Chapter 2 Protocols Controlling communications of principals in systems

Security Protocols This is the broader meaning of “protocols” Not just computer protocols The protocols control the communications of the various principles in a system. Security protocols fail.

Eavesdropping Risk Passwords remain the foundation of which computer security rests Key fob and garage doors use 16 bit serial number as key Random guess serial number Use a grabber to get another's code Using a simple password such as serial number is seldom adequate except for systems that require minimum security

Simple Authentication T  G: T,{T,N} kt T  G name (T) sent to garage Form is the Name (T) concatenated with {T, N) encrypted with kt {T, N where N is nonce) Nonce guarantees freshness Assures it is not a play-back Nonce can be very poorly done Challenge and response two-pass protocol

Manipulating Message Can also set your self up in the middle and manipulate the message These are just adjustments to replay attacks

Changing Environment Can make previously secure products fail. ATMs originally designed under these premise: Cards not secure PINS are Machines installed in secure locations (banks) Moving of ATMs to many locations violated one of the original design premise opening up a series of new attacks

Managing Encryption Keys A variant of Kerberos is widely used in W2K variants. Basic Key Management use a trusted third party Needham-Schroeder Protocol Kerberos is derivative of Needham- Schroeder, developed at MIT

Formal Proofs There has been work done to formally prove the security of various protocols. Ban Logic pg 29 These formal methods require designers to look more closely at the design. But do not assure security, based on external assumptions The “boundaries” between technologies are often where vulnerabilities arise.

Discussion topics Find current example of man in middle attack Find article on using source routing to establish man in middle attack Current uses of Kerberos

List of resources Security protocols Garage door openers Nice article comparing garage opener and automotive security protections:

List of resources Challenge-response Kerberos otocol%29 otocol%29 Needham-Schroeder Schroeder Schroeder