10. Key Management

Contents Key Management  Public-key distribution  Secret-key distribution via public-key cryptography

Key Management Public-key distribution  Public announcement  Public available directory  Public-key authority  Public-key certificates

Public Announcement Public announcement of public keys  Any participant can send his/her public key to any participants or broadcast to the community.

Weakness  Anyone can forge a public announcement  Some user could pretend to be user A and send a public key to another participant or broadcast such a public key. C Public Announcement

Public Available Directory Publicly available directory 1. A trusted authority maintains a directory with a {name, public key} entry for each participants. 2. Each participant registers a public key with the directory authority.

3. A participant may replace the existing key with a new some at any time. 4. Periodically, the authority publishes the entire directory or updates to the directory. Public Available Directory

5. Participants could also access the directory electrically. For this purpose, secure, authenticated communication from the authority to the participant is mandatory. Public Available Directory

 This scheme is more secure, but still has vulnerabilities.  If an opponent get the private key of the directory authority, the opponent could counterfeit public keys in the directory. Public Available Directory

Public-key Authority  Stronger security for public-key distribution can be achieved by providing tighter control over the distribution of public keys from the directory.

1. A sends a timestamped message to the public-key authority containing a request for the current public key of B. Public-key Authority

2. The authority responds with a message that is encrypted using the authority’s private key, KR auth. Public-key Authority

3. A stores B’s public key and also use it to encrypt a message to B containing an identifier of A(ID A ) and a nonce(N 1 ). Public-key Authority

4,5 B retrieves A’s public key from the authority in the same manner as A retrieved B’s public key. Public-key Authority

6. B sends a message to A encrypted with KU a and containing A’s nonce(N 1 ) as well as a new nonce generated by B(N 2 ). Public-key Authority

7. A returns N 2, encrypted using B’s public key, to assure B that is correspondent is A. Public-key Authority

Drawbacks  A total of seven messages are required.  However, the initial four messages need be used only infrequently because both A and B can save the other’s public key for future use.  Public-key authority could be a bottleneck in the system, because a user must access the authority for the public key for every other user that it wishes to contact.  As before, the directory is vulnerable to tampering. Public-key Authority

Public-key Certificates Public-key certificates  Certificates are used to exchange keys without contacting a public-key authority.  A certificate consists of a public key, an identifier of the key owner, and more information with the signature of the whole block signed by a trusted third party.

Public-key Certificates Certificate generation  Each user sends his/her public key to a certificate authority (CA) in a secure manner.  The CA generates a certificate for the user using his/her private key.

Public-key Certificates Public-key exchange  A and B sends their certificates to each other.  Each verify the certificate using the CA’s public key.

Secret-Key Distribution Secret-key distribution via public-key cryptography  Simple secret key distribution  Secret key distribution with confidentiality and authentication  A hybrid scheme

Simple Secret Key Distribution  If A wishes to communicate with B, 1. A generates a public/private key pair {KU a, KR a } and transmits a message to B consisting of KU a and an identifier of A, ID A. 2. B generates a secret key, K s, and transmits it to A, encrypted with A’s public key. 3. A computes D KRa [E KUa [K s ]] to recover the secret key. 4. A discards KU a and KR a and B discards KU a.

 A and B can now securely communicate using conventional encryption and the session key K s.  However, this protocol is vulnerable to an active attack.  Man-in-the-middle attack  An opponent E can compromise the communication without being detected. Simple Secret Key Distribution

Man-in-the-middle attack 1. A generates a public/private key pair {KU a, KR a } and transmits a message intended for B consisting of KU a and ID A. 2. E intercepts the message, creates its own public/private key pair {KU e, KR e } and transmits KU e ||ID A to B. AEB (1) KU a ||ID A (2) KU e ||ID A (3) E KUe [K s ](4) E KUa [K s ] Simple Secret Key Distribution

Man-in-the-middle attack 4. B generates a secret key K s, and transmits E KUe [K s ]. 5. E intercepts the message and learns K s by computing D KRe [E KUe [K s ]]. 6. E transmits E KUa [K s ] to A. Simple Secret Key Distribution AEB (1) KU a ||ID A (2) KU e ||ID A (3) E KUe [K s ](4) E KUa [K s ]

Man-in-the-middle attack  Both A and B know K s and are unaware that E knows K s.  Knowing K s, E can decrypt all encrypted messages between A and B. Simple Secret Key Distribution

Secret Key distribution with Confidentiality and Authentication Secret Key Distribution with Confidentiality and Authentication  Assume that A and B have exchanged public key

1. A uses B’s public key to encrypt a message to B obtaining an identifier of A (ID A ) and a nonce (N 1 ), used to identify this transaction uniquely. 2. B sends a message to A encrypted with KU a and obtaining A’s nonce(N 1 ) as well as a now nonce generated by B(N 2 ). Secret Key distribution with Confidentiality and Authentication

3. A returns N 2, encrypted using B’s public key, to assure B that its correspondent is A. 4. A selects a secret key K s and sends M = E KUb [E KRa [K s ]] to B. Encryption of this message with B’s public key ensures that only B can read it; Encryption with A’s private key ensures that only A could have sent it. 5. B computes D KUa [D KRb [M]] to recover the secret key. Secret Key distribution with Confidentiality and Authentication

 This approach provides protection against both active and passive attacks.  Note that the first 3 step of this scheme are the same as that last 3 steps of Public-key authority scheme.  This scheme ensures both confidentiality and authentication in the exchange of a secret key. Secret Key distribution with Confidentiality and Authentication

Hybrid Scheme A Hybrid Scheme  The use of a key distribution center (KDC) that shares a secret master key with each user and distributes secret session keys encrypted with the master key.  A public key scheme is used to distribute the master keys.

 Performance  Distribution of session key by public-key encryption could degrade overall system performance.  With a 3-level hierarchy, public-key encryption is used only occasionally to update the master key between a user and the KDC.  Backward Compatibility  The hybrid scheme is easily overlaid on an existing KDC scheme, with minimal disruption or software changes. Hybrid Scheme