EEC 688/788 Secure and Dependable Computing Lecture 4 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University wenbing@ieee.org 2/24/2019 EEC688: Secure & Dependable Computing 1

EEC688: Secure & Dependable Computing Outline Public-key algorithms Digital signatures, Message digest, Message authentication code Public key management Authentication Concept Authentication protocols Attacks on authentication protocols 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Public-Key Algorithms Distributing keys => the weakest link in most cryptosystems No matter how strong a cryptosystem was, if an intruder could steal the key, the system was worthless Cryptologists always took for granted that the encryption key and decryption key were the same Diffie and Hellman (1976) proposed a radically new kind of cryptosystem: encryption and decryption keys were different D(E(P)) = P It is exceedingly difficult to deduce D from E E cannot be broken by a chosen plaintext attack 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Public-Key Algorithms Public-key cryptography: Encryption algorithm and the encryption key can be made public How to establish a secure channel Alice and Bob have never had previous contact Alice sends Bob EB(P) (message P encrypted using Bob’s public encryption key EB) Bob receives the encrypted message and retrieves the plaintext by using his private key P = DB(EB(P)) Bobs then sends a reply EA(R) to Alice 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing RSA Rivest, Shamir, Adleman, 1978: a good method for public-key cryptography RSA method: Choose two large primes, p and q (typically 1024 bits) Compute n = p  q and z = (p-1)  (q-1) Choose a number relatively prime to z and call it d Find e such that e  d = 1 mod z To encrypt a message, P, Compute C = Pe (mod n) To decrypt C, compute P = Cd (mod n) The public key consists of the pair (e, n) The private key consists of the pair (d, n) 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing RSA An example of the RSA algorithm P = 3, q = 11 => n = 33 and z = 20 A suitable value for d = 7 e can be found by solving the eq. 7e = 1 (mod 20) => e = 3 C = P3 (mod 33), P = C7 (mod 33) 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing Digital Signatures Requirement on digital signatures: one party can send a signed message to another party in such a way that the following conditions hold: The receiver can verify the claimed identity of the sender The sender cannot later repudiate the contents of the message The receiver cannot possibly have fabricated the message himself 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Symmetric-Key Signatures Big Brother (BB): a central authority that knows everything and whom everyone trusts Each user chooses a secret key and shares it with BB Digital signatures with Big Brother 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Public-Key Signatures Digital signatures using public-key cryptography Requires E(D(P)) = P (in addition to D(E(P)) = P) 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing Message Digests Message digest (MD): using a one-way hash function that takes an arbitrarily long piece of plaintext and from it computes a fixed-length bit string Requirement on the hash function: Given P, it is easy to compute MD(P) Given MD(P), it is effectively impossible to find P No collision: given P no one can find P’ such that MD(P’) = MD(P) A change to the input of even 1 bit produces a very different output Often, authentication is needed but secrecy is not Given P no one can find P’ such that MD(P’) = MD(P): it means that the task to find a collision is computationally very expensive 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Digital Signatures Using Message Digests Ask question: why encryption of message digest is not needed? 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing MD5 One of the most widely used hash functions MD5 is the fifth in a series of message digests designed by Ronald Rivest (1992) It operates by mangling bits in a sufficiently complicated way that every output bit is affected by every input bit MD5 generates a 128-bit fixed value 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing SHA-1 SHA-1: Secure Hash Algorithm 1, developed by National Security Agency (NSA) and blessed by NIST. It generates 160-bit message digest SHA-2: a set of secure hash algorithms SHA-224, SHA-256, SHA-384, SHA-512 Use of SHA-1 and RSA for signing nonsecret messages 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Message Authentication Code MACs are used between two parties that share a secret key in order to validate information transmitted between these parties The MAC mechanism that is based on cryptographic hash functions is called HMAC: Append the key to the plaintext and generate a digest using a hash function Ship the plaintext together with the digest 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Management of Public Keys Problem statement Certificates X.509 Public key infrastructure Start next Wednesday 9/16 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Problems with Public-Key Management If Alice and Bob do not know each other, how do they get each other’s public keys to start the communication process ? It is essential Alice gets Bob’s public key, not someone else’s A way for Trudy to subvert public-key encryption 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing Certificates Certification Authority (CA): an organization that certifies public keys It certifies the public keys belonging to people, companies, or even attributes CA does not need to be on-line all the time (in ideal scenarios) A possible certificate and its signed hash 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing X.509 Devised and approved by ITU The basic fields of an X.509 certificate 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Public-Key Infrastructures A Public-Key Infrastructure (PKI) is needed for reasons of Availability, Scalability, Ease of management A PKI has multiple components Users, CAs, Certificates, RAs (Registration Authorities) A PKI provides a way of structuring these components and define standards for the various documents and protocols A simple form of PKI is hierarchical CAs 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Public-Key Infrastructures Hierarchical PKI A chain of trust/certification path: A chain of certificates going back to the root A registration authority (RA) that acts as the verifier for the certificate authority before a digital certificate is issued to a requestor 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Public-Key Infrastructures Revocation: sometimes certificates can be revoked, due to a number of reasons Reinstatement: a revoked certificate could conceivably be reinstated Each CA periodically issues a CRL (Certificate Revocation List) giving the serial numbers of all certificates that it has revoked A user who is about to use a certificate must now acquire the CRL to see if the certificate has been revoked Having to deal with revocation (and possibly reinstatement) eliminates one of the best properties of certificates, namely, that they can be used without having to contact a CA Revocation examples: Person or organization holding it has abused it in some way The subject's private key has been exposed The CA's private key has been compromised Reinstatement example: if it was revoked for nonpayment of some fee that has since been paid 2/24/2019 EEC688: Secure & Dependable Computing

Authentication Protocols Authentication is the technique by which a process verifies that its communication partner is who it is supposed to be and not an imposter Verifying the identity of a remote process in the face of a malicious, active intruder is surprisingly difficult and requires complex protocols based on cryptography Not to be confused with authorization Authorization is concerned with what process is permitted to do 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing Authorization Authentication: Verify the claim that a subject says it is S: verifying the identity of a subject Authorization: Determining whether a subject is permitted certain services from an object Note: authorization makes sense only if the requesting subject has been authenticated 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

General Model for Authentication Protocols Alice starts out by sending a message either to Bob or to a trusted KDC (Key Distribution Center), which is expected to be honest Several other message exchanges follow in various directions Trudy may intercept, modify, or replay the messages transmitted to trick Alice and Bob When the protocol has been completed, Alice is sure she is talking to Bob and Bob is sure he is talking to Alice 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

General Model for Authentication Protocols In general, the authentication process also produce a secret session key for use in the upcoming conversation For each new connection, a new, randomly-chosen session key should be used Public-key cryptography is widely used for the authentication protocols themselves and for establishing the session key 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing Why Use a Session Key For performance reasons, symmetric key encryption is much faster than public-key encryption To minimize the amount of traffic that gets sent with the users’ secret keys These keys are used to establish the secure session To reduce the amount of ciphertext encrypted using the same key which an intruder can obtain If a session key is broken, only info sent in that session is exposed To minimize the damage done if a process crashes and its core dump falls into the wrong hands. Hopefully, the only key present then will be the session key All the permanent keys should have been carefully zeroed out after the session was established 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Authentication Protocols Authentication Based on a Shared Secret Key Establishing a Shared Key: Diffie-Hellman Authentication Using a Key Distribution Center Authentication Using Public-Key Cryptography 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Authentication Based on a Shared Secret Key Two-way authentication using a challenge-response protocol Challenge-response: one party sends a random number to the other, who then transforms it in a special way and then returns the result Nonces: random numbers used just once in challenge-response protocols Assume that Alice and Bob already share a secret key, KAB What else should only be used once? 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Authentication Based on a Shared Secret Key 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Authentication Based on a Shared Secret Key A shortened two-way authentication protocol. Is this new protocol an improvement over the original one ? It is shorter But it is also wrong Under certain circumstances, Trudy can defeat this protocol by using what is known as a reflection attack 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

EEC688: Secure & Dependable Computing Reflection Attack The reflection attack: Trudy can break it if it is possible to open multiple sessions with Bob at once This attack can be defeated by encrypting RB with KAB in message 2 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

General Rules for Authentication Protocols Design Rule#1: Have the initiator prove who she is before the responder has to In the previous case, Bob gives away valuable information before Trudy has to give any evidence of who she is Rule#2: Have the initiator and responder use different keys for proof, e.g., KAB and K'AB Rule#3: Have the initiator and responder draw their challenges from different sets E.g., the initiator uses even numbers, the responder uses odd numbers Rule#4: Be aware of parallel sessions (no info flows across different sessions) Rule#1: In the previous case, Bob gives away valuable information before Trudy has to give any evidence of who she is Rule#2: even if this means having two shared keys, KAB and K'AB Rule#3: E.g., the initiator uses even numbers, the responder uses odd numbers Rule#4: Make the protocol resistant to attacks involving a second parallel session in which information obtained in one session is used in a different one 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Establishing a Shared Key: The Diffie-Hellman Key Exchange A protocol that leads to the establishment of a shared secrete key is called key agreement protocol or key exchange protocol Diffie-Hellman key exchange Two large numbers, n and g, where n is a prime, (n - 1)/2 is also a prime and certain conditions apply to g 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Establishing a Shared Key: The Diffie-Hellman Key Exchange 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Establishing a Shared Key: The Diffie-Hellman Key Exchange Example: n = 47 and g = 3. Alice picks x = 8 and Bob picks y = 10. Both of these are kept secret Alice's message to Bob is (47, 3, 28) because 38 mod 47 is 28. Bob's message to Alice is (17) Alice computes 178 mod 47, which is 4 Bob computes 2810 mod 47, which is 4 Alice and Bob have independently determined that the secret key is now 4 Trudy has to solve the equation 3x mod 47 = 28 47 is a prime, so does (47-1)/2=23 Trudy has to solve the equation 3x mod 47 = 28, which can be done by exhaustive search for small numbers like this, but not when all the numbers are hundreds of bits long 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Establishing a Shared Key: The Diffie-Hellman Key Exchange The man-in-the-middle attack When Bob gets (47, 3, 28), how does he know it is from Alice and not from Trudy? There is no way he can know Trudy can exploit this fact to deceive both Alice and Bob Man in the middle attack is also called bucket brigade 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Man-In-The-Middle Attack A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised The attacker must be able to observe and intercept messages going between the two victims The MITM attack can work against public-key cryptography and is also particularly applicable to the original Diffie-Hellman key exchange protocol, when used without authentication. 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Authentication Using a Key Distribution Center Each user has a single key shared with the KDC. Authentication and session key management now goes through the KDC The following protocol is subject to replay attack 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Needham-Schroeder Authentication Protocol Needham-Schroeder protocol: a multi-way challenge-response protocol To eliminate the possibility of replay attacks, have each party both generate a challenge and respond to one 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Needham-Schroeder Authentication Protocol Message 1: RA is a nonce Message 2: KB(A, KS) is ticket Alice will send to Bob RA: so that message 2 is not a replay B: so that if Trudy replaces B with her id in message 1, it will be detected Ticket is encrypted using Bob’s key KB so that Trudy cannot replace it with something else on the way back to Alice 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Needham-Schroeder Authentication Protocol Message 3: a new nonce RA2 is used Message 4: Bob sends back KS(RA2-1) instead of KS(RA2) so that Trudy cannot steal KS(RA2) from message 3 and replay it here Message 5: to convince Bob he is talking to Alice and no replays are being used Regarding msg#4: if it is expected Bob to send KS(RA2) back instead of KS(RA2-1), Trudy could intercept msg#3 and response with msg#4 without the need to know either KB and KS. This would invalidate the purpose to authenticate Bob. The original design idea: to get expected response, Bob needs to know KS, to know KS, Bob must have KB. Good protocol have defense in depth: even if Trudy supplied an expected reply, she still must break the session key KS to cause any damage. 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Authentication Using Public-Key Cryptography Message 1: Alice asks a directory server for Bob’s certificate (containing Bob’s public key) Message 2: An X.509 certificate containing Bob's public key is sent to Alice Message 3: When Alice verifies that the signature is correct, she sends Bob a message containing her identity and a nonce Message 4: When Bob receives this message, he asks the directory server for Alice's public key Message 5: An X.509 certificate containing Alice’s public key is sent to Bob Message 6: Bob then sends Alice a message containing Alice's RA, his own nonce, RB, and a proposed session key, KS Message 7: When Alice gets message 6, she decrypts it using her private key. The fact that RA is in message 6 proves that The message must have come from Bob, since Trudy has no way of determining RA Furthermore, it must be fresh and not a replay, since she just sent Bob RA Alice agrees to the session by sending back message 7 When Bob sees RB encrypted with the session key he just generated, he knows Alice got message 6 and verified RA 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao

Authentication Using Public-Key Cryptography What can Trudy do to try to subvert this protocol? She can fabricate message 3 and trick Bob into probing Alice, but Alice (from message 6) will see an RA that she did not send and will not proceed further Trudy cannot forge message 7 back to Bob because she does not know RB or KS and cannot determine them without Alice's private key 2/24/2019 EEC688: Secure & Dependable Computing

EEC688: Secure & Dependable Computing Homework Exercise #5 Recall that the following authentication protocol is vulnerable to the reflection attack. Make one change to the protocol so that it is no longer vulnerable to the reflection attack. Software control will be elaborated in more details in the next slide 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao 44

EEC688: Secure & Dependable Computing Homework Exercise #6 Considering the following way of producing a digital signature using message digests. If the one-way hash function used is not robust and one can easily find the collision on the hash. Which requirement (or requirements) of the digital signature would be violated? Software control will be elaborated in more details in the next slide 2/24/2019 EEC688: Secure & Dependable Computing Wenbing Zhao 45