Handshake Protocols

Handshake Protocols COEN 350

Simple Protocol Alice: Hi, I am Alice. My password is “fiddlesticks”. Bob: Welcome, Alice.

Simple Protocol Vulnerable to sniffing and replay attack. Alice: Hi, I am Alice. My password is “fiddlesticks”. Bob: Welcome, Alice. ... Mallory: Hi, I am Alice. My password is “fiddlesticks”. Bob: Welcome, Alice.

Shared Secret Alice and Bob share a secret key K. Alice: I am Alice. Bob: Encrypt R. Alice: EK(R) Bob (calculates EK(R) as well.): Welcome Alice.

Shared Secret Vulnerable to DOS attack. while(1) { Mallory: I am Alice. Bob: Encrypt R. Mallory: X. Bob (EK(R) != X): Access denied. }

Shared Secret Vulnerable to sniffing and replay attack if R is not random or if R is repeated.

Shared Secret, use of clock Alice: I am Alice, EK(clock). Bob calculates clock, compares with his value: Welcome Alice.

Shared secret, use of clock Man in the Middle + replay attack: Mallory to Bob: KILL, KILL, KILL, KILL. Alice: Hi, I’m Alice. EK(clock). Mallory to Alice: KILL, KILL, KILL, KILL. Mallory to Bob: Hi, I’m Alice. EK(clock). Bob: Hi, Alice.

Public Key Alice: “I’m Alice.” Bob: “R”. Alice: “EAlice(R)”. Bob calculates “DAliceEAlice(R) == R: Hi Alice.

Public Key Alice: “I’m Alice.” Bob creates random challenge R: “EAlice(R)”. Alice: “R”. Bob checks R == R: Hi Alice.

Public Key: DOS attack Trudy: “I’m Alice.” Bob: “R”. Trudy: “X” Bob calculates “DAliceEAlice(X) != R: Access Denied. Bob spends much more time computing than Trudy!

Mutual Authentication: Shared Secret Alice: “I am Alice” Bob: “RB” Alice: EK(RB). RA. Bob calculates EK(RB) himself: EK(RA). Hi Alice. Alice calculates EK(RA) herself: Hi Bob.

Mutual Authentication with less messages? Alice: I am Alice. RA Bob: RB. EK(RA). Alice: Hi Bob. EK(RB). Bob: Hi Alice.

Mutual Authentication with less steps is vulnerable to the replay attack Session 1 Trudy: I am Alice. RA. Session 1 Bob: RB. EK(RA). Session 2 Trudy: I am Alice. RB. Session 2 Bob: RB’. EK(RB). Session 1 Trudy: Hi Bob. EK(RB). Session 1 Bob: Hi Alice.

Warning Signals • Requestor should authenticate herself first. • Don’t have requestor and requestee do exactly the same thing. (E.g. use different key pairs.) • If you provide encryption service, you set yourself up for a key guessing attack.

Public Key: Simple Mutual Authentication Alice: “I am Alice. RA” Bob: “EBob(RA). RB” Alice DBobEBob (RA)=RA: Hello Bob. EAlice(RB). Bob: DAliceEAlice(RB) = RB: Hello Alice.

Key Distribution Centers • Maintains a shared secret for each registered user. • To set-up a connection requires the KDC to set up a session key.

Key Distribution CenterOriginal Algorithm • Alice to KDC: Alice wants Bob. • KDC to Alice: Here is your session key. • KDC to Bob: Here is your session key. This needs to be modified.

Key Distribution Center:Needham Schroeder Protocol Alice to KDC: N1, Alice wants Bob. KDC to Alice: KA(N1,KS,Bob,Ticket), where Ticket=KB(KS,Alice). Alice to Bob: Ticket, KS(N2). Bob to Alice: KS(N2-1,N3). Alice to Bob: K(N3-1). N1, N2, N3 are nonces to prevent replay attacks.

Key Distribution Center:Needham Schroeder Protocol Variant Alice to KDC: N1, Alice wants Bob. KDC to Alice: KA(N1,KS,Bob,Ticket), where Ticket=KB(KS,Alice). Alice to Bob: Ticket, KS(N2). Bob to Alice: KS(N2-1),KS(N3). Alice to Bob: K(N3-1). N1, N2, N3 are nonces to prevent replay attacks.

Replay attack on modified NS Alice to KDC: N1, Alice wants Bob. KDC to Alice: KA(N1,KS,Bob,Ticket), where Ticket=KB(KS,Alice). Alice to Bob: Ticket, KS(N2). Bob to Alice: KS(N2-1),KS(N3). Alice to Bob: KS(N3-1). Trudy as Alice to Bob: Ticket, KS(N2) Bob to Alice, but intercepted by Trudy: KS(N2-1), KS(N4) Trudy as Alice to Bob: Ticket, KS(N4). Bob to Alice, but intercepted by Trudy. KS(N4-1), KS(N5). Trudy as Alice to Bob: KS(N4-1).

Key Distribution Center • Assume that Alice’s key has become compromised. • Trudy can now present herself as Alice to Bob with an old ticket. • Tickets need to have an expiration date!!!!!!!!!!!

Handshake Protocols