חישוב ציון תרגילי בית q מי שלא

חישוב ציון תרגילי בית: q מי שלא יגיש את הפרויקט בזמן )3 : (PA m ממוצע של כל 7 תרגילי הבית q מי שיגיש את הפרויקט בזמן )3 : (PA m ממוצע של 6 תרגילי בית: m הפרויקט )3 (PA m חמשת הטובים )מתוך ששת( התרגילים האחרים m משקל כל תרגיל )מתוך השישה( יהיה זהה )6/1( q הערה: חייבים להקפיד על הגשה בזמן!

January 13, 2010 Chapter 7: Network security Foundations: q what is security? q cryptography q authentication q message integrity q key distribution and certification Security in practice: q application layer: secure e-mail q transport layer: Internet commerce, SSL, SET q network layer: IP security q Firewalls Lecture 13: Network Security 2

January 13, 2010 What is network security? Confidentiality: only sender, intended receiver should “understand” message contents m sender encrypts message m receiver decrypts message Authentication: sender, receiver want to confirm identity of each other Message Integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection Access and Availability: services must be accessible and available to users Lecture 13: Network Security 3

January 13, 2010 Internet security threats Packet sniffing: m broadcast media m promiscuous NIC reads all packets passing by m can read all unencrypted data (e. g. passwords) m e. g. : C sniffs B’s packets C A src: B dest: A payload B Lecture 13: Network Security 4

January 13, 2010 Internet security threats IP Spoofing: m can generate “raw” IP packets directly from application, putting any value into IP source address field m receiver can’t tell if source is spoofed m e. g. : C pretends to be B C A src: B dest: A payload B Lecture 13: Network Security 5

January 13, 2010 Internet security threats Denial of service (DOS): m flood of maliciously generated packets “swamp” receiver m Distributed DOS (DDOS): multiple coordinated sources swamp receiver m e. g. , C and remote host SYN-attack A C A SYN SYN SYN B SYN Lecture 13: Network Security 6

January 13, 2010 Cryptography Principles Lecture 13: Network Security 7

January 13, 2010 Friends and enemies: Alice, Bob, Trudy q well-known in network security world q Bob, Alice (lovers!) want to communicate “securely” q Trudy (intruder) may intercept, delete, add messages Alice data channel secure sender Bob data, control messages secure receiver data Trudy Lecture 13: Network Security 8

January 13, 2010 Who might Bob, Alice be? q … well, real-life Bobs and Alices! q Web browser/server for electronic transactions (e. g. , on-line purchases) q on-line banking client/server q DNS servers q routers exchanging routing table updates q other examples? Lecture 13: Network Security 9

January 13, 2010 The language of cryptography Alice’s K encryption A key plaintext encryption algorithm Bob’s K decryption B key ciphertext decryption plaintext algorithm symmetric key crypto: sender, receiver keys identical public-key crypto: encryption key public, decryption key secret (private) Lecture 13: Network Security 10

January 13, 2010 Symmetric Key Cryptography Lecture 13: Network Security 11

January 13, 2010 Symmetric key cryptography substitution cipher: substituting one thing for another m monoalphabetic cipher: substitute one letter for another plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasdfghjklpoiuytrewq E. g. : Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc Q: How hard to break this simple cipher? : • brute force (how hard? ) • other? Lecture 13: Network Security 12

January 13, 2010 Perfect cipher [Shannon 1948] q Definition: m Let C = E[M] m Pr[C=c] = Pr[C=c | M] q Example: one time pad m Generate random bits b 1. . . bn m E[M 1. . . Mn] = (M 1 b 1. . . Mn bn ) q Cons: size q Pseudo Random Generator m G(R) = b 1. . . bn m Indistinguishable from random (efficiently) Lecture 13: Network Security 13

January 13, 2010 Symmetric key crypto: DES: Data Encryption Standard q US encryption standard [NIST 1993] q 56 -bit symmetric key, 64 bit plaintext input q How secure is DES? m DES Challenge: 56 -bit-key-encrypted phrase (“Strong cryptography makes the world a safer place”) decrypted (brute force) in 4 months m no known “backdoor” decryption approach q making DES more secure m use three keys sequentially (3 -DES) on each datum m use cipher-block chaining Lecture 13: Network Security 14

January 13, 2010 Symmetric key crypto: DES operation initial permutation 16 identical “rounds” of function application, each using different 48 bits of key final permutation Lecture 13: Network Security 15

January 13, 2010 Block Cipher chaining q How do we encode a large message m Would like to guarantee integrity q Encoding: m Ci = E[Mi Ci-1] q Decoding: m Mi = D[Ci] Ci-1 q Malfunctions: m Loss m Reorder/ integrity Lecture 13: Network Security 16

Cipher Block Chaining Mode q Cipher block chaining. (a) Encryption. (b) Decryption. 7: Network Security 17

January 13, 2010 Diffie-Hellman key exchange protocol q Goal: Allow strangers establish a shared secret key for later communication q Assume two parties (Alice and Bob) want to establish a secret key. q Alice and Bob agree on two large numbers, n and g m usually, these are publicly known, and have some additional conditions applied (e. g. , n must be prime) Lecture 13: Network Security 18

January 13, 2010 Diffie-Hellman Key Exchange q Alice picks large x, Bob picks large y (e. g. , 512 bits) Lecture 13: Network Security 19

January 13, 2010 Man in the middle attack q Eavesdropper can’t determine secret key (gxy mod n) from (gx mod n) or (gy mod n) q However, how does Alice and Bob know if there is a third party adversary in between? Lecture 13: Network Security 20

January 13, 2010 Exponentiation q Compute gx mod n Expg, n (x) q Assume x = 2 y + b q Let z = Expg, n (y) q R=z 2 q If (b=1) R = g R mod n q Return R q Complexity: logarithmic in x Lecture 13: Network Security 21

January 13, 2010 Public Key Cryptography Lecture 13: Network Security 22

January 13, 2010 Public Key Cryptography symmetric key crypto q requires sender, receiver know shared secret key q Q: how to agree on key in first place (particularly if never “met”)? public key cryptography q radically different approach [Diffie. Hellman 76, RSA 78] q sender, receiver do not share secret key q encryption key public (known to all) q decryption key private (known only to receiver) Lecture 13: Network Security 23

January 13, 2010 Public key cryptography + Bob’s public B key K K plaintext message, m encryption ciphertext algorithm + K (m) B - Bob’s private B key decryption plaintext algorithm message + m = K B(K (m)) B Lecture 13: Network Security 24

January 13, 2010 Public key encryption algorithms Two inter-related requirements: . B 1 need d ( ) and e ( ) such that d (e (m)) = m B B 2 need public and private keys for d. B( ) and e ( ) . . B RSA: Rivest, Shamir, Adelson algorithm Lecture 13: Network Security 25

January 13, 2010 RSA: Choosing keys 1. Choose two large prime numbers p, q. (e. g. , 1024 bits each) 2. Compute n = pq, z = (p-1)(q-1) 3. Choose e (with e

January 13, 2010 RSA: Encryption, decryption 0. Given (n, e) and (n, d) as computed above 1. To encrypt bit pattern, m, compute e mod n (i. e. , remainder when m e is divided by n) c=m 2. To decrypt received bit pattern, c, compute d m = c d mod n (i. e. , remainder when c is divided by n) Magic d m = (m e mod n) mod n happens! Lecture 13: Network Security 27

January 13, 2010 RSA example: Bob chooses p=5, q=7. Then n=35, z=24. e=5 (so e, z relatively prime). d=29 (so ed-1 exactly divisible by z). encrypt: decrypt: letter m me l 12 1524832 c 17 c = me mod n 17 d c 48196857210675091411825223072000 m = cd mod n letter 12 l Lecture 13: Network Security 28

January 13, 2010 RSA: Why m = (m e mod n) d mod n Number theory result: • IF pq = n, p and q primes then: x y mod n = x (y mod (p-1)(q-1) ) mod • (m e)d mod n = m (ed mod (p-1)(q-1)) n mod n • But ed – 1 divisible by (p-1)(q-1) i. e. , ed mod (p-1)(q-1) = 1 • = m 1 mod n = m Lecture 13: Network Security 29

modified Diffie-Hellman Key Exchange January 13, 2010 q Encrypt 1 with Bob’s public key, 2 with Alice’s public key q Prevents man-in-the-middle attack q Actually, nonces and a third message are needed to fully complete this exchange (in a few slides) Lecture 13: Network Security 30

January 13, 2010 Authentication Lecture 13: Network Security 31

January 13, 2010 Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap 1. 0: Alice says “I am Alice” Failure scenario? ? Lecture 13: Network Security 32

January 13, 2010 Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap 1. 0: Alice says “I am Alice” in a network, Bob can not “see” Alice, so Trudy simply declares herself to be Alice Lecture 13: Network Security 33

January 13, 2010 Authentication: another try Protocol ap 2. 0: Alice says “I am Alice” in an IP packet containing her source IP address Alice’s “I am Alice” IP address Failure scenario? ? Lecture 13: Network Security 34

January 13, 2010 Authentication: another try Protocol ap 2. 0: Alice says “I am Alice” in an IP packet containing her source IP address Alice’s IP address Trudy can create a packet “spoofing” “I am Alice” Alice’s address Lecture 13: Network Security 35

January 13, 2010 Authentication: another try Protocol ap 3. 0: Alice says “I am Alice” and sends her secret password to “prove” it. Alice’s “I’m Alice” IP addr password Alice’s IP addr OK Failure scenario? ? Lecture 13: Network Security 36

January 13, 2010 Authentication: another try Protocol ap 3. 0: Alice says “I am Alice” and sends her secret password to “prove” it. Alice’s “I’m Alice” IP addr password Alice’s IP addr OK playback attack: Trudy records Alice’s packet and later plays it back to Bob Alice’s “I’m Alice” IP addr password Lecture 13: Network Security 37

January 13, 2010 Authentication: yet another try Protocol ap 3. 1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it. Alice’s encrypted “I’m Alice” IP addr password Alice’s IP addr OK Failure scenario? ? Lecture 13: Network Security 38

January 13, 2010 Authentication: another try Protocol ap 3. 1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it. Alice’s encrypted “I’m Alice” IP addr password Alice’s IP addr record and playback still works! OK Alice’s encrypted “I’m Alice” IP addr password Lecture 13: Network Security 39

January 13, 2010 Authentication: yet another try Goal: avoid playback attack Nonce: number (R) used only once –in-a-lifetime ap 4. 0: to prove Alice “live”, Bob sends Alice nonce, R. Alice must return R, encrypted with shared secret key “I am Alice” R KA-B(R) Failures, drawbacks? Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice! Lecture 13: Network Security 40

January 13, 2010 Authentication: ap 5. 0 ap 4. 0 requires shared symmetric key q can we authenticate using public key techniques? ap 5. 0: use nonce, public key cryptography “I am Alice” R Bob computes + - - K A (R) “send me your public key” + KA KA(KA (R)) = R and knows only Alice could have the private key, that encrypted R such that + K (K (R)) = R A A Lecture 13: Network Security 41

January 13, 2010 ap 5. 0: security hole Man (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice) I am Alice R K (R) T K (R) A Send me your public key + K T Send me your public key + K A - + m = K (K (m)) A A + K (m) A Trudy gets - + m = K (K (m)) sends T to Alice m T + K (m) T encrypted with Alice’s public key Lecture 13: Network Security 42

January 13, 2010 ap 5. 0: security hole Man (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice) Difficult to detect: q Bob receives everything that Alice sends, and vice versa. (e. g. , so Bob, Alice can meet one week later and recall conversation) q problem is that Trudy receives all messages as well! Lecture 13: Network Security 43

January 13, 2010 Message Integrity (Signatures etc) Lecture 13: Network Security 44

January 13, 2010 Digital Signatures Cryptographic technique analogous to handwritten signatures. Simple digital signature for message m: q Sender (Bob) digitally signs private key d. B, creating signed message, d. B(m). q Bob sends m and d. B(m) to Alice. document, establishing he is document owner/creator. q Verifiable, nonforgeable: recipient (Alice) can verify that Bob, and no one else, signed document. q Assumption: m m q Bob decrypts m with his e. B(d. B(m)) = d. B(e. B(m)) RSA Lecture 13: Network Security 45

Digital Signatures (more) January 13, 2010 q Suppose Alice receives Alice thus verifies that: msg m, and digital m Bob signed m. signature d. B(m) m No one else signed m. q Alice verifies m signed m Bob signed m and not m’. by Bob by applying Non-repudiation: Bob’s public key e. B to m Alice can take m, and d. B(m) then checks signature d. B(m) to court e. B(d. B(m) ) = m. and prove that Bob q If e. B(d. B(m) ) = m, signed m. whoever signed m must have used Bob’s private key. Lecture 13: Network Security 46

January 13, 2010 Message Digests Computationally expensive to public-key-encrypt long messages Goal: fixed-length, easy to compute digital signature, “fingerprint” q apply hash function H to m, get fixed size message digest, H(m). Hash function properties: q Many-to-1 q Produces fixed-size msg digest (fingerprint) q Given message digest x, computationally infeasible to find m such that x = H(m) q computationally infeasible to find any two messages m and m’ such that H(m) = H(m’). Lecture 13: Network Security 47

January 13, 2010 Hash Function Algorithms q Internet checksum would make a poor message digest. m Too easy to find two messages with same checksum. q MD 5 hash function widely used. m Computes 128 -bit message digest in 4 -step process. m arbitrary 128 -bit string x, appears difficult to construct msg m whose MD 5 hash is equal to x. q SHA-1 is also used. m US standard m 160 -bit message digest Lecture 13: Network Security 48

January 13, 2010 Digital signature = signed message digest Alice verifies signature and integrity of digitally signed message: Bob sends digitally signed message: large message m H: Hash function Bob’s private key + - KB encrypted msg digest H(m) digital signature (encrypt) encrypted msg digest KB(H(m)) large message m H: Hash function KB(H(m)) Bob’s public key + KB digital signature (decrypt) H(m) equal ? Lecture 13: Network Security 49

January 13, 2010 Key Distribution Centers Lecture 13: Network Security 50

Problems with Public-Key Encryption January 13, 2010 q A way for Trudy to subvert public-key encryption. Lecture 13: Network Security 51

January 13, 2010 Trusted Intermediaries Problem: m How do two entities m When Alice obtains establish shared Bob’s public key secret key over (from web site, enetwork? mail, diskette), how does she know it is Solution: Bob’s public key, not m trusted key Trudy’s? distribution center Solution: (KDC) acting as intermediary m trusted certification between entities authority (CA) Lecture 13: Network Security 52

January 13, 2010 Key Distribution Center (KDC) q Alice, Bob need shared symmetric key. q KDC: server shares different secret key with each registered user. q Alice, Bob know own symmetric keys, KA-KDC KB-KDC , for communicating with KDC. q Alice communicates with KDC, gets session key R 1, and KBKDC(A, R 1) q Alice sends Bob KB-KDC(A, R 1), Bob extracts R 1 q Alice, Bob now share the symmetric key R 1. Lecture 13: Network Security 53

January 13, 2010 Certification Authorities q Certification authority (CA) binds public key to particular entity. q Entity (person, router, etc. ) can register its public key with CA. m Entity provides “proof of identity” to CA. m CA creates certificate binding entity to public key. m Certificate digitally signed by CA. q When Alice wants Bob’s public key: q gets Bob’s certificate (Bob or elsewhere). q Apply CA’s public key to Bob’s certificate, get Bob’s public key Lecture 13: Network Security 54

X. 509 is the standard for certificates January 13, 2010 q The basic fields of an X. 509 certificate. Lecture 13: Network Security 55

January 13, 2010 Public-Key Infrastructures q PKIs are a way to structure certificates q (a) A hierarchical PKI. (b) A chain of certificates. Lecture 13: Network Security 56

Example revisited (solved with certificates) January 13, 2010 q Trudy presents Alice a certificate, purporting to be Bob, but Alice is unable to trace Trudy’s certificate back to a trusted root q Be wary if your browser warns about certs! Lecture 13: Network Security 57

January 13, 2010 Secure email Lecture 13: Network Security 58

January 13, 2010 Secure e-mail q Alice wants to send confidential e-mail, m, to Bob. KS m KS K (. ) S + . K B( ) K+ B KS(m ) + + KB(KS ) . K S( ) - Internet + KB(KS ) m KS - . K B( ) KB Alice: q q generates random symmetric private key, KS. encrypts message with KS (for efficiency) also encrypts KS with Bob’s public key. sends both KS(m) and KB(KS) to Bob. Lecture 13: Network Security 59

January 13, 2010 Secure e-mail q Alice wants to send confidential e-mail, m, to Bob. KS m KS K (. ) S + . K B( ) K+ B KS(m ) + + KB(KS ) . K S( ) - Internet + KB(KS ) m KS - . K B( ) KB Bob: q uses his private key to decrypt and recover K S q uses KS to decrypt KS(m) to recover m Lecture 13: Network Security 60

January 13, 2010 Secure e-mail (continued) • Alice wants to provide sender authentication message integrity. m H(. ) KA - . K A( ) - - KA(H(m)) + + KA Internet m m + . K A( ) H(m ) compare . H( ) H(m ) • Alice digitally signs message. • sends both message (in the clear) and digital signature. Lecture 13: Network Security 61

January 13, 2010 Pretty good privacy (PGP) q Internet e-mail encryption scheme, a de-facto standard. q Uses symmetric key cryptography, public key cryptography, hash function, and digital signature as described. q Provides secrecy, sender authentication, integrity. q Inventor, Phil Zimmerman, was target of 3 -year federal investigation. A PGP signed message: ---BEGIN PGP SIGNED MESSAGE--Hash: SHA 1 Bob: My husband is out of town tonight. Passionately yours, Alice ---BEGIN PGP SIGNATURE--Version: PGP 5. 0 Charset: noconv yh. HJRHh. GJGhgg/12 Ep. J+lo 8 g. E 4 v. B 3 mq. Jh FEv. ZP 9 t 6 n 7 G 6 m 5 Gw 2 ---END PGP SIGNATURE--- Lecture 13: Network Security 62

January 13, 2010 Secure Socket layer (SSl) Lecture 13: Network Security 63

January 13, 2010 Secure sockets layer (SSL) q PGP provides security for a specific network app. q SSL works at transport layer. Provides security to any TCP-based app using SSL services. q SSL: used between WWW browsers, servers for Ecommerce (https). q SSL security services: m m m server authentication data encryption client authentication (optional) q Server authentication: m m m SSL-enabled browser includes public keys for trusted CAs. Browser requests server certificate, issued by trusted CA. Browser uses CA’s public key to extract server’s public key from certificate. q Visit your browser’s security menu to see its trusted CAs. Lecture 13: Network Security 64

January 13, 2010 Internet Explorer: Tools Internet options Content Certificates Lecture 13: Network Security 65

January 13, 2010 Internet Explorer: Error Message Lecture 13: Network Security 66

January 13, 2010 SSL (continued) Encrypted SSL session: q Browser generates symmetric session key, encrypts it with server’s public key, sends encrypted key to server. q Using its private key, server decrypts session key. q Browser, server agree that future msgs will be encrypted. q All data sent into TCP socket (by client or server) is encrypted with session key. q SSL: basis of IETF Transport Layer Security (TLS). q SSL can be used for non. Web applications, e. g. , IMAP. q Client authentication can be done with client certificates. Lecture 13: Network Security 67

January 13, 2010 SSL basics Lecture 13: Network Security 68

January 13, 2010 Access Control in the Network Lecture 13: Network Security 69

January 13, 2010 Firewalls firewall isolates organization’s internal net from larger Internet, allowing some packets to pass, blocking others. Two firewall types: m packet filter m application gateways To prevent denial of service attacks: m SYN flooding: attacker establishes many bogus TCP connections. Attacked host alloc’s TCP buffers for bogus connections, none left for “real” connections. To prevent illegal modification of internal data. m e. g. , attacker replaces CIA’s homepage with something else To prevent intruders from obtaining secret info. Lecture 13: Network Security 70

January 13, 2010 Packet Filtering q Internal network is connected to Internet through a router. q Router manufacturer provides options for filtering packets, based on: m m m source IP address destination IP address TCP/UDP source and destination port numbers ICMP message type TCP SYN and ACK bits q Example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23. m All incoming and outgoing UDP flows and telnet connections are blocked. q Example 2: Block inbound TCP segments with ACK=0. m Prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside. Lecture 13: Network Security 71

January 13, 2010 Virtual Private Networks q Using firewalls and IPsec encryption to provide a “leased-line” like connection over the Internet q (a) A leased-line private network. (b) A virtual private network. Lecture 13: Network Security 72

January 13, 2010 Application gateways q Filters packets on application data as well as on IP/TCP/UDP fields. q Example: allow select internal users to telnet outside. host-to-gateway telnet session application gateway-to-remote host telnet session router and filter 1. Require all telnet users to telnet through gateway. 2. For authorized users, gateway sets up telnet connection to dest host. Gateway relays data between 2 connections 3. Router filter blocks all telnet connections not originating from gateway. Lecture 13: Network Security 73

January 13, 2010 Limitations of firewalls and gateways q IP spoofing: router can’t know if data “really” comes from claimed source q If multiple app’s. need special treatment, each has own app. gateway. q Client software must know how to contact gateway. m e. g. , must set IP address of proxy in Web browser q Filters often use all or nothing policy for UDP. q Tradeoff: degree of communication with outside world, level of security q Many highly protected sites still suffer from attacks. Lecture 13: Network Security 74

January 13, 2010 Network Security (summary) Basic techniques…. . . q cryptography (symmetric and public) q authentication q message integrity …. used in many different security scenarios q secure email q secure transport (SSL) q IP sec q Firewalls Lecture 13: Network Security 75