Network Security

1. Network Security

2. Network Security • Information secrecy-only specified parties know the information exchanged. Provided by criptography. • Information integrity-the information is unaltered received by the specified party. Provided by digital signatures. • Authenticaton-user is communicating with the user with whom he/she thinks is communicating.

3. Cryptography • The encryption model (for a symmetric-key cipher).

4. Symmetric-Key Algorithms • Transmitting and receiving users have the same key that they agreed on somehow. • Plain text, P, is encrypted by the transmitting user based on key, K, and becomes EK(P). Receiver is decrypting EK(P) using the same key, and obtains plaintext P=DK(EK(P)). Function P is impossible (or very hard) to guess from EK(P). • DES – Data Encryption Standard • Key has 64 bits • AES – Advanced Encryption Standard • Key has 128 bits

5. Public-Key Algorithms • Each user has a public and a private key. • Plain text, P, is encrypted by the transmitting user based on the public key of the receiving user, Bpub, and becomes EBpub(P). • Receiving user is decrypting the message using its private key Bpri and obtains plaintext P=DBpri(EBpub(P)).

6. Public-Key Algorithms • RSA (Rivest,Shamir, Adleman) • Choose two large prime numbers p and q (typically 1024 bits) • Compute n=pxq and z=(p-1)x(q-1) • Choose a number relatively prime to z and call it d. • Find e such that exd=1mod z • Public key is (n,e), private key is (n,d) • Encryption is C=Pemod n • Decryption is P=Cd mod n

7. Learning Shared Keys • Encryption using a symmetric shared key is much faster. Users can exchange the shared key, either by using public keys or key distribution centers (KDC). • Transmitting user encrypts the shared-key using public key of the receiving user. Receiving user decrypts the message and learns the shared key. • KDC has a key for each user. User A sends encrypted request that it wants to communicate with user B. KDC sends the shared key, S, and encrypted pair EB(A,S).

8. Digital Signatures • Ensure to the receiving party that it is receive the exact information that was sent my the transmitting party. • For example, transmitting user adds to the plaintext the signature which is the encrypted plaintext using its private key. Receiving user decrypts the signature using the public key of the transmitting user, and compares with the plaintext.

9. Public-Key Signatures P ,P ,P ,P) • Digital signatures using public-key cryptography.

10. Digital Signatures Using Message Digests (MD5,SHA-1) • Forming the signature by encrypting the entire plaintext is time consuming, and incurs an inefficient communication. • For this reason, a message digest is derived from the plaintext (message). Message digest is a function of the plaintext such that it is computationaly infeasible to find two messages with the same message digest (hash). Singature is encrypted hash. • Since the message digest is much shorter than the message itself, the signature takes less time to compute and less bandwidth to transfer.

11. Authentication Protocol(Shared Key) • User A sends to user B “I am A”, and nonce RA. • B sends a nonce RB and HASH(RA,RB,A,B,S) to A. • A sends HASH(RA,RB,S) and sends it to B

12. Authentication Protocol(Public Key) • User A sends to user B “I am A”, and RA. • B sends a nonce RBand EBpriv(RA,RB,A,B) to A. • A decrypts encrypted part of the message to check if it is B and sends encrypted nonces using its private key EApriv(RA,RB) and sends it to B. • B decrypts encrypted message and checks if this is really A.

13. Management of Public Keys • How users learn real public keys of other users. • Certificate comprises the public key and basic data about some user, and is signed by the certificate authority (CA). • X.509 defines certificate’s format. • Public key infrastructures comprises CAs that are organized hierarchicaly.

14. Certificates + Alg for hashing, Certificate Authority, Time validity • A possible certificate and its signed hash.

15. Public-Key Infrastructures • (a) A hierarchical PKI. (b) A chain of certificates.

16. Network Security in Practice • IPsec • Firewalls • Virtual Private Networks (VPNs) • E-mail security (Pretty Good Privacy-PGP) • DNS security • WWW security (Secure Sockets Layer-SSL)

17. IPsec based onAuthentication Header Protocol Determines security association with IP source address and security protocol Using encrypted message disgest based on a shared key • The IPsec authentication header in transport mode for IPv4.

18. IPsec based onEncapsulation Security Payload Protocol • (a) ESP in transport mode. (b) ESP in tunnel mode.

19. Firewalls • Two types: packet filtering, and application gateways. • Packet filtering is done based on IP addresses, TCP or UDP ports, ICMP message type, TCP SYN or ACK bits (first segment has ACK=0 so this prevents outside users to open TCP connections with inside servers). • Application gateways may restrict certain applications to certain users.

20. Virtual Private Networks • (a) A leased-line private network. (b) A virtual private network.

21. E-mail SecurityPGP – Pretty Good Privacy International Data Encryption Alg • PGP in operation for sending a message.

22. Secure DNS An example RRSet for bob.com. The KEY record is Bob's public key. The SIG record is the top-level com server's signed hash of A and KEY records to verify their authenticity.

23. SSL • A simplified version of the SSL connection establishment subprotocol.