Security Outline Encryption Algorithms Authentication Protocols Message Integrity

Security Outline Encryption Algorithms Authentication Protocols Message Integrity Protocols Key Distribution Firewalls 1

Overview • Cryptography functions – Secret key (e. g. , DES) – Public key (e. g. , RSA) – Message digest (e. g. , MD 5) • Security services – Privacy: preventing unauthorized release of information – Authentication: verifying identity of the remote participant – Integrity: making sure message has not been altered 2

Secret Key • DES (data encryption standard, last update 1999) • AES (advanced encryption standard, 2000) • Both standardized by NIST (US national inst. of standards & technology), both considered secure, with AES permitting fast implementation and less memory and suitable for small mobile devices. 3

• 64 -bit key (56 -bits + 8 -bit parity), 64 -bit data block • 16 rounds • Each Round Li ─1 Ri ─1 F Ki + Li Ri • Only known way to break the code is exhaustive search, 2^55*1. 5 us = 1. 5 kyr, 3 K PC bring it down to 6 month • 3 DES: 3 64 -bit keys; AES 128, 192, 256 bits 4 keys

• Repeat for larger messages (cipher block chaining, CBC) 5

Public Key (RSA) • Encryption & Decryption encryption: c = me mod n decryption: m = cd mod n e: encryption/public key d: decryption/private key m: plaintext message, c: cipher text 6

RSA (cont) • Choose two large prime numbers p and q (each 256 bits) – Multiply p and q together to get n • Choose the encryption key e, such that e and (p - 1) x (q - 1) are relatively prime. – Two numbers are relatively prime if they have no common factor greater than one • Compute decryption key d such that d x e= 1 mod ((p - 1) x (q - 1)) • Construct public key as (e, n) • Construct public key as (d, n) • Discard (do not disclose) original primes p and q 7

RSA: Example • Let p = 7 and q = 11 – n = 7 x 11 = 77 • Choose e = 7 – relatively prime to (7 - 1) x (11 - 1) = 60 • Select d = 43, which satisfies – d x e= 1 mod ((p - 1) x (q - 1)) • Let m = 9, then – c = 9^7 mod 77 = 37 – m = 37^43 mod 77 = 9 • RSA is based on the premise that factoring large numbers is hard – if n (public) can be factored to p and q, d is easy to compute – 512 -bit number factorable in the next few years, now 1024 -bit or higher considered secure. 8

Message Digest • Cryptographic checksum – just as a regular checksum protects the receiver from accidental changes to the message, a cryptographic checksum protects the receiver from malicious changes to the message. • One-way function – given a cryptographic checksum for a message, it is virtually impossible to figure out what message produced that checksum; it is not computationally feasible to find two messages that hash to the same cryptographic checksum. • Relevance – if you are given a checksum for a message and you are able to compute exactly the same checksum for that message, then it is highly likely this message produced the checksum you were given. 9

Message Digest MD 4, MD 5, SHA (secure hash algorithm) Initial “ digest“ (constant) Message (padded) 512 bits ■■■ 512 bits Transform Message digest • MD 5: 128 -bit digest • SHA-1: 160 -bit digest 10

Implementaion and Performance • Software implementation – – numbers below represent those on state of art processors circa 2003 DES: 100 Mbps MD 5: 600 Mbps RSA: 100 Kbps • Hardware implementation – DES, MD 5 ~ Gbps – RSA ~ Kbps • RSA used for encrypt a key, DES for data encryption 11

Security Services • A security system is composed of a collection of security services, which use cryptographic algorithms. • Key Distribution • Authentication Protocols – Ascertain you (the corresponding partner) are who you claim to be • Message Integrity Protocols – Ascertain the message has not be altered by a third party 12

Key Distribution • Issues: – In secret key cipher, how does the two communicating parties obtain the shared key? – In public key cipher, how does one know what public key belongs to a certain participant? • Types of keys – Session key: valid for one session only, using secret key cipher – Pre-distribution key: used to generate session key, using public key cipher. 13

Public Key Distribution • Certificate (standardized in X. 509) – special type of digitally signed document: “I certify that the public key in this document belongs to the entity named in this document, signed X. ” – the name of the entity being certified can be: • John Smith (jsmith@nmsu. edu) • www. citibank. com – components: • the public key of the entity • the name of the certified authority • a digital signature 14

Key Distribution (cont) • Certified Authority (CA) – administrative entity that issues certificates – useful only to someone that already holds the CA’s public key. • Chain of Trust – if X certifies that a certain public key belongs to Y, and Y certifies that another public key belongs to Z, then there exists a chain of certificates from X to Z – someone that wants to verify Z’s public key has to know X’s public key and follow the chain • Certificate Revocation List (CRL) – A user of a certificate will first check with CRL – CRL do not keep certificates which have expired 15

Key Distribution (cont) 16

Authentication Protocols • Three-way handshake (secret key based, e. g. , DES) – A challenge and response model E(m, k): encryption of message m with key k D(m, k): decryption of message m with key k Assumption: client and server each know the other’s key x: random number CHK: client handshake key SHK: server handshake key SK: session key CHK, SHK used only for the authentification, can be generated from password (not suitable for key) SK used for data encryption after authentication, which is exposed more often, but useful for one secession only Client Server Clien t. Id, E ( , C HK) Y E(y + , CHK ) ) K K, SH E(S 17

• Trusted third party (Kerberos) – uses an authentication server (S) to help two parties (A, B) to authenticate each other, also secret key based Assumption: S and A share a secret key KA, S, B, key KB T: time stamp, works as a R. N. L: life time, K: session key, validation period determined by T, L A can decrypt the 1 st part of message from S, not the 2 nd part, The 2 nd part is passed to B, challenging B to respond T+1. 18

• Public key authentication A x: a R. N. No shared secret key required, only needs to know the other party’s public key B E(x , Pu blic B ) x 19

Message Integrity Protocols • Digital signature using RSA – special case of a message integrity that also ascertains the message is generated by true sender – compute signature with private key and verify with public key – DSS standardized by NIST, using a variant of RSA 20

Message Integrity Protocols • Keyed MD 5 – MD only does not provide integrity, any one can produce a valid MD with an altered message; has to involve a secret privy to the sender. – if the sender and receiver shares a secret key k, then sender: m + MD 5(m + k), if not: – sender: m + MD 5(m + k) + E[E(k, rcv-pub), snd-prv] • k: RN, the third part allows recovery of k by the receiver – receiver • recovers random key using the sender’s public key • applies MD 5 to the concatenation of this random key message 21

Message Integrity Protocols • MD 5 with RSA signature – sender: m + E(MD 5(m), snd-prv) – receiver • decrypts signature with sender’s public key • compares result with MD 5 checksum sent with message 22

Example Security Systems • Can be grouped by the main protocol layer at which they operate – L 3: IP Security (IPSEC) – L 4: Transport Layer Security (TLS), Secure Socket Layer (SSL) – Application: Pretty Good Privacy (PGP, email), Secure Shell (SSH, telnet) 23

Pretty Good Privacy (PGP) • Provide for encryption and authentication of emails • Authentication – Mesh structured trust relationship – Anyone can assign anyone else’s certificate, the more certificate signatures the more trust • Encryption – Sender selects a random secret key k, sends E[m, k] + E[k, receiver’s public key] • Allow different cryptographic algorithms (specified in the email header) 24

Secure Shell (SSH) • Problem with telnet – password and messages are sent in the clear • SSH v. 2 – Client connects to the server, the server provides its public key • doubtful value for the key, alternative: out-of-band mechanism – Client authenticates the server using public key algorithm, sets up a session key • a encrypted channel is established – Transmission of password and messages can start now – The secure channel provided by SSH is often used by other applications, e. g. X-windows, IMAP mail readers, etc. 25

Transport Layer Security (TLS, SSL, HTTPS) • TLS (SSL, older version) provides – A handshake protocol that authenticate and establishes a secure channel • Through exchange of certificates, keys • Hierarchical key distribution, root keys included in the browser. – A “record” protocol for data transfer • Handles encryption, message integrity, even compression • Maintains persistent session state through session ID – Avoid a security handshake for downloading each item (e. g. picture) • HTTPS = TLS/(SSL, older) + HTTP – assigned #port, 443. 26

Transport Layer Security 27

IP Security (IPSEC) • A ambitious framework to provide all security services at the IP level – Modular, allow users to select security algorithms, services, granularity (per connection btw. hosts, per trunk btw. routers) • Two components • Authentication header (AH) + Encapsulation Security Payload (ESP) – implement authentication, encryption, etc • Key management protocol (ISAKMP) • A secure connection consists of two simplex security associations (SA), each identifiable by an IP address and a security parameters index (SPI) 28

Wireless Security (802. 11 i) • Wi-Fi Protected Acess 2 (WPA 2, 802. 11 i) 29

Firewalls • A firewall is a router that enforces security policies – A centralized approach, in contrast to end-to-end approach such as IPSEC • Filter-Based Solution – Lists of 4 -tuples to allow/disallow – Example (prevent web traffic to 128. 7. 6. 5) ( 192. 13. 14, 1234, 128. 7. 6. 5, 80 ) (*, *, 128. 7. 6. 5, 80 ) – Default: forward or not forward? Tradeoff between security and convenience – Dynamic port selection: deals with the case that port number is determined by the application at run time 30

Proxy-Based Firewalls • Problem: complex policy • Example: web server – restrict certain web pages (URLs) to company users • Solution: proxy – determine whether to fetch the page depending on the user category • Works at application layer (HTTP), can also cache web pages, balance load • Limitations: attacks from within – malicious users, visitors, Wi. Fi access 31

Denial of Service • Attacks on end hosts – SYN attack • more effective than data packets due to more processing/states incurred • Attacks on routers – Christmas tree packets • Send packets with all IP options turned on, exhausting processing capability – Pollute route cache • Send serial sequence of IP packets, blowing away route cache and making router spend all its time build new forwarding table 32

Denial of Service • Counter attack – Detect resource usage anomaly • Account for resource usage • Discover if some users/connections are consuming disproportionate amount of resource – Restrict resource usage by misbehaving users/connecitons • Distributed Do. S attacks – Makes distinguishing legitimate heavy load and DDOS hard 33