CMSC 414 Computer and Network Security Lecture 19 Jonathan Katz

Otway-Rees  A  B: N C, K A (N A, N C, Alice, Bob)  B  KDC: K A (…), K B (N B, N C, Alice, Bob) –KDC checks that N C is the same…  KDC  B: N C, K A (N A, K AB ), K B (N B, K AB )  B  A: K A (…)  A  B: K AB (timestamp) –Note: KDC already authenticated Bob

Analysis?  N C should be unpredictable, not just a nonce –Otherwise, can impersonate B to KDC Send first message: (next N C ), “garbage” B forwards to KDC along with encryption of the next N C Next time A initiates a conversation, replay previous message from B  Still uses encryption for authentication…  –Serious attack if ECB is used Replace K AB with N C

Kerberos  (May discuss in more detail later)  A  KDC: N 1, Alice, Bob  KDC  A: K A (N 1, Bob, K AB, ticket), where ticket = K B (K AB, Alice, expiration time)  A  B: ticket, K AB (time)  B  A: K AB (time+1)

Certificate authorities and PKI