1 / 34

Web security

Web security. Applications. Email electronic commerce electronic voting homework submission E-bank Paper submission. Security Requirments. Authentication : identifying someone (or something) reliably. Proving you are who you say you are. Authorization : permission to access a resource.

lucas
Download Presentation

Web security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Web security

  2. Applications • Email • electronic commerce • electronic voting • homework submission • E-bank • Paper submission

  3. Security Requirments • Authentication: identifying someone (or something) reliably. Proving you are who you say you are. • Authorization: permission to access a resource. • Integrity: data has not changed by someone else. • Confidentiality: data is only received by the target

  4. Terminology • Encryption: Scramble data so that only someone with a secret can make sense of the data. • Decryption: Descrambling encrypted data. • DES: Data Encryption Standard: secret key cryptographic function standardized by NBS (NIST). • AES: Advanced Encryption Standard: recent standard for symmetric cryptography

  5. Terminology (cont.) • Secret Key Cryptography: a cryptographic scheme where the same key is used to encrypt and decrypt data. Also called symmetric encryption. • Public Key Cryptography: a cryptographic scheme where different keys are used for encryption and decryption (asymmetric).

  6. Terminology (more!) • Firewall: a network component that separates two networks and (typically) operates in the upper layers of the OSI reference model (Application layer). • Screening Router: a discriminating router that filters packets based on network layer (and sometimes transport layer) protocols and addresses.

  7. Attack types • DoS (denial of service): attempting to disrupt or deny a useful service. • Eavesdropping: interception of a third-party (malicious) host • Modification: changing data • Fabrication: producing data on behalf of another person.

  8. Historical Ciphers • Caesar cipher

  9. Data Encryption Standard (DES) • Designed at IBM in 1975 • Changes suggested by the NSA • Standardized by NIST in 1977 • Official cipher for civilian cryptography • Reviewed by the NSA • Used by CIA • Combines substitutions and permutations • Operates on bits

  10. Feistel Network • Iterative structure • Efficient hardware implementation • Non-linear element F provides security • Multiple rounds provide mixing (diffusion) between the two halves

  11. The AES Cipher - Rijndael • designed by Rijmen-Daemen in Belgium • has 128/192/256 bit keys, 128 bit data • an iterative cipher • treats data in 4 groups of 4 bytes • expands 128-bit key to 4 groups of 4 bytes(larger keys are expanded to more groups) • operates an entire block in every round • round number dependent on key size • designed to be: • resistant against known attacks • speed and code compactness on many CPUs • design simplicity

  12. RSA • by Rivest, Shamir & Adleman of MIT in 1977 • best known & widely used public-key scheme • based on exponentiation in a finite field over integers modulo a prime • exponentiation takes O((log n)3) operations (easy) • uses large integers (eg. 1024 bits) • security due to cost of factoring large numbers

  13. RSA Key Setup Generation of a public/private key pair: • select two large primes at random: p, q • compute the system modulus n = p·q • select at random the encryption key e • (n)=(p-1)(q-1) • where 1<e<(n), gcd(e,(n))=1 • solve following equation to find decryption key d : e·d=1 mod (n) and 0≤d≤n • public encryption key: KU={e,n} • private decryption key: KR={d,n}

  14. RSA Example • Select primes: p=17 & q=11 • Computen = pq =17×11=187 • Compute(n)=(p–1)(q-1)=16×10=160 • Select e : gcd(e,160)=1; choose e=7 • Determine d: de=1 mod 160 and d < 160 Value is d=23 since 23×7=161= 10×160+1 • Public key KU={7,187} • Private key KR={23,187}

  15. RSA Use • to encrypt a message M the sender: • obtains public key of recipient KU={e,n} • computes: C=Me mod n, where 0≤M<n • to decrypt the ciphertext C the owner: • uses the private key KR={d,n} • computes: M=Cd mod n • note that the message M must be smaller than the modulus n

  16. RSA Example cont’d • sample RSA encryption/decryption is: • given message M = 88 (88<187) • encryption: C = 887 mod 187 = 11 • decryption: M = 1123 mod 187 = 88

  17. Public Key Cryptography(a.k.a. asymmetric cryptography) • Each entity has 2 keys: • private key (a secret) • public key (well known).

  18. Using Keys • Private keys are used for decrypting. • Public keys are used for encrypting. encryption plaintext ciphertext public key decryption ciphertext plaintext private key

  19. Digital Signature • Public key cryptography is also used to provide digital signatures. signing plaintext signed message private key verification signed message plaintext public key

  20. Transmitting over an insecure channel. Alice wants to send Bob a private message. Apublicis Alice’s public key. Aprivateis Alice’s private key. Bpublicis Bob’s public key. Bprivateis Bob’s private key.

  21. Hello Bob,Wanna get together? Alice Bob encrypt using Bpublic decrypt using Bprivate

  22. OK Alice,Your place or mine? Alice Bob decrypt using Aprivate encrypt using Apublic

  23. Bob’s Dilemma • Nobody can read the message from Alice, but anyone could produce it. • How does Bob know that the message was really sent from Alice? • Bob may be comforted to know that only Alice can read his reply.

  24. Alice can sign her message! • Alice can create a digital signature and prove she sent the message (or someone with knowledge of her private key). • The signature can be a message digest encrypted with Aprivate.

  25. Revised Scheme Alice Bob Sign with Aprivate check signature using Apublic decrypt using Bprivate encrypt using Bpublic

  26. Another possible problem • Suppose Bill receives a message from Alice including a digital signature. “meet me at the library tonight” • Bill sends the same message to Joe so that it looks like the message came from Alice. • Bill includes the digital signature from the message Alice sent to him. • Joe is convinced Alice sent the message!

  27. Solution? • Always start your messages with: • Dear Bill, • Create a digest from the encrypted message and sign that digest. • There are many other schemes as well.

  28. Authentication

  29. Authentication

  30. Secure Protocols • Many application protocols include the use of cryptography as part of the application level protocol. • The cryptographic scheme employed is part of the protocol. • If stronger cryptographic tools become available we need to change the protocol.

  31. SSL and TLS • Secure Sockets Layer (SSL) is a different approach - a new layer is added that provides a secure channel over a TCP only link. • TLS is Transport Layer Security (IETF standard based on SSL).

  32. Application Application SSL SSL TCP TCP IP IP SSL layer

  33. Advantages of SSL/TLS • Independent of application layer • Includes support for negotiated encryption techniques. • easy to add new techniques. • Possible to switch encryption algorithms in the middle of a session.

  34. HTTPS Usage • HTTPS is HTTP running over SSL. • used for most secure web transactions. • HTTPS server usually runs on port 443. • Include notion of verification of server via a certificate. • Central trusted source of certificates.

More Related