Secure SMS messaging using Quasigroup encryption and Java SMS API

Transcription

1 Secure SMS messaging using Quasigroup encryption and Java SMS API Marko Hassinen, Smile Markovski University of Kuopio, Finland SS Cyril and Methodius University, Republic of Macedonia SPLST 2003 Kuopio, Finland p.1/18

2 Contents Motivation Definition of the encryption method Application structure Performance figures Conclusions and Future Work SPLST 2003 Kuopio, Finland p.2/18

3 Motivation SMS message can go to a wrong number SPLST 2003 Kuopio, Finland p.3/18

4 Motivation SMS message can go to a wrong number Traffic is sometimes not encrypted SPLST 2003 Kuopio, Finland p.3/18

5 Motivation SMS message can go to a wrong number Traffic is sometimes not encrypted The device with messages in it may get lost SPLST 2003 Kuopio, Finland p.3/18

6 Motivation SMS message can go to a wrong number Traffic is sometimes not encrypted The device with messages in it may get lost The operator can have malicious employees SPLST 2003 Kuopio, Finland p.3/18

7 Motivation SMS message can go to a wrong number Traffic is sometimes not encrypted The device with messages in it may get lost The operator can have malicious employees Authentication of receiver SPLST 2003 Kuopio, Finland p.3/18

8 Quasigroup encryption A groupoid is a finite set to an operator that is closed with respect SPLST 2003 Kuopio, Finland p.4/18

9 Quasigroup encryption A groupoid is a finite set to an operator that is closed with respect A quasigroup is a groupoid with unique left and right inverses. SPLST 2003 Kuopio, Finland p.4/18

10 Quasigroup encryption A groupoid is a finite set to an operator that is closed with respect A quasigroup is a groupoid with unique left and right inverses. A quasigroup can be characterised with a that is an matrix where each row and column is a permutation of elements of a set SPLST 2003 Kuopio, Finland p.4/18

11 Quasigroup encryption A groupoid is a finite set to an operator that is closed with respect A quasigroup is a groupoid with unique left and right inverses. A quasigroup can be characterised with a that is an matrix where each row and column is a permutation of elements of a set The encryption primitive defined as on sequence where is SPLST 2003 Kuopio, Finland p.4/18

12 Decryption SPLST 2003 Kuopio, Finland p.5/18 is defined as,where Decryption

13 Decryption Decryption is defined as,where As an example encrypting a bitsequence with a quasigroup of order 4 ( = 01): SPLST 2003 Kuopio, Finland p.5/18

14 Decryption Decryption is defined as,where As an example encrypting a bitsequence with a quasigroup of order 4 ( = 01): SPLST 2003 Kuopio, Finland p.5/18

15 Decryption Decryption is defined as,where As an example encrypting a bitsequence with a quasigroup of order 4 ( = 01): SPLST 2003 Kuopio, Finland p.5/18

16 Decryption Decryption is defined as,where As an example encrypting a bitsequence with a quasigroup of order 4 ( = 01): SPLST 2003 Kuopio, Finland p.5/18

17 Decryption Decryption is defined as,where As an example encrypting a bitsequence with a quasigroup of order 4 ( = 01): SPLST 2003 Kuopio, Finland p.5/18

18 Some words about security Encryption is a composition of primitives and which are characterised by a variable length passprhase. SPLST 2003 Kuopio, Finland p.6/18

19 Some words about security Encryption is a composition of primitives and which are characterised by a variable length passprhase. The amount of different latin squares of order is SPLST 2003 Kuopio, Finland p.6/18

20 Some words about security Encryption is a composition of primitives and which are characterised by a variable length passprhase. The amount of different latin squares of order is There are at least 288 latin squares of order 4, but more than of order 16. SPLST 2003 Kuopio, Finland p.6/18

21 Some words about security Encryption is a composition of primitives and which are characterised by a variable length passprhase. The amount of different latin squares of order is There are at least 288 latin squares of order 4, but more than of order 16. A Latin square of order 16 has 256 entries that can be stored in 128 bytes. SPLST 2003 Kuopio, Finland p.6/18

22 J2ME as an application environment J2ME (Java 2 Micro Edition) is a runtime environment designed for devices with limited resources MIDP APPLICATIONS MIDP OEM SPECIFIC APPLICATIONS OEM SPECIFIC CLASSES NATIVE APPLICATIONS CLDC NATIVE SOFTWARE DEVICE SPLST 2003 Kuopio, Finland p.7/18

23 J2ME as an application environment Basic language features and libraries are in the CLDC (Connected Limited Device Configuration). MIDP APPLICATIONS MIDP OEM SPECIFIC APPLICATIONS OEM SPECIFIC CLASSES NATIVE APPLICATIONS CLDC NATIVE SOFTWARE DEVICE SPLST 2003 Kuopio, Finland p.7/18

24 J2ME as an application environment Mobile Information Device Profile (MIDP) provides additional functionality for a specific type of device. MIDP APPLICATIONS MIDP OEM SPECIFIC APPLICATIONS OEM SPECIFIC CLASSES NATIVE APPLICATIONS CLDC NATIVE SOFTWARE DEVICE SPLST 2003 Kuopio, Finland p.7/18

25 Application requirements The requirements for the application were to 1. Encrypt an SMS message using quasigroup encryption and send it SPLST 2003 Kuopio, Finland p.8/18

26 Application requirements The requirements for the application were to 1. Encrypt an SMS message using quasigroup encryption and send it 2. Receive encrypted messages and decrypt them SPLST 2003 Kuopio, Finland p.8/18

27 Application requirements The requirements for the application were to 1. Encrypt an SMS message using quasigroup encryption and send it 2. Receive encrypted messages and decrypt them 3. Operate fast enough to provide acceptable service in an environment with very limited processing power like a mobile phone SPLST 2003 Kuopio, Finland p.8/18

28 Application requirements The requirements for the application were to 1. Encrypt an SMS message using quasigroup encryption and send it 2. Receive encrypted messages and decrypt them 3. Operate fast enough to provide acceptable service in an environment with very limited processing power like a mobile phone 4. Be compact enough for use in mobile phone memory space SPLST 2003 Kuopio, Finland p.8/18

29 Architecture of CryptSMS software QX.java NokiaSMSHandler.java OutgoingTextMessage.java NokiaDebugLog.java WMA Nokia WMASMSHandler.java SMSHandler.java NUMScreen.java CryptSMS.java PASScreen.java SMSScreen.java DebugLog.java WriteSMS.java CommonLog.java Siemens SiemensSMSHandler.java QX.java Receiver.java OutgoingTextMessage.java SiemensDebugLog.java SPLST 2003 Kuopio, Finland p.9/18

30 Storage memory and JAR size MIDP application (MIDlets) are stored in the device as JAR (Java archive) files JAR sizes for our application are: Nokia: bytes Siemens: bytes WTK: bytes, WTK is the Wireless Toolkit provided by Sun MicroSystems. Through obfuscation the JAR size can be reduced by approximately 10. SPLST 2003 Kuopio, Finland p.10/18

31 Runtime memory Runtime memory usage for each object was measured as follows: int iamount = 100; Object[] objects; long lfree = 0; long lused = 0; objects = new SMSScreen[iAmount]; Runtime.getRuntime().gc(); lfree = Runtime.getRuntime().freeMemory(); for(int i = 0; i < iamount; i++) objects[i] = new SMSScreen(this, TEST,1); Runtime.getRuntime().gc(); lused = lfree - Runtime.getRuntime().freeMemory(); DebugLog.makeEntry(iAmount+ SMSScreen) used: +lused); for(int i = 0; i < iamount; i++) objects[i] = null; SPLST 2003 Kuopio, Finland p.11/18

32 Name of the class Siemens Nokia WTK WTK* Remarks CommonLog.java N/A N/A N/A Abstract super class CryptSms.java DebugLog.java N/A N/A N/A N/A Static class NokiaDebugLog.java N/A 41 N/A N/A NokiaSmsHandler.java N/A 264 N/A N/A NUMScreen.java OutgoingTextMessage.java PASScreen.java QX.java Receiver.java 20 N/A N/A N/A SiemensDebugLog 16 N/A N/A N/A SiemensSmsHandler 284 N/A N/A N/A SmsHandler.java N/A N/A N/A N/A Abstract super class SmsScreen.java WmaDebugLog.java N/A N/A WmaSmsHandler.java N/A N/A WriteSmsScreen.java SPLST 2003 Kuopio, Finland p.12/18

33 Encryption processing power Time needed for encrypting or decrypting a message of a certain length was measured with following way: long lmillis = System.currentTimeMillis(); // Operation that needs to be measured... long ltimespent = System.currentTimeMillis() - lmillis; DebugLog.makeEntry( Encryption time + ltimespent); A bit string with time bits can be encrypted in linear An optimization can be achieved by sorting the latin square. SPLST 2003 Kuopio, Finland p.13/18

34 Encryption processing power (cont.) As a result encryption takes time length of the passphrase. Sorting the latin square takes time order of the group. where is the where is the SPLST 2003 Kuopio, Finland p.14/18

35 Some experiment results 800 Encryption and decryption times with 4 and 16 rounds *Encryption 4*Decryption 16*Encryption 16*Decryption 500 Time (msec) Number of characters SPLST 2003 Kuopio, Finland p.15/18

36 Conclusions Quasigroup encryption is compact and fast enough to be used on a restricted mobile platform. Cryptocraphic security of quasigroup encryption needs to be studied more extensively Latencies, such as encryption can be easily hidden from the user with careful application design Device vendors have their own specific API:s in addition to MIDP and WMA. Not all of them implement WMA. For our purposes Siemens Java API proved to offer the best functionality. SPLST 2003 Kuopio, Finland p.16/18

37 Future work Other cryptocraphic algorithms Public key encryption Authentication Signatures Data integrity Non repudation X.509 certificates Phonebook for keys and numbers Compression SPLST 2003 Kuopio, Finland p.17/18

38 Thank you Questions? SPLST 2003 Kuopio, Finland p.18/18