Security Overview Hofstra University University College for Continuing Education - Advanced Java Programming Lecturer: Engin Yalt May 24, 2006

Disclaimer The images in this presentation are taken from Network Security Essentials, William Stallings

Security Attacks

Interruption: attack on availability Interruption: attack on availability Interception: attack on confidentiality Interception: attack on confidentiality Modification: attack on integrity Modification: attack on integrity Fabrication: attack on authenticity Fabrication: attack on authenticity

Threat Classifications

Passive Attacks - Release of message contents

Passive Attacks - Traffic analysis

Active Attacks - Masquerade

Active Attacks – Replay

Active Attacks – Modification of message

Active Attacks – Denial of service

Security Goals Integrity Authenticity Availability Confidentiality

Security Services Confidentiality (privacy) Confidentiality (privacy) Authentication (who created or sent the data) Authentication (who created or sent the data) Integrity (has not been altered) Integrity (has not been altered) Non-repudiation (the order is final) Non-repudiation (the order is final) Access control (prevent misuse of resources) Access control (prevent misuse of resources) Availability (permanence, non-erasure) Availability (permanence, non-erasure) Denial of Service Attacks Denial of Service Attacks Virus that deletes files Virus that deletes files

Model of Network Security

Methods of Defense Encryption Encryption Software Controls (access limitations in a data base, in operating system protect each user from other users) Software Controls (access limitations in a data base, in operating system protect each user from other users) Hardware Controls (smartcard) Hardware Controls (smartcard) Policies (frequent changes of passwords) Policies (frequent changes of passwords) Physical Controls Physical Controls

Conventional Encryption

Cryptography Classified along three independent dimensions: The type of operations used for transforming plaintext to cipher text The type of operations used for transforming plaintext to cipher text The number of keys used The number of keys used symmetric (single key) (DES, 3DES) symmetric (single key) (DES, 3DES) asymmetric (two-keys, or public-key) (RSA) asymmetric (two-keys, or public-key) (RSA) The way in which the plaintext is processed The way in which the plaintext is processed Block cipher vs. Stream cipher processing Block cipher vs. Stream cipher processing

Average time required for exhaustive key search Key Size (bits) Number of Alternative Keys Time required at 10 6 Decryption/µs = 4.3 x milliseconds = 7.2 x hours = 3.4 x x years = 3.7 x x years

Key Distribution A key could be selected by A and physically delivered to B. A key could be selected by A and physically delivered to B. A third party could select the key and physically deliver it to A and B. A third party could select the key and physically deliver it to A and B. If A and B have previously used a key, one party could transmit the new key to the other, encrypted using the old key. If A and B have previously used a key, one party could transmit the new key to the other, encrypted using the old key. If A and B each have an encrypted connection to a third party C, C could deliver a key on the encrypted links to A and B. If A and B each have an encrypted connection to a third party C, C could deliver a key on the encrypted links to A and B.

Key Distribution Session key: Session key: Data encrypted with a one-time session key. At the conclusion of the session, the key is destroyed Data encrypted with a one-time session key. At the conclusion of the session, the key is destroyed Permanent key: Permanent key: Used between entities for the purpose of distributing session keys Used between entities for the purpose of distributing session keys

Key Distribution

Authentication Requirements - must be able to verify that: Requirements - must be able to verify that: 1. Message came from apparent source or author 2. Contents have not been altered, 3. Sometimes, it was sent at a certain time or sequence. Protection against active attack (falsification of data and transactions) Protection against active attack (falsification of data and transactions)

Authentication - MAC

Authentication – Encrypted MAC

Authentication – Secret Value

Public-Key Cryptography Use of two keys (public key, private key) Use of two keys (public key, private key) The scheme has six ingredients The scheme has six ingredients Public key Public key Private key Private key Plaintext Plaintext Encryption algorithm Encryption algorithm Ciphertext Ciphertext Decryption algorithm Decryption algorithm

Encryption using Public-Key

Authentication using Public-Key

Public-Key Cryptographic Algorithms RSA - Ron Rives, Adi Shamir and Len Adleman at MIT, in RSA - Ron Rives, Adi Shamir and Len Adleman at MIT, in RSA is a block cipher RSA is a block cipher The most widely implemented The most widely implemented Diffie-Hellman Diffie-Hellman Echange a secret key securely Echange a secret key securely Compute discrete logarithms Compute discrete logarithms

Public-Key Infrastructure (PKI) Creating Certificate * CA = Certificate Authority

Public-Key Infrastructure (PKI) Obtaining a Certificate

X.509 Authentication Service Distributed set of servers that maintains a database about users. Distributed set of servers that maintains a database about users. Each certificate contains the public key of a user and is signed with the private key of a CA*. Each certificate contains the public key of a user and is signed with the private key of a CA*. Is used in S/MIME, IP Security, SSL/TLS and SET. Is used in S/MIME, IP Security, SSL/TLS and SET. RSA is recommended to use. RSA is recommended to use. * CA = Certificate Authority

X.509 CA Hierarchy

Revocation of Certificates Reasons: Reasons: The users secret key is assumed to be compromised. The users secret key is assumed to be compromised. The user is no longer certified by this CA. The user is no longer certified by this CA. The CA’s certificate is assumed to be compromised. The CA’s certificate is assumed to be compromised.

Security PGP – (Pretty Good Privacy) PGP – (Pretty Good Privacy) Philip R. Zimmerman is the creator Philip R. Zimmerman is the creator Provides a confidentiality and authentication service Provides a confidentiality and authentication service Can be used for and file storage applications Can be used for and file storage applications S/MIME - (Secure/Multipurpose Internet Mail Extension) S/MIME - (Secure/Multipurpose Internet Mail Extension) Enveloped Data: content and session keys encrypted for recipients. Enveloped Data: content and session keys encrypted for recipients. Signed Data: Message Digest encrypted with private key of “signer.” Signed Data: Message Digest encrypted with private key of “signer.” Clear-Signed Data: Signed but not encrypted. Clear-Signed Data: Signed but not encrypted. Signed and Enveloped Data Signed and Enveloped Data

PGP

Secure Sockets Layer - SSL Browser connects to a secure server Browser connects to a secure server The server sends it’s certificate The server sends it’s certificate The browser The browser verifies the certificate verifies the certificate creates a session key (shared secret) creates a session key (shared secret) encrypts the session key with server’s public key encrypts the session key with server’s public key sends it to the server. sends it to the server. The server decrypts the session key using it’s private key The server decrypts the session key using it’s private key The handshake is comlete! Now browser and server can talk using a shared secret key. The handshake is comlete! Now browser and server can talk using a shared secret key. The browser send sensitive info (credit card) over a secure channel. The browser send sensitive info (credit card) over a secure channel.

Security and Java Platform Platform Security (Java Language, Sand Box) Platform Security (Java Language, Sand Box) Cryptography (JCA, JCE) Cryptography (JCA, JCE) Authentication and Access Control (JAAS) Authentication and Access Control (JAAS) Secure Communications (JSSE, JGSS) Secure Communications (JSSE, JGSS) Public Key Infrastructure (PKI) Public Key Infrastructure (PKI)