Computer and Internet Security

1. Computer and Internet Security

2. Introduction • Both individuals and companies are vulnerable to data theft and hacker attacks that can compromise data, corrupt files and crash systems. • For these reasons, security is crucial to the success of e-business and Web services.

3. Introduction • Five fundamental requirements for a successful, secure transaction: • Privacy • How do you ensure that the information you transmit over the Internet has not been captured or passed to a third party without your knowledge? • Integrity • How do you ensure that the information you send or receive has not been compromised or altered? • Authentication • How do the sender and receiver of a message verify their identities to each other?

4. Introduction • Authorization • How do you manage access to protected resources on the basis of user credentials? • Non-repudiation. • How do you legally prove that a message was sent or received?

5. Ancient Ciphers to Modern Cryptosystems • Cryptography • Transforms data using a cipher • Cryptosystem • A mathematical algorithm for encrypting messages • A key • A string of digits that acts as a password • Input to the cipher • Unencrypted data is called plaintext; encrypted data is called ciphertext.

6. Ancient Ciphers • The two main types of ciphers were • substitution ciphers (Caesar Cipher) • “abc”  “def” • transposition ciphers • “security”  “scrt euiy” • Complicated ciphers combination of substitution ciphers transposition ciphers. • E.g., using the substitution cipher in transposition cipher, the word "security" would encrypt to "tdsu fvjz”. • Problem of many historical ciphers • their security relied on the sender and receiver to remember the encryption algorithm and keep it secret.

7. Modern Cryptosystems • Modern cryptosystems are digital. • Their algorithms are based on the individual bits or blocks (a group of bits) of a message, rather than letters of alphabet. • Encryption and decryption keys are binary strings with a given key length. • For example, 128-bit encryption systems have a key length of 128 bits.

8. K K A B The language of cryptography Alice’s encryption key Bob’s decryption key symmetric key crypto: sender, receiver keys identical public-key crypto: encryption key public, decryption key secret (private) encryption algorithm decryption algorithm ciphertext plaintext plaintext Network Security

9. Secret-Key Cryptography • In the past, organizations wishing to maintain a secure computing symmetric cryptography, also known as secret-key cryptography. • Uses the same secret key to encrypt and decrypt a message

10. secret-key cryptography

11. Secret-Key Cryptography • Have to find a secure way to exchange the secret key before communications • What is the best method? (use FedEx? What are the problems for it?) • Not efficient • Not secure • Authentication problem • Etc.

12. Secret-Key Cryptography • Another way • Have a central authority - an key distribution center (KDC)

13. Secret-Key Cryptography - Data Encryption Standard (DES) • One of the most commonly used symmetric encryption algorithms • Using block cipher • DES has a key length of 56 bits and encrypts data in 64-bit blocks.

14. Public-Key Cryptography • Developed by Whitfield Diffie and Martin Hellman in 1976 at Stanford University. • Two keys • a public key • Freely distributed to outside world • a private key • Kept secret by its owner

15. Public-Key Cryptography

16. + K (m) B - + m = K (K (m)) B B Public key cryptography + Bob’s public key K B - Bob’s private key K B encryption algorithm decryption algorithm plaintext message plaintext message, m ciphertext Network Security

17. RSA Algorithm • RSA – the most commonly used public-key algorithm • Developed by MIT professors Ron Rivest, Adi Shamir, and Leonard Adleman in 1977 • Play an important and crucial role in e-Commerce transactions

18. K (K (m)) = m B B - + 2 1 Public key encryption algorithms Requirements: need K ( ) and K ( ) such that . . + - B B + given public key K , it should be impossible to compute private key K B - B RSA: Rivest, Shamir, Adelson algorithm Network Security

19. + - K K B B RSA: Choosing keys 1. Choose two large prime numbers p, q. (e.g., 1024 bits each) 2. Compute n = pq, z = (p-1)(q-1) 3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”). 4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5.Public key is (n,e).Private key is (n,d). Network Security

20. 1. To encrypt bit pattern, m, compute d e m = c mod n c = m mod n e (i.e., remainder when m is divided by n) d e m = (m mod n) mod n RSA: Encryption, decryption 0. Given (n,e) and (n,d) as computed above 2. To decrypt received bit pattern, c, compute d (i.e., remainder when c is divided by n) Magic happens! c Network Security

21. K (K (m)) = m - B B + K (K (m)) - + = B B RSA: another important property The following property will be very useful later: use private key first, followed by public key use public key first, followed by private key Result is the same! Network Security

22. Authentication using public-key algorithm

23. K (R) A-B Authentication: yet another try Goal:avoid playback attack Nonce:number (R) used only once –in-a-lifetime ap4.0:to prove Alice “live”, Bob sends Alice nonce, R. Alice must return R, encrypted with shared secret key “I am Alice” R Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice! Failures, drawbacks? Network Security

24. Key Agreement Protocols • A drawback of public-key algorithm– not efficient for sending large amounts of data. • Public key algorithms are not used to replace secret-key algorithm • Use Public key algorithms to exchange secret keys securely. • Key Agreement Protocol • The process by which two parties can exchange keys over unsecure medium

25. Digital Envelope • The most common key agreement protocol

26. Key Management • Maintaining the secrecy of private keys is crucial for keeping cryptographic systems secure. • Most compromises in security result from poor key management • Key generation • The process by which keys are created

27. Key Management • Brute-force cracking • Try to decrypt a message by using every possible decryption key • If the subset is too small for key generation, then the encrypted data is more susceptible to brute-force attacks Have a key-generation program that can generate a large number of keys as randomly as possible

28. Digital Signatures • The electronic equivalents of written signatures • Developed to be used in public-key cryptography to solve the problems of authentication and integrity • To create a digital signature, a sender first takes the original plaintext message and runs it through a hash function, which is a mathematical calculation that gives the message a hash value

29. Digital Signatures • A hash value identifies a message uniquely. • The hash value is also known as a message digest • Message integrity • If the hash value of the original message matches the message digest included in the signature • The message has not been altered in transmission.

30. Cryptographic technique analogous to hand-written signatures. sender (Bob) digitally signs document, establishing he is document owner/creator. verifiable, nonforgetable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document Digital Signatures

31. Simple digital signature for message m: Bob signs m by encrypting with his private key KB, creating “signed” message, KB(m) - - K K B B Digital Signatures - - Bob’s private key Bob’s message, m (m) Dear Alice Oh, how I have missed you. I think of you all the time! …(blah blah blah) Bob Bob’s message, m, signed (encrypted) with his private key Public key encryption algorithm

32. Suppose Alice receives msg m, digital signature KB(m) Alice verifies m signed by Bob by applying Bob’s public key KB to KB(m) then checks KB(KB(m) ) = m. If KB(KB(m) ) = m, whoever signed m must have used Bob’s private key. Alice thus verifies that: Bob signed m. No one else signed m. Bob signed m and not m’. Non-repudiation: Alice can take m, and signature KB(m) to court and prove that Bob signed m. Digital Signatures (more) - - - + + - + -

33. Computationally expensive to public-key-encrypt long messages Goal: fixed-length, easy- to-compute digital “fingerprint” apply hash function H to m, get fixed size message digest, H(m). Hash function properties: many-to-1 produces fixed-size msg digest (fingerprint) given message digest x, computationally infeasible to find m such that x = H(m) Message Digests large message m H: Hash Function H(m)

34. Digital signature = signed message digest H: Hash function H: Hash function large message m large message m + - digital signature (decrypt) digital signature (encrypt) K K B B encrypted msg digest encrypted msg digest + - - KB(H(m)) KB(H(m)) H(m) H(m) Bob sends digitally signed message: Alice verifies signature and integrity of digitally signed message: H(m) Bob’s private key Bob’s public key equal ?

35. + + digital signature (encrypt) K K B B K CA Certification Authorities • Certification authority (CA): binds public key to particular entity, E. • E (person, router) registers its public key with CA. • E provides “proof of identity” to CA. • CA creates certificate binding E to its public key. • certificate containing E’s public key digitally signed by CA – CA says “this is E’s public key” Bob’s public key CA private key certificate for Bob’s public key, signed by CA - Bob’s identifying information

36. + + digital signature (decrypt) K K B B K CA Certification Authorities • When Alice wants Bob’s public key: • gets Bob’s certificate (Bob or elsewhere). • apply CA’s public key to Bob’s certificate, get Bob’s public key Bob’s public key CA public key +

37. Secure Sockets Layer (SSL) • Currently, most e-businesses use SSL for secure online transactions • The Secure Sockets Layer (SSL) protocol is a non-proprietary protocol commonly used to secure communication betweens two computers on the Internet and the Web. • Use TCP/IP in the sockets

38. Secure Sockets Layer (SSL) • In a transaction using SSL, the sockets are secured using public-key cryptography. • SSL implements public-key cryptography using the RSA algorithm and digital certificates to authenticate the server in a transaction and to protect private information as it passes over the Internet.

39. Secure Sockets Layer (SSL) Client Server Socket Socket • Encrypt packets with server’s public key • Send packets to the server • Receive packets from the client • Decrypt packets with server’s private key

40. Security Attacks • Denial-of-Service (DoS) Attacks • Viruses and Worms • Eavesdrop: intercept messages • Actively insert messages into connection • Impersonation: can fake (spoof) source address in packet (or any field in packet) • Hijacking: “take over” ongoing connection by removing sender or receiver, inserting himself in place

41. Network Security • Firewalls • Intrusion Detection Systems • Steganography • Hiding information within other information