EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 6 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University

2 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Outline Cipher modes Public-key algorithms Digital signatures Message digest Message authentication code Public key management Authentication protocols

3 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Counter Mode To allow random access to encrypted data –The IV plus a constant is encrypted, and the resulting ciphertext XORed with the plaintext –By stepping the IV by 1 for each new block, it is easy to decrypt a block anywhere in the file without first having to decrypt all of its predecessors

4 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Public-Key Algorithms Distributing keys => the weakest link in most cryptosystems –No matter how strong a cryptosystem was, if an intruder could steal the key, the system was worthless –Cryptologists always took for granted that the encryption key and decryption key were the same Diffie and Hellman (1976) proposed a radically new kind of cryptosystem: encryption and decryption keys were different –D(E(P)) = P –It is exceedingly difficult to deduce D from E –E cannot be broken by a chosen plaintext attack

5 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Public-Key Algorithms Public-key cryptography: –Encryption algorithm and the encryption key can be made public How to establish a secure channel –Alice and Bob have never had previous contact –Alice sends Bob E B (P) (message P encrypted using Bob’s public encryption key E B ) –Bob receives the encrypted message and retrieves the plaintext by using his private key P = D B (E B (P)) –Bobs then sends a reply E A (R) to Alice

6 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao RSA Rivest, Shamir, Adleman, 1978: a good method for public- key cryptography RSA method: –Choose two large primes, p and q (typically 1024 bits) –Compute n = p  q and z = ( p-1 )  ( q-1 ) –Choose a number relatively prime to z and call it d –Find e such that e  d = 1 mod z To encrypt a message, P, Compute C = P e (mod n) To decrypt C, compute P = C d (mod n) The public key consists of the pair (e, n) The private key consists of the pair (d, n)

7 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao RSA An example of the RSA algorithm –P = 3, q = 11 => n = 33 and z = 20 –A suitable value for d = 7 –e can be found by solving the eq. 7e = 1 (mod 20) => e = 3 –C = P 3 (mod 33), P = C 7 (mod 33)

8 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Digital Signatures Requirement on digital signatures: one party can send a signed message to another party in such a way that the following conditions hold: –The receiver can verify the claimed identity of the sender –The sender cannot later repudiate the contents of the message –The receiver cannot possibly have fabricated the message himself

9 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Symmetric-Key Signatures Big Brother (BB): a central authority that knows everything and whom everyone trusts –Each user chooses a secret key and shares it with BB Digital signatures with Big Brother

10 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Public-Key Signatures Digital signatures using public-key cryptography –Requires E(D(P)) = P (in addition to D(E(P)) = P)

11 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Message Digests Message digest (MD): using a one-way hash function that takes an arbitrarily long piece of plaintext and from it computes a fixed-length bit string Requirement on the hash function: –Given P, it is easy to compute MD(P) –Given MD(P), it is effectively impossible to find P –Given P no one can find P’ such that MD(P’) = MD(P) –A change to the input of even 1 bit produces a very different output

12 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Digital Signatures Using Message Digests

13 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao MD5 One of the most widely used hash functions MD5 is the fifth in a series of message digests designed by Ronald Rivest (1992) It operates by mangling bits in a sufficiently complicated way that every output bit is affected by every input bit MD5 generates a 128-bit fixed value

14 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SHA-1 SHA-1: Secure Hash Algorithm 1, developed by National Security Agency (NSA) and blessed by NIST. It generates 160-bit message digest Use of SHA-1 and RSA for signing nonsecret messages

15 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Message Authentication Code MACs are used between two parties that share a secret key in order to validate information transmitted between these parties The MAC mechanism that is based on cryptographic hash functions is called HMAC: –Append the key to the plaintext and generate a digest using a hash function –Ship the plaintext together with the digest

16 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Management of Public Keys Problem statement Certificates X.509 Public key infrastructure

17 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Problems with Public-Key Management If Alice and Bob do not know each other, how do they get each other’s public keys to start the communication process ? –It is essential Alice gets Bob’s public key, not someone else’s A way for Trudy to subvert public-key encryption

18 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Certificates Certification Authority (CA): an organization that certifies public keys –It certifies the public keys belonging to people, companies, or even attributes –CA does not need to be on-line all the time (in ideal scenarios) A possible certificate and its signed hash

19 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao X.509 Devised and approved by ITU The basic fields of an X.509 certificate

20 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Public-Key Infrastructures A Public-Key Infrastructure (PKI) is needed for reasons of –Availability, Scalability, Ease of management A PKI has multiple components –Users, CAs, Certificates, Directories A PKI provides a way of structuring these components and define standards for the various documents and protocols –A simple form of PKI is hierarchical CAs

21 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Public-Key Infrastructures Hierarchical PKI A chain of trust/certification path: A chain of certificates going back to the root

22 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Public-Key Infrastructures Revocation: sometimes certificates can be revoked, due to a number of reasons Reinstatement: a revoked certificate could conceivably be reinstated Each CA periodically issues a CRL (Certificate Revocation List) giving the serial numbers of all certificates that it has revoked –A user who is about to use a certificate must now acquire the CRL to see if the certificate has been revoked Having to deal with revocation (and possibly reinstatement) eliminates one of the best properties of certificates, namely, that they can be used without having to contact a CA

23 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Authentication Protocols Authentication is the technique by which a process verifies that its communication partner is who it is supposed to be and not an imposter –Verifying the identity of a remote process in the face of a malicious, active intruder is surprisingly difficult and requires complex protocols based on cryptography Not to be confused with authorization –Authorization is concerned with what process is permitted to do

24 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao General Model for Authentication Protocols Alice starts out by sending a message either to Bob or to a trusted KDC (Key Distribution Center), which is expected to be honest Several other message exchanges follow in various directions Trudy may intercept, modify, or replay the messages transmitted to trick Alice and Bob When the protocol has been completed, Alice is sure she is talking to Bob and Bob is sure he is talking to Alice

25 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao General Model for Authentication Protocols In general, the authentication process also produce a secret session key for use in the upcoming conversation –For each new connection, a new, randomly-chosen session key should be used Public-key cryptography is widely used for the authentication protocols themselves and for establishing the session key

26 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Why Use a Session Key For performance reasons, symmetric key encryption is much faster than public-key encryption To minimize the amount of traffic that gets sent with the users’ secret keys or public keys To reduce the amount of ciphertext an intruder can obtain To minimize the damage done if a process crashes and its core dump falls into the wrong hands. Hopefully, the only key present then will be the session key –All the permanent keys should have been carefully zeroed out after the session was established

27 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Authentication Protocols Authentication Based on a Shared Secret Key Establishing a Shared Key: Diffie-Hellman Authentication Using a Key Distribution Center Authentication Using Public-Key Cryptography

28 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Authentication Based on a Shared Secret Key Two-way authentication using a challenge- response protocol –Challenge-response: one party sends a random number to the other, who then transforms it in a special way and then returns the result –Nonces: random numbers used just once in challenge-response protocols –Assume that Alice and Bob already share a secret key, K AB

29 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Authentication Based on a Shared Secret Key

30 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Authentication Based on a Shared Secret Key A shortened two-way authentication protocol. Is this new protocol an improvement over the original one ? –It is shorter –But it is also wrong –Under certain circumstances, Trudy can defeat this protocol by using what is known as a reflection attack

31 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Reflection Attack The reflection attack: Trudy can break it if it is possible to open multiple sessions with Bob at once This attack can be defeated by encrypting R B with K AB in message 2

32 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao General Rules for Authentication Protocols Design Have the initiator prove who she is before the responder has to Have the initiator and responder use different keys for proof Have the initiator and responder draw their challenges from different sets Be aware of parallel sessions (no info flows across different sessions)

33 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange A protocol that leads to the establishment of a shared secrete key is called key agreement protocol or key exchange protocol Diffie-Hellman key exchange –Two large numbers, n and g, where n is a prime, (n - 1)/2 is also a prime and certain conditions apply to g

34 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange

35 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange Example: n = 47 and g = 3. Alice picks x = 8 and Bob picks y = 10. Both of these are kept secret –Alice's message to Bob is (47, 3, 28) because 3 8 mod 47 is 28. Bob's message to Alice is (17) –Alice computes 17 8 mod 47, which is 4 –Bob computes mod 47, which is 4 –Alice and Bob have independently determined that the secret key is now 4 –Trudy has to solve the equation 3 x mod 47 = 28

36 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange The man-in-the-middle attack –When Bob gets (47, 3, 28), how does he know it is from Alice and not from Trudy? There is no way he can know –Trudy can exploit this fact to deceive both Alice and Bob