EEC 693 793 Special Topics in Electrical Engineering Secure

EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 7 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University wenbing@ieee. org Spring 2007 EEC 693: Secure & Dependable Computing

2 Outline • Announcement – Feb 26, Monday, 3 pm: CSU Data Center Tour; 10 th floor of Rhodes Tower – Midterm#1: March 20 th, 4 -6 pm (moved from March 27 th) • • Secure hash functions Message authentication code Public key management Authentication protocols Spring 2007 EEC 693: Secure & Dependable Computing 2

3 Message Digests • Message digest (MD): using a one-way hash function that takes an arbitrarily long piece of plaintext and from it computes a fixed-length bit string • Requirement on the hash function: – – Given P, it is easy to compute MD(P) Given MD(P), it is effectively impossible to find P Given P no one can find P’ such that MD(P’) = MD(P) A change to the input of even 1 bit produces a very different output Spring 2007 EEC 693: Secure & Dependable Computing 3

4 Digital Signatures Using Message Digests Spring 2007 EEC 693: Secure & Dependable Computing 4

5 MD 5 • One of the most widely used hash functions • MD 5 is the fifth in a series of message digests designed by Ronald Rivest (1992) • It operates by mangling bits in a sufficiently complicated way that every output bit is affected by every input bit • MD 5 generates a 128 -bit fixed value Spring 2007 EEC 693: Secure & Dependable Computing 5

6 SHA-1 • SHA-1: Secure Hash Algorithm 1, developed by National Security Agency (NSA) and blessed by NIST. It generates 160 -bit message digest • Use of SHA-1 and RSA for signing nonsecret messages Spring 2007 EEC 693: Secure & Dependable Computing 6

7 Message Authentication Code • MACs are used between two parties that share a secret key in order to validate information transmitted between these parties • The MAC mechanism that is based on cryptographic hash functions is called HMAC: – Append the key to the plaintext and generate a digest using a hash function – Ship the plaintext together with the digest Spring 2007 EEC 693: Secure & Dependable Computing 7

8 Management of Public Keys • • Problem statement Certificates X. 509 Public key infrastructure Spring 2007 EEC 693: Secure & Dependable Computing 8

Problems with Public-Key Management 9 • If Alice and Bob do not know each other, how do they get each other’s public keys to start the communication process ? – It is essential Alice gets Bob’s public key, not someone else’s • A way for Trudy to subvert public-key encryption Spring 2007 EEC 693: Secure & Dependable Computing 9

10 Certificates • Certification Authority (CA): an organization that certifies public keys – It certifies the public keys belonging to people, companies, or even attributes – CA does not need to be on-line all the time (in ideal scenarios) • A possible certificate and its signed hash Spring 2007 EEC 693: Secure & Dependable Computing 10

11 X. 509 • Devised and approved by ITU • The basic fields of an X. 509 certificate Spring 2007 EEC 693: Secure & Dependable Computing 11

12 Public-Key Infrastructures • A Public-Key Infrastructure (PKI) is needed for reasons of – Availability, Scalability, Ease of management • A PKI has multiple components – Users, CAs, Certificates, Directories • A PKI provides a way of structuring these components and define standards for the various documents and protocols – A simple form of PKI is hierarchical CAs Spring 2007 EEC 693: Secure & Dependable Computing 12

13 Public-Key Infrastructures • Hierarchical PKI • A chain of trust/certification path: A chain of certificates going back to the root Spring 2007 EEC 693: Secure & Dependable Computing 13

14 Public-Key Infrastructures • Revocation: sometimes certificates can be revoked, due to a number of reasons • Reinstatement: a revoked certificate could conceivably be reinstated • Each CA periodically issues a CRL (Certificate Revocation List) giving the serial numbers of all certificates that it has revoked – A user who is about to use a certificate must now acquire the CRL to see if the certificate has been revoked • Having to deal with revocation (and possibly reinstatement) eliminates one of the best properties of certificates, namely, that they can be used without having to contact a CA Spring 2007 EEC 693: Secure & Dependable Computing 14

15 Authentication Protocols • Authentication is the technique by which a process verifies that its communication partner is who it is supposed to be and not an imposter – Verifying the identity of a remote process in the face of a malicious, active intruder is surprisingly difficult and requires complex protocols based on cryptography • Not to be confused with authorization – Authorization is concerned with what process is permitted to do Spring 2007 EEC 693: Secure & Dependable Computing 15

General Model for Authentication Protocols 16 • Alice starts out by sending a message either to Bob or to a trusted KDC (Key Distribution Center), which is expected to be honest • Several other message exchanges follow in various directions • Trudy may intercept, modify, or replay the messages transmitted to trick Alice and Bob • When the protocol has been completed, Alice is sure she is talking to Bob and Bob is sure he is talking to Alice Spring 2007 EEC 693: Secure & Dependable Computing 16

General Model for Authentication Protocols 17 • In general, the authentication process also produce a secret session key for use in the upcoming conversation – For each new connection, a new, randomly-chosen session key should be used • Public-key cryptography is widely used for the authentication protocols themselves and for establishing the session key Spring 2007 EEC 693: Secure & Dependable Computing 17

18 Why Use a Session Key • For performance reasons, symmetric key encryption is much faster than public-key encryption • To minimize the amount of traffic that gets sent with the users’ secret keys or public keys • To reduce the amount of ciphertext an intruder can obtain • To minimize the damage done if a process crashes and its core dump falls into the wrong hands. Hopefully, the only key present then will be the session key – All the permanent keys should have been carefully zeroed out after the session was established Spring 2007 EEC 693: Secure & Dependable Computing 18

19 Authentication Protocols • • Authentication Based on a Shared Secret Key Establishing a Shared Key: Diffie-Hellman Authentication Using a Key Distribution Center Authentication Using Public-Key Cryptography Spring 2007 EEC 693: Secure & Dependable Computing 19

Authentication Based on a Shared Secret Key 20 • Two-way authentication using a challengeresponse protocol – Challenge-response: one party sends a random number to the other, who then transforms it in a special way and then returns the result – Nonces: random numbers used just once in challenge-response protocols – Assume that Alice and Bob already share a secret key, KAB Spring 2007 EEC 693: Secure & Dependable Computing 20

Authentication Based on a Shared Secret Key Spring 2007 EEC 693: Secure & Dependable Computing 21 21

Authentication Based on a Shared Secret Key 22 • A shortened two-way authentication protocol. Is this new protocol an improvement over the original one ? – It is shorter – But it is also wrong – Under certain circumstances, Trudy can defeat this protocol by using what is known as a reflection attack Spring 2007 EEC 693: Secure & Dependable Computing 22

23 Reflection Attack • The reflection attack: Trudy can break it if it is possible to open multiple sessions with Bob at once • This attack can be defeated by encrypting RB with KAB in message 2 Spring 2007 EEC 693: Secure & Dependable Computing 23

General Rules for Authentication Protocols Design 24 • Rule#1: Have the initiator prove who she is before the responder has to – In the previous case, Bob gives away valuable information before Trudy has to give any evidence of who she is • Rule#2: Have the initiator and responder use different keys for proof, e. g. , KAB and K'AB • Rule#3: Have the initiator and responder draw their challenges from different sets – E. g. , the initiator uses even numbers, the responder uses odd numbers • Rule#4: Be aware of parallel sessions (no info flows across different sessions) Spring 2007 EEC 693: Secure & Dependable Computing 24

Establishing a Shared Key: The Diffie-Hellman Key Exchange 25 • A protocol that leads to the establishment of a shared secrete key is called key agreement protocol or key exchange protocol • Diffie-Hellman key exchange – Two large numbers, n and g, where n is a prime, (n - 1)/2 is also a prime and certain conditions apply to g Spring 2007 EEC 693: Secure & Dependable Computing 25

Establishing a Shared Key: The Diffie-Hellman Key Exchange Spring 2007 EEC 693: Secure & Dependable Computing 26 26

27 Establishing a Shared Key: The Diffie-Hellman Key Exchange • Example: n = 47 and g = 3. Alice picks x = 8 and Bob picks y = 10. Both of these are kept secret – Alice's message to Bob is (47, 3, 28) because 38 mod 47 is 28. Bob's message to Alice is (17) – Alice computes 178 mod 47, which is 4 – Bob computes 2810 mod 47, which is 4 – Alice and Bob have independently determined that the secret key is now 4 – Trudy has to solve the equation 3 x mod 47 = 28 Spring 2007 EEC 693: Secure & Dependable Computing 27

Establishing a Shared Key: The Diffie-Hellman Key Exchange 28 • The man-in-the-middle attack – When Bob gets (47, 3, 28), how does he know it is from Alice and not from Trudy? There is no way he can know – Trudy can exploit this fact to deceive both Alice and Bob Spring 2007 EEC 693: Secure & Dependable Computing 28

29 Man-In-The-Middle Attack • A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised • The attacker must be able to observe and intercept messages going between the two victims Spring 2007 EEC 693: Secure & Dependable Computing 29

Authentication Using a Key Distribution Center 30 • Each user has a single key shared with the KDC. Authentication and session key management now goes through the KDC • The following protocol is subject to replay attack Spring 2007 EEC 693: Secure & Dependable Computing 30

Needham-Schroeder Authentication Protocol 31 • Needham-Schroeder protocol: a multi-way challenge-response protocol – By having each party both generate a challenge and respond to one, the possibility of any kind of replay attack is eliminated Spring 2007 EEC 693: Secure & Dependable Computing 31

Needham-Schroeder Authentication Protocol 32 • Message 1: RA is a nonce • Message 2: – KB(A, KS) is ticket Alice will send to Bob – RA: so that message 2 is not a replay – B: so that if Trudy replaces B with her id in message 1, it will be detected – Ticket is encrypted using Bob’s key KB so that Trudy cannot replace it with something else on the way back to Alice Spring 2007 EEC 693: Secure & Dependable Computing 32

Needham-Schroeder Authentication Protocol 33 • Message 3: a new nonce RA 2 is used • Message 4: Bob sends back KS(RA 2 -1) instead of KS(RA 2) so that Trudy cannot steal KS(RA 2) from message 3 and replay it here • Message 5: to convince Bob he is talking to Alice and no replays are being used Spring 2007 EEC 693: Secure & Dependable Computing 33

Authentication Using Public-Key Cryptography Spring 2007 EEC 693: Secure & Dependable Computing 34 34

35 Authorization • Authentication: Verify the claim that a subject says it is S: verifying the identity of a subject • Authorization: Determining whether a subject is permitted certain services from an object • Note: authorization makes sense only if the requesting subject has been authenticated Spring 2007 EEC 693: Secure & Dependable Computing 35