SSL with New Client Authentication Takuya Yahagi, S University of Aizu Performance Evaluation Lab.

Purpose To evaluate performance of SSL with client authentication with waiting time and probability of finding malicious user point of view.

Spoofing Uses other ’ s or non-existent mail address to send phishing mail, spam and some kind of virus mail. Sender ID (1) Problem  If IP address is also forged, Sender ID can ’ t prevent spoofing. SenderReceiverDNS Domain(2) IP address(3)

SSL Client hello(1) Random value Used to create common key Cryptography algorithms list Server hello(2) Random value Used to create common key Selected algorithm Server certificate(2) Public key Server hello done(2) Client key exchange(3) Premaster secret Used to create common key Change cipher spec(3),(4) Signal of encryption Finished(3),(4)  Problem There is no client authentication. Client hello (1) Client certificate Server hello Server certificate(2) Server hello done Client key exchange Change cipher spec Finished (3) Change cipher spec Finished (4) ServerClient

Feige-Fiat-Shammir Identification Protocol Prove identity via demonstration of knowledge of secret without revealing even a single bit of secret. Malicious person, Mallory has 50% chance of passing this trial without secret number by guessing that Bob will send c = 0 or 1. AliceBob w c r

Waiting time of SSL and SSL with authentication Waiting time of SSL Waiting time of SSL with authentication S1S2S3 C1C2 S4S5 C3C4C5 W2 W1W3W4 W5 C: Client W: Waiting time of SSL S: Service time of SSL S1S3 A1A2M1A3A4 W2 W1W3W4 W5 A: Alice M: Mallory W: Waiting time of SSL with authentication S: Service time of SSL with authentication S2S4S5

Waiting Time of SSL Expectation of number of SSL clients:

Waiting Time of SSL with Authentication(1) Expectation value and variance of Mallory ’ s number of trials: Expectation value and variance of Alice ’ s number of trials: Expectation value and variance of Mallory ’ s and Alice ’ s service time of SSL with authentication:

Waiting Time of SSL with Authentication(2) Expectation of number of SSL with authentication clients: Expectation value of waiting time of SSL with authentication:

Waiting Time l Waiting time n = 20 n = 15 n = 5 No auth

Probability of Miss n p(n) Probability of missing Mallory in n trials:

Conclusion and Future Works Using the feature of this authentication, client can prove identity more securely. This method is solution to IP address spoofing. However, service time of authentication and probability of Mallory is not accurate value.