cases in fact where keys
need to be used to encrypt multiple messages. We call these many time keys.
For example, when you encrypt files in a file system the same key is used
to encrypt many many, different files. And it turns out if the key is now going to be used to encrypt
multiple messages we need a little bit of more machinery to make sure that the
encryption system is secure. In fact after we talk about the one-time keys, we
will move over and talk about encryption modes that are specifically designed for
many-time keys. And we'll see that there are a couple more steps that need to be taken to
ensure security in those cases. Okay, the last point I wanna make
is that there are a couple of important things to remember about cryptography. First of all,
cryptography, of course, is a fantastic tool for protecting information in computer systems.
However, it's also very important that cryptography has its limitations.
First of all, cryptography is really not the solution to all security problems.
For example, if you have software bugs then very often cryptography is not
going to be able to help you. Similarly, if you're worried about social engineering attacks,
where the attacker tries to fool the user into taking actions
that are going to hurt the user, then cryptography is very often actually not
going to help you. So it's very important that although it's a fabulous tool, it's not the
solution to all security problems. Now another very important point is that cryptography
essentially becomes useless if it's implemented incorrectly. So, for example,
there are a number of systems that work perfectly fine. And we'll see examples of those
systems, that, in fact, allow Alice and Bob to communicate. And,
in fact, messages that Alice sent to Bob, Bob can receive and decrypt. However,
because cryptography is implemented incorrectly, the systems are completely insecure.
Actually I should say that I like to mention an old encryption standard
called WEP this is used for encrypting Wi-Fi traffic. WEP contains many
mistakes in it and often when I wanna show you how not to do things in cryptography
I will point to how things were done in WEP as an example. So for me, it's very fortunate to have an example,
a protocol I can point to for how not to do things. And finally, a very
important point that I'd like you to remember is that cryptography is not
something you should try to invent and design yourself. As I said, there are
standards in cryptography, standard cryptographic primitives which we're gonna discuss
at length during this course. And primarily you're supposed to use
these standard cryptographic primitives, and not invent things, these primitives,
yourself. The standards have all gone through, many years of
review by hundreds of people, and that's not something that's going to happen to an ad hoc design.
And, as I said, over the years there are many examples of
ad hoc designs that were immediately broken as soon as they were analyzed.
