Dan Boneh Authenticated Encryption Case study: TLS Online Cryptography Course Dan Boneh.

Slides:

Advertisements

Similar presentations

ECE454/CS594 Computer and Network Security

Advertisements

Kriptográfia - a legerősebb láncszem a kiberbiztonság gyakorlatában? Boldizsár Bencsáth PhD Laboratory of Cryptography and System Security (CrySyS) Budapest.

“Advanced Encryption Standard” & “Modes of Operation”

Online Cryptography Course Dan Boneh

CS470, A.SelcukStream Ciphers1 CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk.

Transport Layer Security (TLS) Protocol Introduction to networks and communications(CS555) Prof : Dr Kurt maly Student:Abhinav y.

Authenticated Encryption and Cryptographic Network Protocols David Brumley Carnegie Mellon University.

Dan Boneh Authenticated Encryption Active attacks on CPA-secure encryption Online Cryptography Course Dan Boneh.

Wired Equivalent Privacy (WEP)

Modes of Operation CS 795. Electronic Code Book (ECB) Each block of the message is encrypted with the same secret key Problems: If two identical blocks.

IEEE Wireless Local Area Networks (WLAN’s).

CS470, A.SelcukModes of Operation1 Encrypting with Block Ciphers CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk.

Dan Boneh Public Key Encryption from trapdoor permutations RSA in practice Online Cryptography Course Dan Boneh.

Active attacks on CPA-secure encryption

Dan Boneh Authenticated Encryption Definitions Online Cryptography Course Dan Boneh.

Dan Boneh Authenticated Encryption Chosen ciphertext attacks Online Cryptography Course Dan Boneh.

Dan Boneh Public Key Encryption from trapdoor permutations Public key encryption: definitions and security Online Cryptography Course Dan Boneh.

Dan Boneh Stream ciphers The One Time Pad Online Cryptography Course Dan Boneh.

Wireless security & privacy Authors: M. Borsc and H. Shinde Source: IEEE International Conference on Personal Wireless Communications 2005 (ICPWC 2005),

Lecture 4: Using Block Ciphers

CS555Spring 2012/Topic 111 Cryptography CS 555 Topic 11: Encryption Modes and CCA Security.

Dan Boneh Using block ciphers Modes of operation: many time key (CTR) Online Cryptography Course Dan Boneh Example applications: 1. File systems: Same.

WEP Protocol Weaknesses and Vulnerabilities

Attacks on OTP and stream ciphers

Dan Boneh Public Key Encryption from trapdoor permutations PKCS 1 Online Cryptography Course Dan Boneh.

Applied Cryptography Spring 2015 Chaining Modes. What happens when the clear text is longer than the block length k? Most simple solution — encrypt each.

CMSC 414 Computer and Network Security Lecture 5 Jonathan Katz.

Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP.

3DES and Block Cipher Modes of Operation CSE 651: Introduction to Network Security.

Chapter 9: Algorithms Types and Modes Dulal C. Kar Based on Schneier.

1.1 Chapter 8 Encipherment Using Modern Symmetric-Key Ciphers Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

Shambhu Upadhyaya Security – AES-CCMP Shambhu Upadhyaya Wireless Network Security CSE 566 (Lecture 13)

Dan Boneh Using block ciphers Modes of operation: many time key (CBC) Online Cryptography Course Dan Boneh Example applications: 1. File systems: Same.

Modes of Usage Dan Fleck CS 469: Security Engineering These slides are modified with permission from Bill Young (Univ of Texas) 11 Coming up: Modes of.

Modes of Operation INSTRUCTOR: DANIA ALOMAR. Modes of Operation A block cipher can be used in various methods for data encryption and decryption; these.

1 Symmetric-Key Encryption CSE 5351: Introduction to Cryptography Reading assignment: Chapter 3 Read sections first (skipping 3.2.2)

Class 3 Cryptography Refresher II CIS 755: Advanced Computer Security Spring 2014 Eugene Vasserman

Wireless Security Rick Anderson Pat Demko. Wireless Medium Open medium Broadcast in every direction Anyone within range can listen in No Privacy Weak.

Template vertLeftWhite2 Authenticated Encryption Attacking non-atomic decryption Online Cryptography Course Dan Boneh.

1 Symmetric-Key Encryption CSE 5351: Introduction to Cryptography Reading assignment: Chapter 2 Chapter 3 (sections ) You may skip proofs, but are.

Various Attacks on Cryptosystems slides (c) 2012 by Richard Newman.

Dan Boneh Basic key exchange Trusted 3 rd parties Online Cryptography Course Dan Boneh.

Dan Boneh Introduction Course Overview Online Cryptography Course Dan Boneh.

802.11b Security CSEP 590 TU Osama Mazahir. Introduction Packets are sent out into the air for anyone to receive Eavesdropping is a much larger concern.

Dan Boneh Collision resistance The Merkle-Damgard Paradigm Online Cryptography Course Dan Boneh.

Dan Boneh Odds and ends Deterministic Encryption Online Cryptography Course Dan Boneh.

Giuseppe Bianchi Warm-up example WEP. Giuseppe Bianchi WEP lessons  Good cipher is far from being enough  You must make good USAGE of cipher.

Dan Boneh Authenticated Encryption CBC paddings attacks Online Cryptography Course Dan Boneh.

Part 1  Cryptography 1 Integrity Part 1  Cryptography 2 Data Integrity  Integrity  detect unauthorized writing (i.e., modification of data)  Example:

Dan Boneh Authenticated Encryption Constructions from ciphers and MACs Online Cryptography Course Dan Boneh.

Visit for more Learning Resources

Authenticated encryption

CSE 4095 TLS Attacks.

Cryptography Lecture 9.

Topic 11: Authenticated Encryption + CCA-Security

Cryptography Lecture 12.

Cryptography Lecture 10.

Block cipher and modes of encryptions

Cryptography Lecture 11.

Symmetric-Key Encryption

Block Ciphers (Crypto 2)

Cryptography Lecture 11.

Cryptography Lecture 9.

Cryptography Lecture 12.

Padding Oracle Attacks

Cryptography Lecture 11.

Cryptography Lecture 10.

Cryptography Lecture 25.

Counter With Cipher Block Chaining-MAC

Secret-Key Encryption

Presentation transcript:

Dan Boneh Authenticated Encryption Case study: TLS Online Cryptography Course Dan Boneh

Dan Boneh The TLS Record Protocol (TLS 1.2) Unidirectional keys: k bs and k sb Stateful encryption: Each side maintains two 64-bit counters: ctr bs, ctr sb Init. to 0 when session started. ctr++ for every record. Purpose: replay defense k bs, k sb TLS record HDR

Dan Boneh TLS record: encryption (CBC AES-128, HMAC-SHA1) k bs = (k mac, k enc ) Browser side enc(k bs, data, ctr bs ) : step 1: tag S ( k mac, [ ++ctr bs ll header ll data ] ) step 2: pad [ header ll data ll tag ] to AES block size step 3: CBC encrypt with k enc and new random IV step 4: prepend header data type ll ver ll len tag pad

Dan Boneh TLS record: decryption (CBC AES-128, HMAC-SHA1) Server side dec(k bs, record, ctr bs ) : step 1: CBC decrypt record using k enc step 2: check pad format: send bad_record_mac if invalid step 3: check tag on [ ++ctr bs ll header ll data ] send bad_record_mac if invalid Provides authenticated encryption (provided no other info. is leaked during decryption)

Dan Boneh Bugs in older versions (prior to TLS 1.1) IV for CBC is predictable: (chained IV) IV for next record is last ciphertext block of current record. Not CPA secure. (a practical exploit: BEAST attack) Padding oracle: during decryption if pad is invalid send decryption failed alert if mac is invalid send bad_record_mac alert ⇒ attacker learns info. about plaintext (attack in next segment) Lesson: when decryption fails, do not explain why

Dan Boneh b WEP: how not to do it b WEP: Previously discussed problems: two time pad and related PRG seeds k k m m CRC(m) PRG( IV ll k ) ciphetext IV

Dan Boneh Active attacks Fact: CRC is linear, i.e. ∀ m,p: CRC( m p) = CRC(m) F(p) dest-port = 80 data CRC IV WEP ciphertext: attacker: 000…….00….. XX …0000… F(XX) IV dest-port = 25 data CRC’ XX = 2580 Upon decryption: CRC is valid, but ciphertext is changed !!

Dan Boneh End of Segment