EEC 688/788 Secure and Dependable Computing Lecture 7 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University

Slides:



Advertisements
Similar presentations
Key distribution and certification In the case of public key encryption model the authenticity of the public key of each partner in the communication must.
Advertisements

CSC 474 Information Systems Security
ECE454/CS594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2011.
Last Class: The Problem BobAlice Eve Private Message Eavesdropping.
CIS 725 Key Exchange Protocols. Alice ( PB Bob (M, PR Alice (hash(M))) PB Alice Confidentiality, Integrity and Authenication PR Bob M, hash(M) M, PR Alice.
1 Security Handshake Pitfalls. 2 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: –Authenticate.
Interlock Protocol - Akanksha Srivastava 2002A7PS589.
1 Digital Signatures & Authentication Protocols. 2 Digital Signatures have looked at message authentication –but does not address issues of lack of trust.
EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 6 Wenbing Zhao Department of Electrical and Computer Engineering.
Lecture III : Communication Security, Services & Mechanisms Internet Security: Principles & Practices John K. Zao, PhD SMIEEE National Chiao-Tung University.
CS555Spring 2012/Topic 161 Cryptography CS 555 Topic 16: Key Management and The Need for Public Key Cryptography.
EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 6 Wenbing Zhao Department of Electrical and Computer Engineering.
EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 7 Wenbing Zhao Department of Electrical and Computer Engineering.
ECOMMERCE TECHNOLOGY FALL 2003 COPYRIGHT © 2003 MICHAEL I. SHAMOS Cryptography.
Cryptography1 CPSC 3730 Cryptography Chapter 10 Key Management.
8-1 What is network security? Confidentiality: only sender, intended receiver should “understand” message contents m sender encrypts message m receiver.
Mar 5, 2002Mårten Trolin1 Previous lecture More on hash functions Digital signatures Message Authentication Codes Padding.
McGraw-Hill©The McGraw-Hill Companies, Inc., 2004 Chapter 30 Message Security, User Authentication, and Key Management.
EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 7 Wenbing Zhao Department of Electrical and Computer Engineering.
CMSC 414 Computer and Network Security Lecture 22 Jonathan Katz.
Kemal AkkayaWireless & Network Security 1 Department of Computer Science Southern Illinois University Carbondale CS 591 – Wireless & Network Security Lecture.
More on AuthenticationCS-4513 D-term More on Authentication CS-4513 Distributed Computing Systems (Slides include materials from Operating System.
Slide 1 Vitaly Shmatikov CS 378 Key Establishment Pitfalls.
EEC 688/788 Secure and Dependable Computing Lecture 6 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University
EEC 688/788 Secure and Dependable Computing Lecture 12 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University
CMSC 414 Computer and Network Security Lecture 23 Jonathan Katz.
Chapter 9 Cryptographic Protocol Cryptography-Principles and Practice Harbin Institute of Technology School of Computer Science and Technology Zhijun Li.
Key Distribution CS 470 Introduction to Applied Cryptography
1 CS 194: Distributed Systems Security Scott Shenker and Ion Stoica Computer Science Division Department of Electrical Engineering and Computer Sciences.
Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved DISTRIBUTED SYSTEMS.
Diffie-Hellman Key Exchange
Alexander Potapov.  Authentication definition  Protocol architectures  Cryptographic properties  Freshness  Types of attack on protocols  Two-way.
31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
Computer Security Tran, Van Hoai Department of Systems & Networking Faculty of Computer Science & Engineering HCMC University of Technology.
Network Security Chapter Computer Networks, Fifth Edition by Andrew Tanenbaum and David Wetherall, © Pearson Education-Prentice Hall, 2011.
EEC 688/788 Secure and Dependable Computing
ECE 454/CS 594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall.
CSCD 218 : DATA COMMUNICATIONS AND NETWORKING 1
Using Cryptography for Network Security Common problems: –Authentication - A and B want to prove their identities to one another –Key-distribution - A.
Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved DISTRIBUTED.
PUBLIC-KEY CRYPTOGRAPH IT 352 : Lecture 2- part3 Najwa AlGhamdi, MSc – 2012 /1433.
Lecture 16: Security CDK4: Chapter 7 CDK5: Chapter 11 TvS: Chapter 9.
Upper OSI Layers Natawut Nupairoj, Ph.D. Department of Computer Engineering Chulalongkorn University.
31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
Digital Signatures, Message Digest and Authentication Week-9.
1 Needham-Schroeder A --> S: A,B, N A S --> A: {N A,B,K AB,{K AB,A} KBS } KAS A --> B:{K AB,A} KBS B --> A:{N B } KAB A --> B:{N B -1} KAB.
6 June Lecture 2 1 TU Dresden - Ws on Proof Theory and Computation Formal Methods for Security Protocols Catuscia Palamidessi Penn State University,
Using Cryptography for Network Security Common problems: –Authentication - A and B want to prove their identities to one another –Key-distribution - A.
31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
1 Chapter 10: Key Management in Public key cryptosystems Fourth Edition by William Stallings Lecture slides by Lawrie Brown (Modified by Prof. M. Singhal,
The School of Electrical Engineering and Computer Science (EECS) CS/ECE Network Security Dr. Attila Altay Yavuz Authentication Protocols (I): Secure Handshake.
EEC 688/788 Secure and Dependable Computing Lecture 4 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University
EEC 688/788 Secure and Dependable Computing Lecture 4 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University
Key Management Network Systems Security Mort Anvari.
Identify Friend or Foe (IFF) Chapter 9 Simple Authentication protocols Namibia Angola 1. N 2. E(N,K) SAAF Impala Russian MIG 1 Military needs many specialized.
Diffie-Hellman Key Exchange first public-key type scheme proposed by Diffie & Hellman in 1976 along with the exposition of public key concepts – note:
9.2 SECURE CHANNELS JEJI RAMCHAND VEDULLAPALLI. Content Introduction Authentication Message Integrity and Confidentiality Secure Group Communications.
Lesson Introduction ●Authentication protocols ●Key exchange protocols ●Kerberos Security Protocols.
@Yuan Xue CS 285 Network Security Key Distribution and Management Yuan Xue Fall 2012.
SECURITY. Security Threats, Policies, and Mechanisms There are four types of security threats to consider 1. Interception 2 Interruption 3. Modification.
Tanenbaum & Van Steen, Distributed Systems: Principles and Paradigms, 2e, (c) 2007 Prentice-Hall, Inc. All rights reserved DISTRIBUTED SYSTEMS.
Network Security and It’s Issues
Security Handshake Pitfalls. Client Server Hello (K)
Computer Communication & Networks
EEC 688/788 Secure and Dependable Computing
EEC 688/788 Secure and Dependable Computing
EEC 688/788 Secure and Dependable Computing
刘振 上海交通大学 计算机科学与工程系 电信群楼3-509
Secure Diffie-Hellman Algorithm
AIT 682: Network and Systems Security
Presentation transcript:

EEC 688/788 Secure and Dependable Computing Lecture 7 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University

2 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Outline Midterm #1 Results Authentication Concept General model for authentication protocols Authentication protocols –Authentication Based on a Shared Secret Key –Establishing a Shared Key: Diffie-Hellman –Authentication Using a Key Distribution Center –Authentication Using Public-Key Cryptography Attacks on authentication protocols

3 Midterm #1 Results High 100, low 79, average: 90.4 Q1: 26.4/30, Q2: 28.1/30, Q3: 19.3/20, Q4: 16.6/20 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao

4 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authentication Protocols Authentication is the technique by which a process verifies that its communication partner is who it is supposed to be and not an imposter –Verifying the identity of a remote process in the face of a malicious, active intruder is surprisingly difficult and requires complex protocols based on cryptography Not to be confused with authorization –Authorization is concerned with what process is permitted to do

5 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authorization Authentication: Verify the claim that a subject says it is S: verifying the identity of a subject Authorization: Determining whether a subject is permitted certain services from an object Note: authorization makes sense only if the requesting subject has been authenticated

6 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao General Model for Authentication Protocols Alice starts out by sending a message either to Bob or to a trusted KDC (Key Distribution Center), which is expected to be honest Several other message exchanges follow in various directions Trudy may intercept, modify, or replay the messages transmitted to trick Alice and Bob When the protocol has been completed, Alice is sure she is talking to Bob and Bob is sure he is talking to Alice

7 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao General Model for Authentication Protocols In general, the authentication process also produce a secret session key for use in the upcoming conversation –For each new connection, a new, randomly-chosen session key should be used Public-key cryptography is widely used for the authentication protocols themselves and for establishing the session key

8 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Why Use a Session Key For performance reasons, symmetric key encryption is much faster than public-key encryption To minimize the amount of traffic that gets sent with the users’ secret keys or public keys –These keys are used to establish the secure session To reduce the amount of ciphertext encrypted using the same key which an intruder can obtain –If a session key is broken, only info sent in that session is exposed To minimize the damage done if a process crashes and its core dump falls into the wrong hands. Hopefully, the only key present then will be the session key –All the permanent keys should have been carefully zeroed out after the session was established

9 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authentication Protocols Authentication Based on a Shared Secret Key Establishing a Shared Key: Diffie-Hellman Authentication Using a Key Distribution Center Authentication Using Public-Key Cryptography

10 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authentication Based on a Shared Secret Key Two-way authentication using a challenge- response protocol –Challenge-response: one party sends a random number to the other, who then transforms it in a special way and then returns the result –Nonces: random numbers used just once in challenge-response protocols –Assume that Alice and Bob already share a secret key, K AB

11 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authentication Based on a Shared Secret Key

12 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authentication Based on a Shared Secret Key A shortened two-way authentication protocol. Is this new protocol an improvement over the original one ? –It is shorter –But it is also wrong –Under certain circumstances, Trudy can defeat this protocol by using what is known as a reflection attack

13 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Reflection Attack The reflection attack: Trudy can break it if it is possible to open multiple sessions with Bob at once This attack can be defeated by encrypting R B with K AB in message 2

14 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao General Rules for Authentication Protocols Design Rule#1: Have the initiator prove who she is before the responder has to –In the previous case, Bob gives away valuable information before Trudy has to give any evidence of who she is Rule#2: Have the initiator and responder use different keys for proof, e.g., K AB and K' AB Rule#3: Have the initiator and responder draw their challenges from different sets –E.g., the initiator uses even numbers, the responder uses odd numbers Rule#4: Be aware of parallel sessions (no info flows across different sessions)

15 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange A protocol that leads to the establishment of a shared secrete key is called key agreement protocol or key exchange protocol Diffie-Hellman key exchange –Two large numbers, n and g, where n is a prime, (n - 1)/2 is also a prime and certain conditions apply to g

16 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange

17 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange Example: n = 47 and g = 3. Alice picks x = 8 and Bob picks y = 10. Both of these are kept secret –Alice's message to Bob is (47, 3, 28) because 3 8 mod 47 is 28. Bob's message to Alice is (17) –Alice computes 17 8 mod 47, which is 4 –Bob computes mod 47, which is 4 –Alice and Bob have independently determined that the secret key is now 4 –Trudy has to solve the equation 3 x mod 47 = 28

18 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Establishing a Shared Key: The Diffie-Hellman Key Exchange The man-in-the-middle attack –When Bob gets (47, 3, 28), how does he know it is from Alice and not from Trudy? There is no way he can know –Trudy can exploit this fact to deceive both Alice and Bob

19 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Man-In-The-Middle Attack A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised The attacker must be able to observe and intercept messages going between the two victims

20 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authentication Using a Key Distribution Center Each user has a single key shared with the KDC. Authentication and session key management now goes through the KDC The following protocol is subject to replay attack

21 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Needham-Schroeder Authentication Protocol Needham-Schroeder protocol: a multi-way challenge-response protocol –By having each party both generate a challenge and respond to one, the possibility of any kind of replay attack is eliminated

22 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Needham-Schroeder Authentication Protocol Message 1: R A is a nonce Message 2: –K B (A, K S ) is ticket Alice will send to Bob –R A : so that message 2 is not a replay –B: so that if Trudy replaces B with her id in message 1, it will be detected –Ticket is encrypted using Bob’s key K B so that Trudy cannot replace it with something else on the way back to Alice

23 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Needham-Schroeder Authentication Protocol Message 3: a new nonce R A2 is used Message 4: Bob sends back K S (R A2 -1) instead of K S (R A2 ) so that Trudy cannot steal K S (R A2 ) from message 3 and replay it here Message 5: to convince Bob he is talking to Alice and no replays are being used

24 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao Authentication Using Public-Key Cryptography

25 What can Trudy do to try to subvert this protocol? –She can fabricate message 3 and trick Bob into probing Alice, but Alice (from message 6) will see an R A that she did not send and will not proceed further –Trudy cannot forge message 7 back to Bob because she does not know R B or K S and cannot determine them without Alice's private key 6/26/2015 EEC688/788: Secure & Dependable ComputingWenbing Zhao