Chapter 8: Network Security

1. Chapter goals: understand principles of network security: cryptography and its many uses beyond “confidentiality” authentication message integrity security in practice: firewalls and intrusion detection systems security in application, transport, network, link layers Chapter 8: Network Security 8: Network Security

2. Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS 8: Network Security

3. Friends and enemies: Alice, Bob, Trudy • well-known in network security world • Bob, Alice (lovers!) want to communicate “securely” • Trudy (intruder) may intercept, delete, add messages Alice Bob data, control messages channel secure sender secure receiver data data Trudy 8: Network Security

4. There are bad guys (and girls) out there! Q: What can a “bad guy” do? A: a lot! • eavesdrop: intercept messages • actively insert messages into connection • impersonation: can fake (spoof) source address in packet (or any field in packet) • hijacking: “take over” ongoing connection by removing sender or receiver, inserting himself in place • denial of service: prevent service from being used by others (e.g., by overloading resources) 8: Network Security

5. What is network security? Confidentiality: only sender, intended receiver should “understand” message contents • sender encrypts message • receiver decrypts message Authentication: sender, receiver want to confirm identity of each other Message integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection Access and availability: services must be accessible and available to users 8: Network Security

6. Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS 8: Network Security

7. K K A B The language of cryptography Alice’s encryption key Bob’s decryption key symmetric key crypto: sender, receiver keys identical public-key crypto: encryption key public, decryption key secret (private) encryption algorithm decryption algorithm ciphertext plaintext plaintext 8: Network Security

8. Symmetric key cryptography substitution cipher: substituting one thing for another • monoalphabetic cipher: substitute one letter for another plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasdfghjklpoiuytrewq E.g.: Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc Key: the mapping from the set of 26 letters to the set of 26 letters • Q: How hard to break this simple cipher?: • brute force (how hard?) or other? 8: Network Security

9. Polyalphabetic encryption • n monoalphabetic cyphers, M1,M2,…,Mn • Cycling pattern: • e.g., n=5, M1,M3,M4,M3,M2; M1,M3,M4,M3,M2; • For each new plaintext symbol, use subsequent monoalphabetic pattern in cyclic pattern • dog: d from M1, o from M3, g from M4 • Key: the n ciphers and the cyclic pattern

10. K K A-B A-B K (m) m = K ( ) A-B A-B Symmetric key cryptography symmetric key crypto: Bob and Alice share know same (symmetric) key: K • e.g., key is knowing substitution pattern in mono alphabetic substitution cipher • Q: how do Bob and Alice agree on key value? encryption algorithm decryption algorithm ciphertext plaintext plaintext message, m K (m) A-B A-B 8: Network Security

11. Two types of symmetric ciphers • Stream ciphers • encrypt one bit at time • Block ciphers • Break plaintext message in equal-size blocks • Encrypt each block as a unit

12. Stream Ciphers pseudo random • Combine each bit of keystream with bit of plaintext to get bit of ciphertext • m(i) = ith bit of message • ks(i) = ith bit of keystream • c(i) = ith bit of ciphertext • c(i) = ks(i)  m(i) ( = exclusive or) • m(i) = ks(i)  c(i) keystream generator key keystream

13. RC4 Stream Cipher • RC4 is a popular stream cipher • Extensively analyzed and considered good • Key can be from 1 to 256 bytes • Used in WEP for 802.11 • Can be used in SSL

14. Block ciphers • How many possible mappings are there for k=3? • How many 3-bit inputs? • How many permutations of the 3-bit inputs? • Answer: 40,320 ; not very many! • In general, 2k! mappings; huge for k=64 • Problem: • Table approach requires table with 264 entries, each entry with 64 bits • Table too big: instead use function that simulates a randomly permuted table

15. From Kaufman et al 64-bit input 8bits 8bits 8bits 8bits 8bits 8bits 8bits 8bits S5 S6 S7 S8 S2 S4 S3 S1 8 bits 8 bits 8 bits 8 bits 8 bits 8 bits 8 bits 8 bits 64-bit intermediate Loop for n rounds 64-bit output Prototype function 8-bit to 8-bit mapping

16. Why rounds in prototpe? • If only a single round, then one bit of input affects at most 8 bits of output. • In 2nd round, the 8 affected bits get scattered and inputted into multiple substitution boxes. • How many rounds? • How many times do you need to shuffle cards • Becomes less efficient as n increases

17. DES operation Symmetric key crypto: DES initial permutation 16 identical “rounds” of function application, each using different 48 bits of key final permutation 8: Network Security

18. Symmetric key crypto: DES DES: Data Encryption Standard • US encryption standard [NIST 1993] • 56-bit symmetric key, 64-bit plaintext input • How secure is DES? • DES Challenge: 56-bit-key-encrypted phrase (“Strong cryptography makes the world a safer place”) decrypted (brute force) in 4 months • no known “backdoor” decryption approach • making DES more secure: • use three keys sequentially (3-DES) on each datum • use cipher-block chaining 8: Network Security

19. AES: Advanced Encryption Standard • new (Nov. 2001) symmetric-key NIST standard, replacing DES • processes data in 128 bit blocks • 128, 192, or 256 bit keys • brute force decryption (try each key) taking 1 sec on DES, takes 149 trillion years for AES 8: Network Security

20. Public key cryptography symmetric key crypto • requires sender, receiver know shared secret key • Q: how to agree on key in first place (particularly if never “met”)? public key cryptography • radically different approach [Diffie-Hellman76, RSA78] • sender, receiver do not share secret key • public encryption key known to all • private decryption key known only to receiver 8: Network Security

21. + K (m) B - + m = K (K (m)) B B Public key cryptography + Bob’s public key K B - Bob’s private key K B encryption algorithm decryption algorithm plaintext message plaintext message, m ciphertext 8: Network Security

22. K (K (m)) = m B B - + 2 1 Public key encryption algorithms Requirements: need K ( ) and K ( ) such that . . + - B B + given public key K , it should be impossible to compute private key K B - B RSA: Rivest, Shamir, Adleman algorithm 8: Network Security

23. + - K K B B RSA: Choosing keys 1. Choose two large prime numbers p, q. (e.g., 1024 bits each) 2. Compute n = pq, z = (p-1)(q-1) 3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”). 4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5.Public key is (n,e).Private key is (n,d). 8: Network Security

24. 1. To encrypt bit pattern, m, compute d e m = c mod n c = m mod n e (i.e., remainder when m is divided by n) d e m = (m mod n) mod n RSA: Encryption, decryption 0. Given (n,e) and (n,d) as computed above 2. To decrypt received bit pattern, c, compute d (i.e., remainder when c is divided by n) Magic happens! c 8: Network Security

25. d e m = c mod n c = m mod n d c RSA example: Bob chooses p=5, q=7. Then n=35, z=24. e=5 (so e, z relatively prime). d=29 (so ed-1 exactly divisible by z. e m m letter encrypt: l 17 1524832 12 c letter decrypt: 17 12 l 481968572106750915091411825223071697 8: Network Security

26. Prerequisite: modular arithmetic • x mod n = remainder of x when divide by n • Facts: [(a mod n) + (b mod n)] mod n = (a+b) mod n [(a mod n) - (b mod n)] mod n = (a-b) mod n [(a mod n) * (b mod n)] mod n = (a*b) mod n • Thus (a mod n)d mod n = ad mod n • Example: x=14, n=10, d=2:(x mod n)d mod n = 42 mod 10 = 6xd = 142 = 196 xd mod 10 = 6 8: Network Security

27. e d ed (m mod n) mod n = m mod n ed mod (p-1)(q-1) 1 = m = m mod n = m mod n y y mod (p-1)(q-1) d e x mod n = x mod n m = (m mod n) mod n RSA: Why is that Useful number theory result: If p,q prime and n = pq, then: (using number theory result above) (since we choseed to be divisible by (p-1)(q-1) with remainder 1 ) 8: Network Security

28. K (K (m)) = m - B B + K (K (m)) - + = B B RSA: another important property The following property will be very useful later: use private key first, followed by public key use public key first, followed by private key Result is the same! 8: Network Security

29. K (K (m)) = m - B B + K (K (m)) - + = B B Why is RSA Secure? Why ? Follows directly from modular arithmetic: (me mod n)d mod n = med mod n = mde mod n = (md mod n)e mod n • Suppose you know Bob’s public key (n,e). How hard is it to determine d? • Essentially need to find factors of n without knowing the two factors p and q. • Fact: factoring a big number is hard.

30. Still Need Secret Session keys • Exponentiation is computationally intensive • DES is at least 100 times faster than RSA Session key, KS • Bob and Alice use RSA to exchange a symmetric key KS • Once both have KS, they use symmetric key cryptography 8: Network Security

31. Chapter 8 roadmap 8.1What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS 8: Network Security

32. Bob receives msg from Alice, wants to ensure: message originally came from Alice message not changed since sent by Alice Cryptographic Hash: takes input m, produces fixed length value, H(m) e.g., as in Internet checksum computationally infeasible to find two different messages, x, y such that H(x) = H(y) equivalently: given m = H(x), (x unknown), can not determine x. note: Internet checksum fails this requirement! Message Integrity 8: Network Security

33. Internet checksum: poor crypto hash function Internet checksum has some properties of hash function: • produces fixed length digest (16-bit sum) of message • is many-to-one But given message with given hash value, it is easy to find another message with same hash value: ASCII format message ASCII format message I O U 9 0 0 . 1 9 B O B 49 4F 55 39 30 30 2E 31 39 42 4F 42 I O U 1 0 0 . 9 9 B O B 49 4F 55 31 30 30 2E 39 39 42 4F 42 B2 C1 D2 AC B2 C1 D2 AC different messages but identical checksums! 8: Network Security

34. Computationally expensive to public-key-encrypt long messages Goal: fixed-length, easy- to-compute digital “fingerprint” apply hash function H to m, get fixed size message digest, H(m). Hash function properties: many-to-1 But given message digest x = H(m), it’s infeasible to find m’ that H(m’) = H(m) Data integrity: cannot replace m with m’ Message Digests large message m H: Hash Function H(m) Ch8

35. H(.) public Internet m m m append H(.) H(m+s) H(m+s) H(m+s) H(m+s) compare Message Authentication Code (shared secret) s (message) s (shared secret) 8: Network Security

36. HMAC • Popular MAC standard • Addresses some subtle security flaws • Concatenates secret to front of message. • Hashes concatenated message • Concatenates the secret to front of digest • Hashes the combination again.

37. MD5 hash function widely used (RFC 1321) computes 128-bit MAC in 4-step process. arbitrary 128-bit string x, appears difficult to construct msg m whose MD5 hash is equal to x recent (2005) attacks on MD5 SHA-1 is also used US standard [NIST, FIPS PUB 180-1] 160-bit MAC Partial attack MACs in practice 8: Network Security

38. cryptographic technique analogous to hand-written signatures. sender (Bob) digitally signs document, establishing he is document owner/creator. verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document Digital Signatures 8: Network Security

39. simple digital signature for message m: Bob “signs” m by encrypting with his private key KB, creating “signed” message, KB(m) - - K K B B Digital Signatures - - Bob’s private key Bob’s message, m (m) Dear Alice Oh, how I have missed you. I think of you all the time! …(blah blah blah) Bob Bob’s message, m, signed (encrypted) with his private key public key encryption algorithm 8: Network Security

40. suppose Alice receives msg m, digital signature KB(m) Alice verifies m signed by Bob by applying Bob’s public key KB to KB(m) then checks KB(KB(m) ) = m. if KB(KB(m) ) = m, whoever signed m must have used Bob’s private key. Alice thus verifies that: Bob signed m. No one else signed m. Bob signed m and not m’. non-repudiation: Alice can take m, and signature KB(m) to court and prove that Bob signed m. Digital Signatures (more) - - - + + - + - 8: Network Security

41. Digital signature = signed MAC H: hash function H: hash function large message m large message m + - digital signature (decrypt) digital signature (encrypt) K K B B encrypted msg digest encrypted msg digest + - - KB(H(m)) KB(H(m)) H(m) H(m) Bob sends digitally signed message: Alice verifies signature and integrity of digitally signed message: H(m) Bob’s private key Bob’s public key equal ? 8: Network Security

42. Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap1.0:Alice says “I am Alice” “I am Alice” Failure scenario?? 8: Network Security

43. Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap1.0:Alice says “I am Alice” in a network, Bob can not “see” Alice, so Trudy simply declares herself to be Alice “I am Alice” 8: Network Security

44. Alice’s IP address “I am Alice” Authentication: another try Protocol ap2.0:Alice says “I am Alice” in an IP packet containing her source IP address Failure scenario?? 8: Network Security

45. Alice’s IP address “I am Alice” Authentication: another try Protocol ap2.0:Alice says “I am Alice” in an IP packet containing her source IP address Trudy can create a packet “spoofing” Alice’s address 8: Network Security

46. Alice’s password Alice’s IP addr “I’m Alice” Alice’s IP addr OK Authentication: another try Protocol ap3.0:Alice says “I am Alice” and sends her (encrypted) secret password to “prove” it. Failure scenario?? 8: Network Security

47. Alice’s password Alice’s IP addr “I’m Alice” Alice’s IP addr OK Authentication: another try Protocol ap3.0:Alice says “I am Alice” and sends her (encrypted) secret password to “prove” it. Alice’s password Alice’s IP addr “I’m Alice” playback attack: Trudy records Alice’s packet and later plays it back to Bob 8: Network Security

48. K (R) A-B Authentication: yet another try Goal:avoid playback attack Nonce:number (R) used only once –in-a-lifetime ap4.0:to prove Alice “live”, Bob sends Alice nonce, R. Alice must return R, encrypted with shared secret key “I am Alice” R Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice! Failures, drawbacks? 8: Network Security

49. Two-way Authentication 1 Request from Alice 2 & 4 Challege (a nonce) from Bob & Alice, resp 3 & 5 Response from Alice & Bob, resp (authenticated afterwards) Ch8

50. What if we do it in three steps? • Alice request and challenges Bob first • Bob responses (and get authenticated) and challenges Alice next • Alice responses (is she authenticated?) Ch8