Distributed Computer Security: Authentication and Key Distribution

1. Distributed Computer Security: Authentication and Key Distribution Vijay Jain CSc 8320, Spring 2007

2. Outline • Overview • Design of Authentication Protocols • Needham-Schroeder Protocol • Denning-Sacco Protocol • Kerberos Protocol • Kerberos Protocol Version V • References

3. Overview • Password verification is a simple example of one-way user identification. • In a distributed environment, there is a greater need to authenticate the machine the user connects to as well. • This type of mutual authentication is even more important for communication between autonomous principals under different administrative authorities in a client/server distributed environment.

4. Overview (cont…) • Messages being exchanged must also be authenticated such that they are free of forgery, counterfeiting and repudiation. • Forgery could occur when a communication key is compromised. • A counterfeit is the replay of a secret message in the context of communication.

5. Overview (cont…) • For message authenticity, an irreproducible secret message digest can be used to sign the message. • Secrecy of information can be accomplished by encryption using secret keys.

6. Design of Authentication Protocols • Authentication protocols are all about distribution and management of secret keys. • Key distribution in a distributed environment is an implementation of distributed authentication protocols. • Design of distributed authentication protocols depends on underlying communication service, i.e. connectionless or connection-oriented.

7. Design of Authentication Protocols (cont…) ConnectionConnectionless Peer processes Client / Server • Most distributed applications follow Client/Server programming paradigm and Client/Server interaction is viewed as request / reply communication.

8. Design of Authentication Protocols (cont…) • Session key can also be used for Client / Server communication. Conceptually similar with tickets. • A ticket is a signed certificate that contains information for authenticating the client. • Kerberos Protocol was the first one to use the ticket notion.

9. Design of Authentication Protocols (cont…) • All protocols assume that some secret information is held initially by each principal. • Authentication is achieved by one principal demonstrating the other that it holds that secret information. • All protocols assume that system environment is very insecure and is open for attack.

10. Design of Authentication Protocols (cont…) • Message received by a principal must have its origin authenticity, integrity and freshness verified. • To achieve these goals, most protocols need to rely on an authentication server. • Authentication server delivers good quality session keys to requesting principals securely.

11. Design of Authentication Protocols (cont…) • Protocol are divided into two categories to verify the freshness of a message. • First category uses nonce and challenge/ response handshake to verify freshness. • Second category uses timestamps and assumes that all machines in distributed system are clock-synchronized.

12. Needham-Schroeder Protocol (1978) • First to use the encryption techniques for authentication and key distribution. • Five Steps… • A->S : A, B, Na • S->A: {Na, B, Kab, {A, Kab}Kbs}Kas • A->B: {A, Kab}Kbs • B->A: {Nb}Kab • A->B: {Nb - 1}Kab

13. Needham-Schroeder Protocol (cont…) • A contacts S which returns a session key and certificate encrypted with Kbs. • B decrypts it and does a nonce handshake with A assure the freshness. • Subtracting 1 from Nb in last message ensures that its not a replay of the previous message from B to A.

14. Needham-Schroeder Protocol (cont…) • Denning and Sacco found a drawback. • If session key between A and B is compromised, an intruder can impersonate A by carrying out last 3 steps. • Needham-Schroeder responded by requiring A to obtain another nonce from B before it contacts S and requiring S to put this nonce into certificate to be forwarded to B.

15. Denning-Sacco Protocol (1981) • Uses timestamps rather than nonce to guarantee message freshness. • A->S: A, B • S->A: {B, Kab,Ts{A, Kab, Ts}Kbs}Kas • A->B: {A, Kab, Ts}Kbs A and B can verify the message freshness by checking: Clock – T < Δt1 + Δt2

16. Denning-Sacco Protocol (cont…) • Clock is the local clock time. Δt1 is normal discrepancy between server’s clock and local clock. Δt2 is expected network delay. • So long Δt1 + Δt2 is less than the interval between two contiguous authentication sessions, message freshness is guaranteed.

17. Denning-Sacco Protocol (cont…) • Denning-Sacco has better performance than Needham-Schroeder as it eliminates message handshake. • But drawback is that all machines must be clock-synchronized with authentication server.

18. Kerberos Protocol (1980s) • As a part of project Athena at MIT, Kerberos is one of the most promising implementation of authentication service. • Based on Needham-Schroeder but also uses timestamps suggested by Denning-Sacco. • Authentication service is divided on two servers: Kerberos Server and Ticket Granting Server (TGS).

19. Kerberos Protocol (cont…) • Simplified version of Kerberos that treats Kerberos server and TGS as single entity S. 1. A->S: A, B 2. S->A: {Kab, Ticketab}Kas Where Ticketab = {B, A, addr, Ts, L, Kab}Kbs 3. A->B: Authenticatorab, Ticketab Where Authenticatorab = {A, addr, Ta}Kab 4. B->A: {Ta + 1}Kab

20. Kerberos Protocol (cont…) • A sends its own identity to S before it connect to B. • S responds with session key Kab and a ticket for B. • Ticket contains identities of B and A, IP of A, timestamp Ts, lifetime L and a session key to identify A. • A now creates its own authenticator containing A’s identity, its IP and timestamp and sends it to B along with the B’s ticket.

21. Kerberos Protocol (cont…) • B decrypts the ticket and authenticator, and compares two pieces of information. • First, their identity and address information must match. • Second, discrepancy between time in authenticator and current local time must not exceed a predetermined value. • If these match, B authenticates the A’s identity and allows the service request to proceed.

22. Kerberos Protocol (cont…) • Drawbacks of Kerberos were identified by Bellovin and Merritt. • Drawback includes difficulty in adapting to all environments, and the need for special purpose hardware. • To fix some of these problems, Kerberos has been upgraded to version V.

23. Kerberos Protocol Version V (1993) K C S G

24. Kerberos Protocol Version V (cont…) • This protocol separates the authentication server S into Kerberos server (K) for authentication and Ticket Granting Server (G). • Client (C) first sends identity for itself and TGS to Authentication Server K. (Message 1) • Authentication Server K does the initial login and grants ticket for TGS. (Message 2) • Client (C) sends authenticator to TGS to identify itself (like simplified Kerberos). (Message 3)

25. Kerberos Protocol Version V (cont…) • Message 4 and 5 are similar to Message 2 and 3 respectively. • Most widely implemented protocol. • Implemented in Distributed Computing Environment (DCE) security service and SESAME (A Secure European System for Application in a Multi-vendor Environment).

26. References • “Distributed Operating Systems and Algorithms” by Randy Chow and Theodore Johnson • B. Clifford Neuman and Theodore Ts'o. Kerberos: An Authentication Service for Computer Networks, IEEE Communications, 32(9):33-38. September 1994 • Clifford Neumann. The Kerberos Network Authentication Service (V5). Internet Draft ietf-cat-kerb-kerberos-revision-04.txt, June 1999 • B. Clifford Neuman, Brian Tung, and John Wray. Public Key Cryptography for Initial Authentication in Kerberos, Internet Draft ietf-cat-kerberos-pk-init-09, July 1999 • http://en.wikipedia.org/wiki/Needham-Schroeder [Accessed: March 29, 2007] • http://web.mit.edu/Kerberos/ [Accessed: April 2, 2007] • http://en.wikipedia.org/wiki/Kerberos_%28protocol%29 [Accessed: April 8, 2007]