Upload
others
View
12
Download
0
Embed Size (px)
Citation preview
Part 1 Cryptography 1
Protocollen en Handshake Pitfalls
Part 1 Cryptography 2
VS
Part 1 Cryptography 3
Part 1 Cryptography 4
Public Key Cryptography
Part 1 Cryptography 5
Public Key Cryptography Two keys
o Sender uses recipient’s public key to encrypto Receiver uses his private key to decrypt
Based on trap door, one way functiono Easy to compute in one directiono Hard to compute in other directiono “Trap door” used to create keyso Example: Given p and q, product N=pq is easy to
compute, but given N, it is hard to find p and q
Part 1 Cryptography 6
Public Key Cryptography Encryption
o Suppose we encrypt M with Bob’s public keyo Only Bob’s private key can decrypt to find M
Digital Signatureo Sign by “encrypting” with private keyo Anyone can verify signature by “decrypting”
with public keyo But only private key holder could have signedo Like a handwritten signature (and then some)
Part 1 Cryptography 7
RSA
Part 1 Cryptography 8
RSA Invented by Cocks (GCHQ), independently,
by Rivest, Shamir and Adleman (MIT) Let p and q be two large prime numbers Let N = pq be the modulus Choose e relatively prime to (p−1)(q−1) Find d s.t. ed = 1 mod (p−1)(q−1) Public key is (N,e) Private key is d
Part 1 Cryptography 9
RSA To encrypt message M compute
o C = Me mod N To decrypt C compute
o M = Cd mod N Recall that e and N are public If attacker can factor N, he can use e to
easily find d since ed = 1 mod (p−1)(q−1) Factoring the modulus breaks RSA It is not known whether factoring is the
only way to break RSA
Part 1 Cryptography 10
Diffie-Hellman
Part 1 Cryptography 11
Diffie-Hellman Invented by Williamson (GCHQ) and,
independently, by D and H (Stanford) A “key exchange” algorithm
o Used to establish a shared symmetric key Not for encrypting or signing Security rests on difficulty of discrete log
problem: given g, p, and gk mod p find k
Part 1 Cryptography 12
Diffie-Hellman Let p be prime, let g be a generator
o For any x ∈ {1,2,…,p-1} there is n s.t. x = gn mod p Alice selects secret value a Bob selects secret value b Alice sends ga mod p to Bob Bob sends gb mod p to Alice Both compute shared secret gab mod p Shared secret can be used as symmetric key
Part 1 Cryptography 13
Diffie-Hellman Suppose that Bob and Alice use gab mod p as
a symmetric key Trudy can see ga mod p and gb mod p Note ga gb mod p = ga+b mod p ≠ gab mod p If Trudy can find a or b, system is broken If Trudy can solve discrete log problem,
then she can find a or b
Part 1 Cryptography 14
Diffie-Hellman Public: g and p Secret: Alice’s exponent a, Bob’s exponent b
Alice, a Bob, b
ga mod p
gb mod p
Alice computes (gb)a = gba = gab mod p Bob computes (ga)b = gab mod p Could use K = gab mod p as symmetric key
Part 1 Cryptography 15
Diffie-Hellman Subject to man-in-the-middle (MiM) attack
Alice, a Bob, b
ga mod p
gb mod p
Trudy, t
gt mod p
gt mod p
Trudy shares secret gat mod p with Alice Trudy shares secret gbt mod p with Bob Alice and Bob don’t know Trudy exists!
Part 1 Cryptography 16
Diffie-Hellman How to prevent MiM attack?
o Encrypt DH exchange with symmetric keyo Encrypt DH exchange with public keyo Sign DH values with private keyo Other?
You MUST be aware of MiM attack on Diffie-Hellman
Part 1 Cryptography 17
Elliptic Curve Cryptography
Part 1 Cryptography 18
Elliptic Curve Crypto (ECC) “Elliptic curve” is not a cryptosystem Elliptic curves are a different way to do the
math in public key system Elliptic curve versions of DH, RSA, etc. Elliptic curves may be more efficient
o Fewer bits needed for same securityo But the operations are more complex
Part 1 Cryptography 19
What is an Elliptic Curve? An elliptic curve E is the graph of
an equation of the formy2 = x3 + ax + b
Also includes a “point at infinity” What do elliptic curves look like? See the next slide!
Part 1 Cryptography 20
Elliptic Curve Picture
Consider elliptic curveE: y2 = x3 - x + 1
If P1 and P2 are on E, we can define
P3 = P1 + P2 as shown in picture
Addition is all we need
P1P2
P3
x
y
Part 1 Cryptography 21
ECC Diffie-Hellman Public: Elliptic curve and point (x,y) on curve Secret: Alice’s A and Bob’s B
Alice, A Bob, B
A(x,y)
B(x,y)
Alice computes A(B(x,y)) Bob computes B(A(x,y)) These are the same since AB = BA
Part 1 Cryptography 22
ECC Diffie-Hellman Public: Curve y2 = x3 + 7x + b (mod 37)
and point (2,5) ⇒ b = 3 Alice’s secret: A = 4 Bob’s secret: B = 7 Alice sends Bob: 4(2,5) = (7,32) Bob sends Alice: 7(2,5) = (18,35) Alice computes: 4(18,35) = (22,1) Bob computes: 7(7,32) = (22,1)
Part 1 Cryptography 23
Uses for Public Key Crypto
Part 1 Cryptography 24
Uses for Public Key Crypto Confidentiality
o Transmitting data over insecure channelo Secure storage on insecure media
Authentication (later) Digital signature provides integrity
and non-repudiationo No non-repudiation with symmetric keys
Part 1 Cryptography 25
Non-non-repudiation Alice orders 100 shares of stock from Bob Alice computes MAC using symmetric key Stock drops, Alice claims she did not order Can Bob prove that Alice placed the order? No! Since Bob also knows symmetric key, he
could have forged message Problem: Bob knows Alice placed the order,
but he can’t prove it
Part 1 Cryptography 26
Non-repudiation Alice orders 100 shares of stock from Bob Alice signs order with her private key Stock drops, Alice claims she did not order Can Bob prove that Alice placed the order? Yes! Only someone with Alice’s private key
could have signed the order This assumes Alice’s private key is not
stolen (revocation problem)
Part 1 Cryptography 27
Sign and Encrypt vs
Encrypt and Sign
Part 1 Cryptography 28
Public Key NotationSign message M with Alice’s private key: [M]Alice
Encrypt message M with Alice’s public key: {M}Alice
Then{[M]Alice}Alice = M[{M}Alice]Alice = M
Part 1 Cryptography 29
Confidentiality and Non-repudiation
Suppose that we want confidentiality and non-repudiation
Can public key crypto achieve both? Alice sends message to Bob
o Sign and encrypt {[M]Alice}Bob
o Encrypt and sign [{M}Bob]Alice
Can the order possibly matter?
Part 1 Cryptography 30
Sign and Encrypt
Alice Bob
{[M]Alice}Bob
Q: What is the problem? A: Charlie misunderstands crypto!
Charlie
{[M]Alice}Charlie
M = “I love you”
Part 1 Cryptography 31
Encrypt and Sign
Alice Bob
[{M}Bob]Alice
Note that Charlie cannot decrypt M Q: What is the problem? A: Bob misunderstands crypto!
Charlie
[{M}Bob]Charlie
M = “My theory, which is mine….”
Part 1 Cryptography 32
Public Key Infrastructure
Part 1 Cryptography 33
Public Key Certificate Contains name of user and user’s
public key (and possibly other info) Certificate is signed by the issuer
(such as VeriSign) who vouches for it Signature on certificate is verified
using signer’s public key
Part 1 Cryptography 34
Certificate Authority Certificate authority (CA) is a trusted 3rd
party (TTP) that issues and signs cert’so Verifying signature verifies the identity of the
owner of corresponding private keyo Verifying signature does not verify the identity
of the source of certificate!o Certificates are public!o Big problem if CA makes a mistake (a CA once
issued Microsoft certificate to someone else!)o Common format for certificates is X.509
Part 1 Cryptography 35
PKI Public Key Infrastructure (PKI) consists of
all pieces needed to securely use public key cryptographyo Key generation and managemento Certificate authoritieso Certificate revocation (CRLs), etc.
No general standard for PKI We consider a few “trust models”
Part 1 Cryptography 36
PKI Trust Models Monopoly model
o One universally trusted organization is the CA for the known universe
o Favored by VeriSign (for obvious reasons)o Big problems if CA is ever compromisedo Big problem if you don’t trust the CA!
Part 1 Cryptography 37
PKI Trust Models Oligarchy
o Multiple trusted CAso This approach used in browsers todayo Browser may have 80 or more certificates,
just to verify signatures!o User can decide which CAs to trust
Part 1 Cryptography 38
PKI Trust Models Anarchy model
o Everyone is a CA!o Users must decide which “CAs” to trusto This approach used in PGP (Web of trust)o Why do they call it “anarchy”? Suppose cert. is
signed by Frank and I don’t know Frank, but I do trust Bob and Bob says Alice is trustworthy and Alice vouches for Frank. Should I trust Frank?
Many other PKI trust models
Part 1 Cryptography 39
Confidentiality in the Real World
Part 1 Cryptography 40
Symmetric Key vs Public Key Symmetric key +’s
o Speedo No public key infrastructure (PKI) needed
Public Key +’so Signatures (non-repudiation)o No shared secret
Part 1 Cryptography 41
Notation Reminder Public key notation
o Sign message M with Alice’s private key [M]Alice
o Encrypt message M with Alice’s public key {M}Alice
Symmetric key notationo Encrypt plaintext P with symmetric key K
C = E(P,K) o Decrypt ciphertext C with symmetric key K
P = D(C,K)
Part 1 Cryptography 42
Real World Confidentiality Hybrid cryptosystem
o Public key crypto to establish a keyo Symmetric key crypto to encrypt datao Consider the following
Alice Bob
{K}Bob
E(Bob’s data, K)
E(Alice’s data, K)
Can Bob be sure he’s talking to Alice?
Part 1 Cryptography 43
Hash Functions
Part 1 Cryptography 44
Hash Function Motivation Suppose Alice signs M
o Alice sends M and S = [M]Alice to Bobo Bob verifies that M = {S}Alice
o Is it OK to just send S? If M is big, [M]Alice is costly to compute Suppose instead, Alice signs h(M), where
h(M) is much smaller than Mo Alice sends M and S = [h(M)]Alice to Bobo Bob verifies that h(M) = {S}Alice
Part 1 Cryptography 45
Crypto Hash Function Crypto hash function h(x) must provide
o Compression output length is smallo Efficiency h(x) easy to computer for any xo One-way given a value y it is infeasible to
find an x such that h(x) = yo Weak collision resistance given x and h(x),
infeasible to find y ≠ x such that h(y) = h(x)o Strong collision resistance infeasible to
find any x and y, with x ≠ y such that h(x) = h(y)o Lots of collisions exist, but hard to find one
Part 1 Cryptography 46
Pre-Birthday Problem Suppose N people in a room How large must N be before the
probability someone has same birthday as me is ≥ 1/2o Solve: 1/2 = 1 − (364/365)N for No Find N = 253
Part 1 Cryptography 47
Birthday Problem How many people must be in a room before
probability is ≥ 1/2 that two or more have same birthday?o 1 − 365/365 ⋅ 364/365 ⋅ ⋅ ⋅(365−N+1)/365o Set equal to 1/2 and solve: N = 23
Surprising? A paradox? Maybe not: “Should be” about sqrt(365)
since we compare all pairs x and y
Part 1 Cryptography 48
Of Hashes and Birthdays If h(x) is N bits, then 2N different hash
values are possible sqrt(2N) = 2N/2
Therefore, hash about 2N/2 random values and you expect to find a collision
Implication: secure N bit symmetric key requires 2N−1 work to “break” while secure N bit hash requires 2N/2 work to “break”
Part 1 Cryptography 49
Non-crypto Hash (1) Data X = (X0,X1,X2,…,Xn-1), each Xi is a byte Spse hash(X) = X0+X1+X2+…+Xn-1
Is this secure? Example: X = (10101010,00001111) Hash is 10111001 But so is hash of Y = (00001111,10101010) Easy to find collisions, so not secure…
Part 1 Cryptography 50
Non-crypto Hash (2) Data X = (X0,X1,X2,…,Xn-1) Suppose hash is
o h(X) = nX0+(n-1)X1+(n-2)X2+…+1⋅Xn-1
Is this hash secure? At least
o h(10101010,00001111)≠h(00001111,10101010) But hash of (00000001,00001111) is same as
hash of (00000000,00010001) Not one-way, but this hash is used in the
(non-crypto) application rsync
Part 1 Cryptography 51
Non-crypto Hash (3) Cyclic Redundancy Check (CRC) Essentially, CRC is the remainder in a
long division problem Good for detecting burst errors But easy to construct collisions CRC sometimes mistakenly used in
crypto applications (WEP)
Part 1 Cryptography 52
Popular Crypto Hashes MD5 invented by Rivest
o 128 bit outputo Note: MD5 collision recently found
SHA-1 A US government standard (similar to MD5)o 160 bit output
Many others hashes, but MD5 and SHA-1 most widely used
Hashes work by hashing message in blocks
Part 1 Cryptography 53
Crypto Hash Design Desired property: avalanche effect
o Change to 1 bit of input should affect about half of output bits
Crypto hash functions consist of some number of rounds
Want security and speedo Avalanche effect after few roundso But simple rounds
Analogous to design of block ciphers
Part 1 Cryptography 54
Hash Uses Authentication (HMAC) Message integrity (HMAC) Message fingerprint Data corruption detection Digital signature efficiency Anything you can do with symmetric crypto
Part 1 Cryptography 55
Online Auction Suppose Alice, Bob and Charlie are bidders Alice plans to bid A, Bob B and Charlie C They don’t trust that bids will stay secret Solution?
o Alice, Bob, Charlie submit hashes h(A), h(B), h(C)o All hashes received and posted onlineo Then bids A, B and C revealed
Hashes don’t reveal bids (one way) Can’t change bid after hash sent (collision)
Part 1 Cryptography 56
Spam Reduction Spam reduction Before I accept an email from you, I
want proof that you spent “effort” (e.g., CPU cycles) to create the email
Limit amount of email that can be sent Make spam much more costly to send
Part 1 Cryptography 57
Spam Reduction Let M = email message Let R = value to be determined Let T = current time Sender must find R such that
o hash(M,R,T) = (00…0,X), whereo N initial bits of hash are all zero
Sender then sends (M,R,T) Recipient accepts email, provided
o hash(M,R,T) begins with N zeros
Part 1 Cryptography 58
Spam Reduction Sender: hash(M,R,T) begins with N zeros Recipient: verify that hash(M,R,T) begins
with N zeros Work for sender: about 2N hashes Work for recipient: 1 hash Sender’s work increases exponentially in N Same work for recipient regardless of N Choose N so that
o Work acceptable for normal email userso Work unacceptably high for spammers!
Part 1 Cryptography 59
Secret Sharing
Part 1 Cryptography 60
Shamir’s Secret Sharing
(X0,Y0)(X1,Y1)
(0,S)
Two points determine a line Give (X0,Y0) to Alice Give (X1,Y1) to Bob Then Alice and Bob must cooperate to find secret S Also works in discrete case Easy to make “m out of n” scheme for any m ≤ nX
Y
2 out of 2
Part 1 Cryptography 61
Shamir’s Secret Sharing
(X0,Y0)
(X1,Y1)
(0,S)
Give (X0,Y0) to Alice Give (X1,Y1) to Bob Give (X2,Y2) to Charlie Then any two of Alice, Bob and Charlie can cooperate to find secret S But no one can find secret S A “2 out of 3” schemeX
Y
(X2,Y2)
2 out of 3
Part 1 Cryptography 62
Shamir’s Secret Sharing
(X0,Y0)
(X1,Y1)
(0,S)
Give (X0,Y0) to Alice Give (X1,Y1) to Bob Give (X2,Y2) to Charlie 3 points determine a parabola Alice, Bob and Charlie must cooperate to find secret S A “3 out of 3” scheme Can you make a “3 out of 4”?
X
Y
(X2,Y2)
3 out of 3
Part 1 Cryptography 63
Secret Sharing Example Key escrow required that your key be
stored somewhere Key can be used with court order But you don’t trust FBI to store keys We can use secret sharing
o Say, three different government agencieso Two must cooperate to recover the key
Part 1 Cryptography 64
Secret Sharing Example
(X0,Y0)
(X1,Y1)
(0,K)
Your symmetric key is K Point (X0,Y0) to FBI Point (X1,Y1) to DoJ Point (X2,Y2) to DoC To recover your key K, two of the three agencies must cooperate No one agency can get K
X
Y
(X2,Y2)
Part 1 Cryptography 65
Random Numbers in Cryptography
Part 1 Cryptography 66
Random Numbers Random numbers used to generate keys
o Symmetric keyso RSA: Prime numberso Diffie Hellman: secret values
Random numbers used for nonceso Sometimes a sequence is OKo But sometimes nonces must be random
Random numbers also used in simulations, statistics, etc., where numbers only need to be “statistically” random
Part 1 Cryptography 67
Random Numbers Cryptographic random numbers must be
statistically random and unpredictable Suppose server generates symmetric keys
o Alice: KA
o Bob: KB
o Charlie: KC
o Dave: KD
Spse Alice, Bob and Charlie don’t like Dave Alice, Bob and Charlie working together must
not be able to determine KD
Part 1 Cryptography 68
Bad Random Number Example
Random numbers used to shuffle the deck Program did not produce a random shuffle Could determine the shuffle in real time!
Online version of Texas Hold ‘em Pokero ASF Software, Inc.
Part 1 Cryptography 69
Randomness True randomness is hard to defineEntropy is a measure of randomness Good sources of “true” randomness
o Radioactive decay though radioactive computers are not too popular
o Hardware devices many good ones on the market
o Lava lamp relies on chaotic behavior
Part 1 Cryptography 70
Randomness Sources of randomness via software
o Software is (hopefully) deterministico So must rely on external “random” eventso Mouse movements, keyboard dynamics, network
activity, etc., etc. Can get quality random bits via software But quantity of such bits is very limited Bottom line: “The use of pseudo-random
processes to generate secret quantities can result in pseudo-security”
Part 1 Cryptography 71
Protocols
Part 1 Cryptography 72
Protocol Human protocols the rules followed in
human interactionso Example: Asking a question in class
Networking protocols rules followed in networked communication systemso Examples: HTTP, FTP, etc.
Security protocol the (communication) rules followed in a security applicationo Examples: SSL, IPSec, Kerberos, etc.
Part 1 Cryptography 73
Protocols Protocol flaws can be very subtle Several well-known security protocols
have serious flawso Including IPSec, GSM and WEP
Common to find implementation errorso Such as IE implementation of SSL
Difficult to get protocols right…
Part 1 Cryptography 74
Ideal Security Protocol Satisfies security requirements
o Requirements must be precise Efficient
o Minimize computational requirement in particular, costly public key operations
o Minimize delays/bandwidth Not fragile
o Must work when attacker tries to break ito Works even if environment changes
Easy to use and implement, flexible, etc. Very difficult to satisfy all of these!
Part 1 Cryptography 75
Simple Security Protocols
Part 1 Cryptography 76
Secure Entry to NSA1. Insert badge into reader2. Enter PIN3. Correct PIN?
Yes? EnterNo? Get shot by security guard
Part 1 Cryptography 77
ATM Machine Protocol1. Insert ATM card2. Enter PIN3. Correct PIN?
Yes? Conduct your transaction(s)No? Machine eats card
Part 1 Cryptography 78
Identify Friend or Foe (IFF)
Namibia
Angola
1. N
2. E(N,K)SAAFImpala
RussianMIG
Part 1 Cryptography 79
MIG in the Middle
Namibia
Angola
1. N
2. N
3. N
4. E(N,K)
5. E(N,K)
6. E(N,K)
SAAFImpala
RussianMiG
Part 1 Cryptography 80
Authentication Protocols
Part 1 Cryptography 81
Authentication Alice must prove her identity to Bob
o Alice and Bob can be humans or computers May also require Bob to prove he’s Bob
(mutual authentication) May also need to establish a session key May have other requirements, such as
o Use only public keyso Use only symmetric keyso Use only a hash functiono Anonymity, plausible deniability, etc., etc.
Part 1 Cryptography 82
Authentication Authentication on a stand-alone computer is
relatively simpleo “Secure path” is the primary issueo Main concern is an attack on authentication
software (we discuss software attacks later) Authentication over a network is much more
complexo Attacker can passively observe messageso Attacker can replay messageso Active attacks may be possible (insert, delete,
change messages)
Part 1 Cryptography 83
Simple Authentication
Alice Bob
“I’m Alice”
Prove it
My password is “frank”
Simple and may be OK for standalone system But insecure for networked system
o Subject to a replay attack (next 2 slides)o Bob must know Alice’s password
Part 1 Cryptography 84
Authentication Attack
Alice Bob
“I’m Alice”
Prove it
My password is “frank”
Trudy
Part 1 Cryptography 85
Authentication Attack
Bob
“I’m Alice”
Prove it
My password is “frank”Trudy
This is a replay attack How can we prevent a replay?
Part 1 Cryptography 86
Simple Authentication
Alice Bob
I’m Alice, My password is “frank”
More efficient… But same problem as previous version
Part 1 Cryptography 87
Better Authentication
Alice Bob
“I’m Alice”
Prove it
h(Alice’s password)
Better since it hides Alice’s passwordo From both Bob and attackers
But still subject to replay
Part 1 Cryptography 88
Challenge-Response To prevent replay, challenge-response used Suppose Bob wants to authenticate Alice
o Challenge sent from Bob to Aliceo Only Alice can provide the correct responseo Challenge chosen so that replay is not possible
How to accomplish this?o Password is something only Alice should know…o For freshness, a “number used once” or nonce
Part 1 Cryptography 89
Challenge-Response
Bob
“I’m Alice”
Nonce
h(Alice’s password, Nonce)
Nonce is the challenge The hash is the response Nonce prevents replay, insures freshness Password is something Alice knows Note that Bob must know Alice’s password
Alice
Part 1 Cryptography 90
Challenge-Response
Bob
“I’m Alice”
Nonce
Something that could only beAlice from Alice (and Bob can verify)
What can we use to achieve this? Hashed pwd works, crypto might be better
Part 1 Cryptography 91
Symmetric Key Notation Encrypt plaintext P with key K
C = E(P,K) Decrypt ciphertext C with key K
P = D(C,K) Here, we are concerned with attacks on
protocols, not directly on the crypto We assume that crypto algorithm is secure
Part 1 Cryptography 92
Symmetric Key Authentication Alice and Bob share symmetric key KAB
Key KAB known only to Alice and Bob Authenticate by proving knowledge of
shared symmetric key How to accomplish this?
o Must not reveal keyo Must not allow replay attack
Part 1 Cryptography 93
Authentication with Symmetric Key
Alice, KABBob, KAB
“I’m Alice”
E(R,KAB)
Secure method for Bob to authenticate Alice Alice does not authenticate Bob Can we achieve mutual authentication?
R
Part 1 Cryptography 94
Mutual Authentication?
Alice Bob
“I’m Alice”, R
E(R,KAB)
E(R,KAB)
What’s wrong with this picture? “Alice” could be Trudy (or anybody else)!
Part 1 Cryptography 95
Mutual Authentication Since we have a secure one-way
authentication protocol… The obvious thing to do is to use the
protocol twiceo Once for Bob to authenticate Aliceo Once for Alice to authenticate Bob
This has to work…
Part 1 Cryptography 96
Mutual Authentication
Alice Bob
“I’m Alice”, RA
RB, E(RA,KAB)
E(RB,KAB)
This provides mutual authentication Is it secure? See the next slide…
Part 1 Cryptography 97
Mutual Authentication Attack
Bob
1. “I’m Alice”, RA
2. RB, E(RA,KAB)
Trudy
Bob
3. “I’m Alice”, RB
4. RC, E(RB,KAB)
Trudy
5. E(RB,KAB)
Part 1 Cryptography 98
Mutual Authentication Our one-way authentication protocol not
secure for mutual authentication Protocols are subtle! The “obvious” thing may not be secure Also, if assumptions or environment changes,
protocol may not worko This is a common source of security failureo For example, Internet protocols
Part 1 Cryptography 99
Symmetric Key Mutual Authentication
Alice Bob
“I’m Alice”, RA
RB, E(“Bob”,RA,KAB)
E(“Alice”,RB,KAB)
Do these “insignificant” changes help? Yes!
Part 1 Cryptography 100
Public Key Notation Encrypt M with Alice’s public key: {M}Alice
Sign M with Alice’s private key: [M]Alice
Theno [{M}Alice ]Alice = Mo {[M]Alice }Alice = M
Anybody can do public key operations Only Alice can use her private key (sign)
Part 1 Cryptography 101
Public Key Authentication
Alice Bob
“I’m Alice”
{R}Alice
R
Is this secure? Trudy can get Alice to decrypt anything!
o Must have two key pairs
Part 1 Cryptography 102
Public Key Authentication
Alice Bob
“I’m Alice”
R
[R]Alice
Is this secure? Trudy can get Alice to sign anything!
o Must have two key pairs
Part 1 Cryptography 103
Public Keys Never use the same key pair for
encryption and signing One key pair for
encryption/decryption A different key pair for
signing/verifying signatures
Part 1 Cryptography 104
Session Key Usually, a session key is required
o Symmetric key for a particular session Can we authenticate and establish a shared
symmetric key?o Key can be used for confidentialityo Key can be used for integrity
In some cases, we may also require perfect forward secrecy (PFS)o Discussed later…
Part 1 Cryptography 105
Authentication & Session Key
Alice Bob
“I’m Alice”, R
{R,K}Alice
{R +1,K}Bob
Is this secure? OK for key, but no mutual authentication Note that K is acting as Bob’s nonce
Part 1 Cryptography 106
Public Key Authentication and Session Key
Alice Bob
“I’m Alice”, R
[R,K]Bob
[R +1,K]Alice
Is this secure? Mutual authentication but key is not secret!
Part 1 Cryptography 107
Public Key Authentication and Session Key
Alice Bob
“I’m Alice”, R
{[R,K]Bob}Alice
{[R +1,K]Alice}Bob
Is this secure? Seems to be OK Mutual authentication and session key!
Part 1 Cryptography 108
Public Key Authentication and Session Key
Alice Bob
“I’m Alice”, R
[{R,K}Alice]Bob
[{R +1,K}Bob]Alice
Is this secure? Seems to be OK
o Though anyone can see {R,K}Alice and {R +1,K}Bob
Part 1 Cryptography 109
Perfect Forward Secrecy The concern…
o Alice encrypts message with shared key KAB and sends ciphertext to Bob
o Trudy records ciphertext and later attacks Alice’s (or Bob’s) computer to find KAB
o Then Trudy decrypts recorded messages Perfect forward secrecy (PFS): Trudy
cannot later decrypt recorded ciphertexto Even if Trudy gets key KAB or other secret(s)
Is PFS possible?
Part 1 Cryptography 110
Perfect Forward Secrecy Suppose Alice and Bob share key KAB For perfect forward secrecy, Alice
and Bob cannot use KAB to encrypt Instead they must use a session key
KS and forget it after it’s used Problem: How can Alice and Bob agree
on session key KS and insure PFS?
Part 1 Cryptography 111
Naïve Session Key Protocol
Trudy could also record E(KS,KAB) If Trudy gets KAB, she gets KS
Alice, KAB Bob, KAB
E(KS, KAB)
E(messages, KS)
Part 1 Cryptography 112
Perfect Forward Secrecy Can use Diffie-Hellman for PFS Recall Diffie-Hellman: public g and p
But Diffie-Hellman is subject to MiM How to get PFS and prevent MiM?
Alice, a Bob, b
ga mod p
gb mod p
Part 1 Cryptography 113
Perfect Forward Secrecy
Session key KS = gab mod p Alice forgets a, Bob forgets b Ephemeral Diffie-Hellman Not even Alice and Bob can later recover KS
Other ways to do PFS?
Alice, a Bob, b
E(ga mod p, KAB)
E(gb mod p, KAB)
Part 1 Cryptography 114
Mutual Authentication, Session Key and PFS
Alice Bob
“I’m Alice”, RA
RB, [{RA, gb mod p}Alice]Bob
[{RB, ga mod p}Bob]Alice
Session key is K = gab mod p Alice forgets a and Bob forgets b If Trudy later gets Bob’s and Alice’s secrets,
she cannot recover session key K
Part 1 Cryptography 115
Timestamps A timestamp T is the current time Timestamps used in many security protocols
(Kerberos, for example) Timestamps reduce number of messages
o Like a nonce that both sides know in advance But, use of timestamps implies that time is a
security-critical parameter Clocks never exactly the same, so must allow
for clock skew risk of replay How much clock skew is enough?
Part 1 Cryptography 116
Public Key Authentication with Timestamp T
Bob
“I’m Alice”, {[T,K]Alice}Bob
{[T +1,K]Bob}Alice
Alice
Is this secure? Seems to be OK
Part 1 Cryptography 117
Public Key Authentication with Timestamp T
Bob
“I’m Alice”, [{T,K}Bob]Alice
[{T +1,K}Alice]Bob
Alice
Is this secure? Trudy can use Alice’s public key to find {T,K}Bob and then…
Part 1 Cryptography 118
Public Key Authentication with Timestamp T
Bob
“I’m Trudy”, [{T,K}Bob]Trudy
[{T +1,K}Trudy]Bob
Trudy
Trudy obtains Alice-Bob session key K Note: Trudy must act within clock skew
Part 1 Cryptography 119
Public Key Authentication Sign and encrypt with nonce…
o Secure Encrypt and sign with nonce…
o Secure Sign and encrypt with timestamp…
o Secure Encrypt and sign with timestamp…
o Insecure Protocols can be subtle!
Part 1 Cryptography 120
Public Key Authentication with Timestamp T
Bob
“I’m Alice”, [{T,K}Bob]Alice
[{T +1}Alice]Bob
Alice Is this “encrypt and sign” secure? Yes, seems to be Does “sign and encrypt” also work here?
Part 1 Cryptography 121
Authentication and TCP
Part 1 Cryptography 122
TCP-based Authentication TCP not intended for use as an
authentication protocol But IP address in TCP connection
often used for authentication One mode of IPSec uses IP address
for authentication This can cause problems
Part 1 Cryptography 123
TCP 3-way Handshake
Alice Bob
SYN, SEQ a
SYN, ACK a+1, SEQ b
ACK b+1, data
Recall the TCP three way handshake Initial SEQ number must be random Why? See the next slide…
Part 1 Cryptography 124
TCP Authentication Attack
Alice
BobTrudy
1. SYN, SEQ = t (as Trudy)
2. SYN, ACK = t+1, SEQ = b1
3. SYN, SEQ = t (as Alice)
4. SYN, ACK = t+1, SEQ = b 2
5. ACK = b2+1, data
5.5.
5.
5.
Part 1 Cryptography 125
TCP Authentication Attack
Random SEQ numbersInitial SEQ numbers
Mac OS X
If initial SEQ numbers not very random… …possible to guess initial SEQ number… …and previous attack will succeed
Part 1 Cryptography 126
TCP Authentication Attack Trudy cannot see what Bob sends, but she can
send packets to server Bob, while posing as Alice Trudy must prevent Alice from receiving Bob’s
packets (or else connection will terminate) If password (or other authentication) required,
this attack fails If TCP connection is relied on for authentication,
then attack succeeds Bad idea to rely on TCP for authentication
Part 1 Cryptography 127
Best Authentication Protocol? What is best depends on many factors… The sensitivity of the application The delay that is tolerable The cost that is tolerable What crypto is supported
o Public key, symmetric key, hash functions Is mutual authentication required? Is a session key required? Is PFS a concern? Is anonymity a concern?, etc.
Part 1 Cryptography 128
Real-World Protocols Next, we’ll look at specific protocols
o SSL security on the Webo IPSec security at the IP layero Kerberos symmetric key systemo GSM mobile phone (in)security
Part 1 Cryptography 129
Secure Socket Layer
Part 1 Cryptography 130
Socket layer “Socket layer”
lives between application and transport layers
SSL usually lies between HTTP and TCP
application
transport
network
link
physical
Socket“layer”
OS
User
NIC
Part 1 Cryptography 131
What is SSL? SSL is the protocol used for most secure
transactions over the Internet For example, if you want to buy a book at
amazon.com…o You want to be sure you are dealing with
Amazon (authentication)o Your credit card information must be protected
in transit (confidentiality and/or integrity)o As long as you have money, Amazon doesn’t care
who you are (authentication need not be mutual)
Part 1 Cryptography 132
Simple SSL-like Protocol
Alice Bob
I’d like to talk to you securely
Here’s my certificate
{KAB}Bob
protected HTTP
Is Alice sure she’s talking to Bob? Is Bob sure he’s talking to Alice?
Part 1 Cryptography 133
Simplified SSL Protocol
Alice Bob
Can we talk?, cipher list, RA
Certificate, cipher, RB
{S}Bob, E(h(msgs,CLNT,K),K)
Data protected with key Kh(msgs,SRVR,K)
S is pre-master secret K = h(S,RA,RB) msgs = all previous messages CLNT and SRVR are constants
Part 1 Cryptography 134
SSL Keys 6 “keys” derived from K = hash(S,RA,RB)
o 2 encryption keys: send and receiveo 2 integrity keys: send and receiveo 2 IVs: send and receiveo Why different keys in each direction?
Q: Why is h(msgs,CLNT,K) encrypted (and integrity protected)?
A: It adds no security…
Part 1 Cryptography 135
SSL Authentication Alice authenticates Bob, not vice-versa
o How does client authenticate server?o Why does server not authenticate client?
Mutual authentication is possible: Bob sends certificate request in message 2o This requires client to have certificateo If server wants to authenticate client, server
could instead require (encrypted) password
Part 1 Cryptography 136
SSL MiM Attack
Alice Bob
RA
certificateT, RB
{S1}Trudy,E(X1,K1)
E(data,K1)h(Y1,K1)
Q: What prevents this MiM attack? A: Bob’s certificate must be signed by a
certificate authority (such as Verisign) What does Web browser do if sig. not
valid? What does user do if signature is not valid?
Trudy
RA
certificateB, RB
{S2}Bob,E(X2,K2)
E(data,K2)h(Y2,K2)
Part 1 Cryptography 137
SSL Sessions vs Connections SSL session is established as shown on
previous slides SSL designed for use with HTTP 1.0 HTTP 1.0 usually opens multiple simultaneous
(parallel) connections SSL session establishment is costly
o Due to public key operations SSL has an efficient protocol for opening
new connections given an existing session
Part 1 Cryptography 138
SSL Connection
Alice Bob
session-ID, cipher list, RA
session-ID, cipher, RB,
h(msgs,SRVR,K)
h(msgs,CLNT,K)
Protected data
Assuming SSL session exists So S is already known to Alice and Bob Both sides must remember session-ID Again, K = h(S,RA,RB)
No public key operations! (relies on known S)
Part 1 Cryptography 139
SSL vs IPSec IPSec discussed in next section
o Lives at the network layer (part of the OS)o Has encryption, integrity, authentication, etc.o Is overly complex (including serious flaws)
SSL (and IEEE standard TLS)o Lives at socket layer (part of user space)o Has encryption, integrity, authentication, etc.o Has a simpler specification
Part 1 Cryptography 140
SSL vs IPSec IPSec implementation
o Requires changes to OS, but no changes to applications SSL implementation
o Requires changes to applications, but no changes to OS SSL built into Web application early on (Netscape) IPSec used in VPN applications (secure tunnel) Reluctance to retrofit applications for SSL Reluctance to use IPSec due to complexity and
interoperability issues Result? Internet less secure than it should be!
Part 1 Cryptography 141
IPSec
Part 1 Cryptography 142
IPSec and SSL IPSec lives at
the network layer
IPSec is transparent to applications
application
transport
network
link
physical
SSL
OS
User
NIC
IPSec
Part 1 Cryptography 143
IPSec and Complexity IPSec is a complex protocol Over-engineered
o Lots of generally useless extra features Flawed
o Some serious security flaws Interoperability is serious challenge
o Defeats the purpose of having a standard! Complex Did I mention, it’s complex?
Part 1 Cryptography 144
IKE and ESP/AH Two parts to IPSec IKE: Internet Key Exchange
o Mutual authenticationo Establish shared symmetric keyo Two “phases” like SSL session/connection
ESP/AHo ESP: Encapsulating Security Payload for
encryption and/or integrity of IP packetso AH: Authentication Header integrity only
Part 1 Cryptography 145
IKE
Part 1 Cryptography 146
IKE IKE has 2 phases
o Phase 1 IKE security association (SA)o Phase 2 AH/ESP security association
Phase 1 is comparable to SSL session Phase 2 is comparable to SSL connection Not an obvious need for two phases in IKE If multiple Phase 2’s do not occur, then it is
more expensive to have two phases!
Part 1 Cryptography 147
IKE Phase 1 Four different “key” options
o Public key encryption (original version)o Public key encryption (improved version)o Public key signatureo Symmetric key
For each of these, two different “modes”o Main modeo Aggressive mode
There are 8 versions of IKE Phase 1! Evidence that IPSec is over-engineered?
Part 1 Cryptography 148
IKE Phase 1 We’ll discuss 6 of 8 phase 1 variants
o Public key signatures (main and aggressive modes)
o Symmetric key (main and aggressive modes)o Public key encryption (main and aggressive)
Why public key encryption and public key signatures?o Always know your own private keyo May not (initially) know other side’s public key
Part 1 Cryptography 149
IKE Phase 1 Uses ephemeral Diffie-Hellman to establish
session keyo Achieves perfect forward secrecy (PFS)
Let a be Alice’s Diffie-Hellman exponent Let b be Bob’s Diffie-Hellman exponent Let g be generator and p prime Recall p and g are public
Part 1 Cryptography 150
IKE Phase 1: Digital Signature (Main Mode)
CP = crypto proposed, CS = crypto selected IC = initiator “cookie”, RC = responder “cookie” K = h(IC,RC,gab mod p,RA,RB) SKEYID = h(RA, RB, gab mod p) proofA = [h(SKEYID,ga,gb,IC,RC,CP,“Alice”)]Alice
Alice Bob
IC, CPIC,RC, CS
IC,RC, ga mod p, RA
IC,RC, E(“Alice”, proofA, K)IC,RC, gb mod p, RB
IC,RC, E(“Bob”, proofB, K)
Part 1 Cryptography 151
IKE Phase 1: Public Key Signature (Aggressive Mode)
Main difference from main modeo Not trying to protect identitieso Cannot negotiate g or p
Alice Bob
IC, “Alice”, ga mod p, RA, CP
IC,RC, “Bob”, RB,
gb mod p, CS, proofB
IC,RC, proofA
Part 1 Cryptography 152
Main vs Aggressive Modes Main mode MUST be implemented Aggressive mode SHOULD be implemented
o In other words, if aggressive mode is not implemented, “you should feel guilty about it”
Might create interoperability issues For public key signature authentication
o Passive attacker knows identities of Alice and Bob in aggressive mode
o Active attacker can determine Alice’s and Bob’s identity in main mode
Part 1 Cryptography 153
IKE Phase 1: Symmetric Key (Main Mode)
Same as signature mode excepto KAB = symmetric key shared in advance o K = h(IC,RC,gab mod p,RA,RB,KAB)o SKEYID = h(K, gab mod p)o proofA = h(SKEYID,ga,gb,IC,RC,CP,“Alice”)
Alice Bob
IC, CPIC,RC, CS
IC,RC, ga mod p, RA
IC,RC, E(“Alice”, proofA, K)IC,RC, gb mod p, RB
IC,RC, E(“Bob”, proofB, K)
Part 1 Cryptography 154
Problems with Symmetric Key (Main Mode)
Catch-22o Alice sends her ID in message 5o Alice’s ID encrypted with Ko To find K Bob must know KAB
o To get KAB Bob must know he’s talking to Alice! Result: Alice’s ID must be IP address! Useless mode for the “road warrior” Why go to all of the trouble of trying to
hide identities in 6 message protocol?
Part 1 Cryptography 155
IKE Phase 1: SymmetricKey (Aggressive Mode)
Same format as digital signature aggressive mode Not trying to hide identities… As a result, does not have problems of main mode But does not (pretend to) hide identities
Alice Bob
IC, “Alice”, ga mod p, RA, CP
IC,RC, “Bob”, RB,
gb mod p, CS, proofB
IC,RC, proofA
Part 1 Cryptography 156
IKE Phase 1: Public Key Encryption (Main Mode)
CP = crypto proposed, CS = crypto selected IC = initiator “cookie”, RC = responder “cookie” K = h(IC,RC,gab mod p,RA,RB) SKEYID = h(RA, RB, gab mod p) proofA = h(SKEYID,ga,gb,IC,RC,CP,“Alice”)
Alice Bob
IC, CPIC,RC, CS
IC,RC, ga mod p, {RA}Bob, {“Alice”}Bob
IC,RC, E(proofA, K)IC,RC, gb mod p, {RB}Alice, {“Bob”}Alice
IC,RC, E(proofB, K)
Part 1 Cryptography 157
IKE Phase 1: Public Key Encryption (Aggressive Mode)
K, proofA, proofB computed as in main mode Note that identities are hidden
o The only aggressive mode to hide identitieso Then why have main mode?
Alice Bob
IC, CP, ga mod p,{“Alice”}Bob, {RA}Bob
IC,RC, CS, gb mod p, {“Bob”}Alice, {RB}Alice, proofB
IC,RC, proofA
Part 1 Cryptography 158
Public Key Encryption Issue? Public key encryption, aggressive mode Suppose Trudy generates
o Exponents a and bo Nonces RA and RB
Trudy can compute “valid” keys and proofs: gab mod p, K, SKEYID, proofA and proofB
Also true of main mode
Part 1 Cryptography 159
Public Key Encryption Issue?
Trudyas Alice
Trudyas Bob
Trudy can create exchange that appears to be between Alice and Bob
Appears valid to any observer, including Alice and Bob!
IC,RC, CS, gb mod p, {“Bob”}Alice, {RB}Alice, proofB
IC,RC, proofA
IC, CP, ga mod p,{“Alice”}Bob, {RA}Bob
Part 1 Cryptography 160
Plausible Deniability Trudy can create “conversation” that
appears to be between Alice and Bob Appears valid, even to Alice and Bob! A security failure? In this mode of IPSec, it is a feature
o Plausible deniability: Alice and Bob can deny that any conversation took place!
In some cases it might be a security failureo If Alice makes a purchase from Bob, she could
later repudiate it (unless she had signed)
Part 1 Cryptography 161
IKE Phase 1 Cookies Cookies (or “anti-clogging tokens”) supposed
to make denial of service more difficult No relation to Web cookies To reduce DoS, Bob wants to remain stateless
as long as possible But Bob must remember CP from message 1
(required for proof of identity in message 6) Bob must keep state from 1st message on! These cookies offer little DoS protection!
Part 1 Cryptography 162
IKE Phase 1 Summary Result of IKE phase 1 is
o Mutual authenticationo Shared symmetric keyo IKE Security Association (SA)
But phase 1 is expensive (in public key and/or main mode cases)
Developers of IKE thought it would be used for lots of things not just IPSec
Partly explains over-engineering…
Part 1 Cryptography 163
IKE Phase 2 Phase 1 establishes IKE SA Phase 2 establishes IPSec SA Comparison to SSL
o SSL session is comparable to IKE Phase 1o SSL connections are like IKE Phase 2
IKE could be used for lots of things But in practice, it’s not!
Part 1 Cryptography 164
IKE Phase 2
Key K, IC, RC and SA known from Phase 1 Proposal CP includes ESP and/or AH Hashes 1,2,3 depend on SKEYID, SA, RA and RB
Keys derived from KEYMAT = h(SKEYID,RA,RB,junk) Recall SKEYID depends on phase 1 key method Optional PFS (ephemeral Diffie-Hellman exchange)
Alice Bob
IC,RC,CP,E(hash1,SA,RA,K)
IC,RC,CS,E(hash2,SA,RB,K)
IC,RC,E(hash3,K)
Part 1 Cryptography 165
IPSec After IKE Phase 1, we have an IKE SA After IKE Phase 2, we have an IPSec SA Both sides have a shared symmetric key Now what?
o We want to protect IP datagrams But what is an IP datagram?
o From the perspective of IPSec…
Part 1 Cryptography 166
IP Review
Where IP header is
IP header data
IP datagram is of the form
Part 1 Cryptography 167
IP and TCP Consider HTTP traffic (over TCP) IP encapsulates TCP TCP encapsulates HTTP
IP header TCP hdr HTTP hdr app data
IP header data
IP data includes TCP header, etc.
Part 1 Cryptography 168
IPSec Transport Mode IPSec Transport Mode
IP header data
IP header ESP/AH data
Transport mode designed for host-to-host Transport mode is efficient
o Adds minimal amount of extra header The original header remains
o Passive attacker can see who is talking
Part 1 Cryptography 169
IPSec Tunnel Mode IPSec Tunnel Mode
IP header data
new IP hdr ESP/AH IP header data
Tunnel mode for firewall to firewall traffic Original IP packet encapsulated in IPSec Original IP header not visible to attacker
o New header from firewall to firewallo Attacker does not know which hosts are talking
Part 1 Cryptography 170
Comparison of IPSec Modes Transport Mode
Tunnel Mode
IP header data
IP header ESP/AH data
IP header data
new IP hdr ESP/AH IP header data
Transport Modeo Host-to-host
Tunnel Modeo Firewall-to-
firewall Transport mode
not necessary Transport mode
is more efficient
Part 1 Cryptography 171
IPSec Security What kind of protection?
o Confidentiality?o Integrity?o Both?
What to protect?o Data?o Header?o Both?
ESP/AH do some combinations of these
Part 1 Cryptography 172
AH vs ESP AH
o Authentication Headero Integrity only (no confidentiality)o Integrity-protect everything beyond IP header
and some fields of header (why not all fields?) ESP
o Encapsulating Security Payloado Integrity and confidentialityo Protects everything beyond IP headero Integrity only by using NULL encryption
Part 1 Cryptography 173
ESP’s NULL Encryption According to RFC 2410
o NULL encryption “is a block cipher the origins of which appear to be lost in antiquity”
o “Despite rumors”, there is no evidence that NSA “suppressed publication of this algorithm”
o Evidence suggests it was developed in Roman times as exportable version of Caesar’s cipher
o Can make use of keys of varying lengtho No IV is requiredo Null(P,K) = P for any P and any key K
Security people have a strange sense of humor!
Part 1 Cryptography 174
Why Does AH Exist? (1) Cannot encrypt IP header
o Routers must look at the IP headero IP addresses, TTL, etc.o IP header exists to route packets!
AH protects immutable fields in IP headero Cannot integrity protect all header fieldso TTL, for example, must change
ESP does not protect IP header at all
Part 1 Cryptography 175
Why Does AH Exist? (2) ESP encrypts everything beyond the IP
header (if non-null encryption) If ESP encrypted, firewall cannot look at
TCP header (e.g., port numbers) Why not use ESP with null encryption?
o Firewall sees ESP header, but does not know whether null encryption is used
o End systems know, but not firewalls Aside 1: Do firewalls reduce security? Aside 2: Is IPSec compatible with NAT?
Part 1 Cryptography 176
Why Does AH Exist? (3) The real reason why AH exists
o At one IETF meeting “someone from Microsoft gave an impassioned speech about how AH was useless…”
o “…everyone in the room looked around and said `Hmm. He’s right, and we hate AH also, but if it annoys Microsoft let’s leave it in since we hate Microsoft more than we hate AH.”
Part 1 Cryptography 177
Kerberos
Part 1 Cryptography 178
Kerberos In Greek mythology, Kerberos is 3-headed
dog that guards entrance to Hadeso “Wouldn’t it make more sense to guard the
exit?” In security, Kerberos is an authentication
system based on symmetric key cryptoo Originated at MITo Based on work by Needham and Schroedero Relies on a trusted third party (TTP)
Part 1 Cryptography 179
Motivation for Kerberos Authentication using public keys
o N users ⇒ N key pairs Authentication using symmetric keys
o N users requires about N2 keys Symmetric key case does not scale! Kerberos based on symmetric keys but only
requires N keys for N userso But must rely on TTPo Advantage is that no PKI is required
Part 1 Cryptography 180
Kerberos KDC Kerberos Key Distribution Center or KDC
o Acts as a TTPo TTP must not be compromised!o KDC shares symmetric key KA with Alice, key KB
with Bob, key KC with Carol, etc.o Master key KKDC known only to KDCo KDC enables authentication and session keyso Keys for confidentiality and integrityo In practice, the crypto algorithm used is DES
Part 1 Cryptography 181
Kerberos Tickets KDC issues a ticket containing info needed
to access a network resource KDC also issues ticket-granting tickets or
TGTs that are used to obtain tickets Each TGT contains
o Session keyo User’s IDo Expiration time
Every TGT is encrypted with KKDC
o TGT can only be read by the KDC
Part 1 Cryptography 182
Kerberized Login Alice enters her password Alice’s workstation
o Derives KA from Alice’s passwordo Uses KA to get TGT for Alice from the KDC
Alice can then use her TGT (credentials) to securely access network resources
Plus: Security is transparent to Alice Minus: KDC must be secure it’s trusted!
Part 1 Cryptography 183
Kerberized Login
Alice
Alice’sAlice wants
password a TGT
E(SA,TGT,KA)
KDC
Key KA derived from Alice’s password KDC creates session key SA
Workstation decrypts SA, TGT, forgets KA
TGT = E(“Alice”,SA, KKDC)
Computer
Part 1 Cryptography 184
Alice Requests Ticket to Bob
Alice
Talk to Bob
I want totalk to Bob
REQUEST
REPLY
KDC REQUEST = (TGT, authenticator) where
authenticator = E(timestamp,SA) REPLY = E(“Bob”,KAB,ticket to Bob, SA) ticket to Bob = E(“Alice”,KAB,KB) KDC gets SA from TGT to verify timestamp
Computer
Part 1 Cryptography 185
Alice Uses Ticket to Bob
ticket to Bob, authenticator
E(timestamp + 1,KAB)
ticket to Bob = E(“Alice”,KAB, KB) authenticator = E(timestamp, KAB) Bob decrypts “ticket to Bob” to get KAB which he
then uses to verify timestamp
Alice’s Computer
Bob
Part 1 Cryptography 186
Kerberos Session key SA used for authentication Can also be used for confidentiality/integrity Timestamps used for mutual authentication Recall that timestamps reduce number of
messageso Acts like a nonce that is known to both sideso Note: time is a security-critical parameter!
Part 1 Cryptography 187
Kerberos Questions When Alice logs in, KDC sends E(SA,TGT,KA)
where TGT = E(“Alice”,SA,KKDC)Q: Why is TGT encrypted with KA?A: Extra work and no added security!
In Alice’s Kerberized login to Bob, why can Alice remain anonymous?
Why is “ticket to Bob” sent to Alice? Where is replay prevention in Kerberos?
Part 1 Cryptography 188
Kerberos Alternatives Could have Alice’s workstation remember
password and use that for authenticationo Then no KDC requiredo But hard to protect password on workstationo Scaling problem
Could have KDC remember session key instead of putting it in a TGTo Then no need for TGTso But stateless KDC is big feature of Kerberos
Part 1 Cryptography 189
Kerberos Keys In Kerberos, KA = h(Alice’s password) Could instead generate random KA and
o Compute Kh = h(Alice’s password)o And workstation stores E(KA, Kh)
Then KA need not change (on workstation or KDC) when Alice changes her password
But E(KA, Kh) subject to password guessing This alternative approach is often used in
applications (but not in Kerberos)
Part 1 Cryptography 190
GSM Security
Part 1 Cryptography 191
Cell Phones First generation cell phones
o Analog, few standardso Little or no securityo Susceptible to cloning
Second generation cell phones: GSMo Began in 1982 as Groupe Speciale Mobileo Now, Global System for Mobile Communications
Third generation?o 3rd Generation Partnership Project (3GPP)
Part 1 Cryptography 192
GSM System Overview
Mobile
HomeNetwork
“land line”
air interface
BaseStation
BaseStation
Controller
PSTNInternet
Etc.Visited Network
VLR
HLR
AuC
Part 1 Cryptography 193
GSM System Components Mobile phone
o Contains SIM (Subscriber Identity Module)
SIM is the security moduleo IMSI (International Mobile
Subscriber ID)o User key Ki (128 bits)o Tamper resistant (smart card)o PIN activated (usually not used)
SIM
Part 1 Cryptography 194
GSM System Components Visited network network where mobile is
currently locatedo Base station one “cell”o Base station controller manages many cellso VLR (Visitor Location Register) info on all
visiting mobiles currently in the network Home network “home” of the mobile
o HLR (Home Location Register) keeps track of most recent location of mobile
o AuC (Authentication Center) contains IMSI/Ki
Part 1 Cryptography 195
GSM Security Goals Primary design goals
o Make GSM as secure as ordinary telephoneo Prevent phone cloning
Not designed to resist an active attack!o At the time this seemed infeasibleo Today such an attack is very feasible…
Designers considered biggest threatso Insecure billingo Corruptiono Other low-tech attacks
Part 1 Cryptography 196
GSM Security Features Anonymity
o Intercepted traffic does not identify usero Not so important to phone company
Authenticationo Necessary for proper billingo Very important to phone company!
Confidentialityo Confidentiality of calls over the air interfaceo Not important to phone companyo May be very important for marketing!
Part 1 Cryptography 197
GSM: Anonymity IMSI used to initially identify caller Then TMSI (Temporary Mobile Subscriber
ID) used TMSI changed frequently TMSI’s encrypted when sent Not a strong form of anonymity But probably sufficient for most uses
Part 1 Cryptography 198
GSM: Authentication Caller is authenticated to base station Authentication is not mutual Authentication via challenge-response
o Home network generates RAND and computes XRES = A3(RAND, Ki) where A3 is a hash
o Then (RAND,XRES) sent to base stationo Base station sends challenge RAND to mobileo Mobile’s response is SRES = A3(RAND, Ki)o Base station verifies SRES = XRES
Note: Ki never leaves home network!
Part 1 Cryptography 199
GSM: Confidentiality Data encrypted with stream cipher Error rate estimated at about 1/1000
o Error rate too high for a block cipher Encryption key Kc
o Home network computes Kc = A8(RAND, Ki), where A8 is a hash
o Then Kc sent to base station with (RAND,XRES)o Mobile computes Kc = A8(RAND, Ki)o Keystream generated from A5(Kc)
Note: Ki never leaves home network!
Part 1 Cryptography 200
GSM Security
SRES and Kc must be uncorrelatedo Even though both are derived from RAND and Ki
Must not be possible to deduce Ki from known RAND/SRES pairs (known plaintext attack)
Must not be possible to deduce Ki from chosen RAND/SRES pairs (chosen plaintext attack)o With possession of SIM, attacker can choose RAND’s
Mobile Base Station
4. RAND
5. SRES
6. Encrypt with Kc
1. IMSI
HomeNetwork
3. (RAND,XRES,Kc)
2. IMSI
Part 1 Cryptography 201
GSM Insecurity (1) Hash used for A3/A8 is COMP128
o Broken by 160,000 chosen plaintextso With SIM, can get Ki in 2 to 10 hours
Encryption between mobile and base station but no encryption from base station to base station controllero Often transmitted over microwave link
Encryption algorithm A5/1o Broken with 2 seconds of known plaintext
BaseStation
BaseStation
Controller
VLR
Part 1 Cryptography 202
GSM Insecurity (2) Attacks on SIM card
o Optical Fault Induction can attack SIM with a flashbulb to recover Ki
o Partitioning Attacks using timing and power consumption, can recover Ki with only 8 adaptively chosen “plaintexts”
With possession of SIM, attacker can recover Ki in seconds
Part 1 Cryptography 203
GSM Insecurity (3) Fake base station exploits two flaws
o Encryption not automatico Base station not authenticated
Mobile Base Station
RAND
SRES
Fake Base Station
Noencryption
Call todestination
Note: The bill goes to fake base station!
Part 1 Cryptography 204
GSM Insecurity (4) Denial of service is possible
o Jamming (always an issue in wireless) Base station can replay triple
(RAND,XRES,Kc)o One compromised triple gives attacker a
key Kc that is valid forevero No replay protection!
Part 1 Cryptography 205
GSM Conclusion Did GSM achieve its goals?
o Eliminate cloning? Yeso Make air interface as secure as PSTN? Perhaps…o But design goals were clearly too limited
GSM insecurities weak crypto, SIM issues, fake base station, replay, etc.
PSTN insecurities tapping, active attack, passive attack (e.g., cordless phones), etc.
GSM a (modest) security success?
Part 1 Cryptography 206
3GPP: 3rd Generation Partnership Project
3G security built on GSM (in)security 3G fixes known GSM security problems
o Mutual authenticationo Integrity protect signaling (such as “start
encryption” command)o Keys (encryption/integrity) cannot be reusedo Triples cannot be replayedo Strong encryption algorithm (KASUMI)o Encryption extended to base station controller
Part 1 Cryptography 207
Protocols Summary Generic authentication protocols
o Protocols can be very subtle! SSL IPSec Kerberos GSM