Handshake Protocols COEN 350

Simple Protocol Alice: Hi, I am Alice. My password is “fiddlesticks”. Bob: Welcome, Alice.

Simple Protocol Vulnerable to sniffing and replay attack. Alice: Hi, I am Alice. My password is “fiddlesticks”. Bob: Welcome, Alice.... Mallory: Hi, I am Alice. My password is “fiddlesticks”. Bob: Welcome, Alice.

Shared Secret Alice and Bob share a secret key K. Alice: I am Alice. Bob: Encrypt R. Alice: E K (R) Bob (calculates E K (R) as well.): Welcome Alice.

Shared Secret Vulnerable to DOS attack. while(1){ Mallory: I am Alice. Bob: Encrypt R. Mallory: X. Bob (E K (R) != X): Access denied. }

Shared Secret Vulnerable to sniffing and replay attack if R is not random or if R is repeated.

Shared Secret, use of clock Alice: I am Alice, E K (clock). Bob calculates clock, compares with his value: Welcome Alice.

Shared secret, use of clock Man in the Middle + replay attack: Mallory to Bob: KILL, KILL, KILL, KILL. Alice: Hi, I’m Alice. E K (clock). Mallory to Alice: KILL, KILL, KILL, KILL. Mallory to Bob: Hi, I’m Alice. E K (clock). Bob: Hi, Alice.

Public Key Alice: “I’m Alice.” Bob: “R”. Alice: “E Alice (R)”. Bob calculates “D Alice E Alice (R) == R: Hi Alice.

Public Key Alice: “I’m Alice.” Bob creates random challenge R: “E Alice (R)”. Alice: “R”. Bob checks R == R: Hi Alice.

Public Key: DOS attack Trudy: “I’m Alice.” Bob: “R”. Trudy: “X” Bob calculates “D Alice E Alice (X) != R: Access Denied. Bob spends much more time computing than Trudy!

Mutual Authentication: Shared Secret Alice: “I am Alice” Bob: “R B ” Alice: E K (R B ). R A. Bob calculates E K (R B ) himself: E K (R A ). Hi Alice. Alice calculates E K (R A ) herself: Hi Bob.

Mutual Authentication with less messages? Alice: I am Alice. R A Bob: R B. E K (R A ). Alice: Hi Bob. E K (R B ). Bob: Hi Alice.

Mutual Authentication with less steps is vulnerable to the replay attack Session 1 Trudy: I am Alice. R A. Session 1 Bob: R B. E K (R A ). Session 2 Trudy: I am Alice. R B. Session 2 Bob: R B’. E K (R B ). Session 1 Trudy: Hi Bob. E K (R B ). Session 1 Bob: Hi Alice.

Warning Signals  Requestor should authenticate herself first.  Don’t have requestor and requestee do exactly the same thing. (E.g. use different key pairs.)  If you provide encryption service, you set yourself up for a key guessing attack.

Public Key: Simple Mutual Authentication Alice: “I am Alice. R A ” Bob:“E Bob (R A ). R B ” Alice D Bob E Bob (R A )=R A : Hello Bob. E Alice (R B ). Bob: D Alice E Alice (R B ) = R B : Hello Alice.

Key Distribution Centers  Maintains a shared secret for each registered user.  To set-up a connection requires the KDC to set up a session key.

Key Distribution Center Original Algorithm  Alice to KDC: Alice wants Bob.  KDC to Alice: Here is your session key.  KDC to Bob: Here is your session key. This needs to be modified.

Key Distribution Center: Needham Schroeder Protocol Alice to KDC: N1, Alice wants Bob. KDC to Alice: K A (N1,K S,Bob,Ticket), where Ticket=K B (K S,Alice). Alice to Bob: Ticket, K S (N2). Bob to Alice: K S (N2-1,N3). Alice to Bob: K(N3-1). N1, N2, N3 are nonces to prevent replay attacks.

Key Distribution Center: Needham Schroeder Protocol Variant Alice to KDC: N1, Alice wants Bob. KDC to Alice: K A (N1,K S,Bob,Ticket), where Ticket=K B (K S,Alice). Alice to Bob: Ticket, K S (N2). Bob to Alice: K S (N2-1),K S (N3). Alice to Bob: K(N3-1). N1, N2, N3 are nonces to prevent replay attacks.

Replay attack on modified NS Alice to KDC: N1, Alice wants Bob. KDC to Alice: K A (N1,K S,Bob,Ticket), where Ticket=K B (K S,Alice). Alice to Bob: Ticket, K S (N2). Bob to Alice: K S (N2-1),K S (N3). Alice to Bob: K S (N3-1). Trudy as Alice to Bob: Ticket, K S (N 2 ) Bob to Alice, but intercepted by Trudy: K S (N 2 -1), K S (N 4 ) Trudy as Alice to Bob: Ticket, K S (N 4 ). Bob to Alice, but intercepted by Trudy. K S (N4-1), K S (N 5 ). Trudy as Alice to Bob: K S (N4-1).

Key Distribution Center  Assume that Alice’s key has become compromised.  Trudy can now present herself as Alice to Bob with an old ticket.  Tickets need to have an expiration date!!!!!!!!!!!