1 / 34

Last Class: The Problem

Last Class: The Problem. Private Message. Bob. Alice. Eavesdropping. Eve. Last Class: The Solution. Private Message. Private Message. Encryption. Decryption. Scrambled Message. Bob. Alice. Eavesdropping. Eve. Other Security Problems. Are you who you say you are? Authentication

priscilla-shaw
Download Presentation

Last Class: The Problem

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Last Class: The Problem Private Message Bob Alice Eavesdropping Eve

  2. Last Class: The Solution Private Message Private Message Encryption Decryption Scrambled Message Bob Alice Eavesdropping Eve

  3. Other Security Problems • Are you who you say you are? • Authentication • How does Bob know that he’s really talking to Alice? • How does Alice know the message was sent by Bob? • Mutual authentication • How does Alice know that the message she receives hasn’t been tampered with? • Message Integrity • Are you authorized to do what you want to do? • Authorization

  4. Secure Channels

  5. Given credit where it is due • Most slides are from Prof. Kenneth Chiu at SUNY Binghamton • Some slides are from Scott Shenker and Ion Stoica at University of California, Berkeley and Ariel J. Frank at Bar-Ilan University • I have modified and added some slides

  6. Authentication • Can you have authentication without message integrity? • I know that Bob sent the message, but someone may have tampered with it. • I know that no one tampered with it, but I don’t know whether or not it was really Bob who sent it. • Authentication & message integrity cannot do without each other ! • Set-up phase precedes message exchange • Session keys to ensure message integrity

  7. Notation for Cryptography

  8. Shared Secret Key Authentication • Suppose Alice and Bob share a secret key (KA, B). How can they setup a secure channel over an insecure medium?

  9. Alice sends her identity to Bob. • Bob sends a challenge (random number). • Alice must encrypt and return. • Alice then sends a challenge to Bob. • Bob must encrypt and return.

  10. An Optimization • Authentication based on a shared secret key, but using three instead of five messages.

  11. Chuck…er…Alice ? Attack Attempt • Chuck tries to pretend to be Alice. • He sends the initial message to Bob. • Bob responds with the encrypted challenge, but then his own challenge. • Chuck cannot properly respond to the challenge because he doesn’t have the key.

  12. Reflection Attack • Lesson: never encrypt anything without knowing who you are encrypting it for.

  13. Key Distribution Centers • If there are N parties using shared secret keys, how many keys are needed? • Alternative is to use a trusted KDC. It has a shared key with every host.

  14. Key Distribution Centers • Disadvantage is that Bob has to get into the loop first.

  15. Tickets • Using a ticket and letting Alice set up a connection to Bob. • Vulnerable to replay attacks if Chuck gets hold on KB,KDCold

  16. Authentication using KDC(Needham-Schroeder Protocol) • Relate messages 1 and 2: use challenge response mechanism • RA1, RA2, RB: nonces • Nonce: random number used only once to relate two messages 1 RA1,A,B KDC KA,KDC(RA1,B,KA,B, KB,KDC(A,KA,B)) 2 KA,B(RA2), KB,KDC(A, KA,B) Bob Alice 3 KA,B(RA2-1, RB) 4 KA,B(RB-1) 5

  17. KA,KDC(B,KA,B, KB,KDCold(A,KA,B)) 2 (replayed message) Alice KA,B(RA2), KB,KDCold(A, KA,B) 3 KA,B(RA2-1, RB) 4 KA,B(RB-1) 5 What if RA1 is Missing? • Assume Chuck intercepted • KA,KDC(B,KA,B, KB,KDCold(A,KA,B)) • Knows KB,KDCold 1 A,B KDC Chuck (KB,KDCold) Bob (KB,KDC) Here Chuck gets KA,B !

  18. Authentication using KDC(Needham-Schroeder Protocol) • Why do we need to include B in message 2? 1 RA1,A,B KDC KA,KDC(RA1,B,KA,B, KB,KDC(A,KA,B)) 2 KA,B(RA2), KB,KDC(A, KA,B) Bob Alice 3 KA,B(RA2-1, RB) 4 KA,B(RB-1) 5

  19. RA1,A,C KA,KDC(RA1,KA,C, KC,KDC(A,KA,C)) 2 KA,C(RA2), KC,KDC(A, KA,C) 3 KA,C(RA2-1, RB) 4 KA,C(RB-1) 5 What if B is Missing from Message 2? • Assume Chuck intercepts message 1 1 RA1,A,B KDC Bob (KB,KDC) Alice Chuck Here Chuck gets KA,C !

  20. Authentication using KDC(Needham-Schroeder Protocol) • Vulnerable to replay attacks if Chuck gets hold on KA,B 1 RA1,A,B KDC KA,KDC(RA1,B,KA,B, KB,KDC(A,KA,B)) 2 KA,B(RA2), KB,KDC(A, KA,B) Bob Alice 3 KA,B(RA2-1, RB) 4 KA,B(RB-1) 5

  21. What if Chuck gets KA,B? • Assume Chuck intercepted • KA,B(RA2), KB,KDC,(A,KA,B) • Knows KA,B 1 RA1,A,B KDC KA,KDC(RA1,B,KA,B, KB,KDC(A,KA,B)) 2 KA,B(RA2), KB,KDC(A, KA,B) Bob Alice 3 (replayed message) Chuck (KA,B) KA,B(RA2-1, RB) 4 KA,B(RB-1) 5

  22. Defend Against leaking of KA,B • Message 5 (former 3) contains an encrypted nonce (KB,KDC(RB1)) provided by Bob. • Chuck can no longer simply replay message 5 (former 3) to fool Bob, cause message 5 is now related to message 2 by including nonce RB1. 1 A KB,KDC(RB1) 2 3 RA1,A,B, KB,KDC(RB1) KDC KA,KDC(RA1,B,KA,B, KB,KDC(A,KA,B,RB1)) 4 KA,B(RA2), KB,KDC(A, KA,B,RB1) Bob Alice 5 KA,B(RA2-1, RB2) 6 KA,B(RB2-1) 7

  23. 1 KB+(A, RA) KA+(RA, RB,KA,B) 2 KA,B(RB) 3 Authentication Using Public-Key Cryptography ? • KA+, KB+: public keys Bob Alice

  24. More on Secure Channels • In addition to authentication, a secure channel also requires that messages are confidential, and that they maintain their integrity.

  25. More on Secure Channels • For example: Alice needs to be sure that Bob cannot change a received message and claim it came from her. And Bob needs to be sure that he can prove the message was sent by/from Alice, just in case she decides to deny ever having sent it in the first place. • Solution: Digital Signing. ?

  26. Digital Signatures • Digital signing a message using public-key cryptography. • This is implemented in the RSA technology. • Note: the entire document is encrypted/signed - this can sometimes be a costly overkill.

  27. Message Digest (MD) • Can provide data integrity and non-repudiation • Used to verify the authentication of a message • Idea: compute a hash on the message and send it along with the message • Receiver can apply the same hash function on the message and see whether the result coincides with the received hash

  28. Message Digest Operation • Transformation contains complex operations (see textbook) Initial digest (constant) Message (padded) 512 bits 512 bits 512 bits Transformation Transformation . . . Transformation Message digest

  29. Digital Signature • In practice someone cannot alter the message without modifying the digest • Digest operation very hard to invert • Encrypt digest with sender’s private key • KA-, KA+: private and public keys of A

  30. Secure Replicated Servers • A client issues a request to a group of replicated servers • Servers can be subject to Byzantine failures • How does the client gets the correct answer?

  31. Strawman Solution • Client gets replies from all servers… • … and take majority voting • Problem: client needs to authenticate each server

  32. Solution: Secret Sharing • Secret sharing: none of processes know the entire secret • Intuition: • Assume we want to tolerate c failures (some of them can by Byzantine failures) • Need to combine responses such that c+1 correct servers are sufficient to get the correct response

  33. (k,n)-threshold Signature Scheme • One public key K+ • n shares of corresponding private keys, Ki-, 1 <= i <= n • Encrypted value v with each of private key shares, i.e., vi=Ki-(v) • A client can decrypt value v using K+ only if it knows at least k values of vi

  34. Example • Assume 5 replicated servers that tolerate 2 corrupted servers, i.e., we need to adopt a (k,n)-threshold signature scheme where k=3 & n=5

More Related