Network Security7-1 CIS3360: Chapter 8: Cryptography Application of Public Cryptography Cliff Zou Spring 2012 TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AA A AAAA A

Network Security7-2 Acknowledgement r Some slides are modified from the slides provided by textbook:  Computer Networking: A Top Down Approach Featuring the Internet, J. Kurose & K. Ross, Addison Wesley, 4 rd ed., 2007

Network Security7-3 Digital Signatures Cryptographic technique analogous to hand- written signatures. r sender (Bob) digitally signs document, establishing he is document owner/creator. r verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document

Network Security7-4 Digital Signatures Simple digital signature for message m: r Bob signs m by encrypting with his private key K B, creating “signed” message, K B (m) - - Dear Alice Oh, how I have missed you. I think of you all the time! …(blah blah blah) Bob Bob’s message, P Public key encryption algorithm Bob’s private key K B - Bob’s message, P, signed (encrypted) with his private key

Network Security7-5 Digital Signatures (more) r Suppose Alice receives: m msg P’, and its digital signature r Alice verifies P’ signed by Bob by applying Bob’s public key to m checks if Alice thus verifies that: ü Bob signed P. ü No one else signed P. ü Bob signed P and not a different P’. Non-repudiation: Alice can take P, and its signature to court and prove that Bob signed P.

Network Security7-6 Message Digests Computationally expensive to public-key-encrypt long messages Goal: fixed-length, easy- to-compute digital “fingerprint” r apply hash function H to m, get fixed size message digest, H(m). Hash function properties: r many-to-1 r produces fixed-size msg digest (fingerprint) r given message digest x, computationally infeasible to find m such that x = H(m) large message P H: Hash Function H(m)

Network Security7-7 Hash Function Algorithms r MD5 hash function widely used (RFC 1321) m computes 128-bit message digest in 4-step process. m arbitrary 128-bit string x, appears difficult to construct msg m whose MD5 hash is equal to x. r SHA-1 is also used. m US standard [ NIST, FIPS PUB 180-1] m 160-bit message digest

Network Security7-8 large message m H: Hash function H(m) digital signature (encrypt) Bob’s private key K B - + Bob sends digitally signed message: Alice verifies signature and integrity of digitally signed message: encrypted msg digest encrypted msg digest large message m H: Hash function H(m) digital signature (decrypt) H(m) Bob’s public key K B + equal ? Digital signature = signed message digest No confidentiality !

Network Security7-9 Trusted Intermediaries Public key problem: r When Alice obtains Bob’s public key (from web site, , diskette), how does she know it is Bob’s public key, not Trudy’s? Solution: r trusted certification authority (CA)

Network Security7-10 Certification Authorities r Certification authority (CA): binds public key to particular entity, E. r E (person, router) registers its public key with CA. m E provides “proof of identity” to CA. m CA creates certificate binding E to its public key. m certificate containing E’s public key digitally signed by CA – CA says “this is E’s public key” Bob’s public key K B + Bob’s identifying information digital signature (encrypt) CA private key K CA - K B + certificate for Bob’s public key, signed by CA

Network Security7-11 Certification Authorities r When Alice wants Bob’s public key: m gets Bob’s certificate (Bob or elsewhere). m apply CA’s public key to Bob’s certificate, get Bob’s public key Bob’s public key K B + digital signature (decrypt) CA public key K CA + K B +

Network Security7-12 A certificate contains: r Serial number (unique to issuer) r info about certificate owner, including algorithm and key value itself (not shown) r info about certificate issuer r valid dates r digital signature by issuer

Network Security7-13 Internet Web Security Architecture Client A CA Web Server B E K + B (K AB, R) E K AB (R) E K AB (m) Cert Request K+BK+B

Network Security7-14 Internet Web Security Conditions r Clients’ web browsers have built-in CAs. r CAs are trustable r Web servers have certificates in CAs. r Q: What if a server has no certificate? m Example: SSH servers

Network Security7-15 SSH Example r Initial setup: m Trust the first-time connection m Save the server’s public key r Still vulnerable due to the update of server’s key Client A Web Server B E K AB (R) E K AB (m) E K + B (K AB, R)

Network Security7-16 Secure Message Alice:  generates random symmetric private key, K S.  encrypts message with K S (for efficiency)  also encrypts K S with Bob’s public key.  sends both K S (m) and to Bob.  Assumption: Public keys are pre-distributed securely  E.g: through CA, or pre-established like SSH  Alice wants to send confidential message, m, to Bob. K S ( ). K B ( ). + + K S (m ) m KSKS KBKB + Internet KSKS

Network Security7-17 Secure Message Bob:  uses his private key to decrypt and recover K S  uses K S to decrypt E K S (m) to recover m  Alice wants to send confidential message, m, to Bob. E() + - E K S (m ) m KSKS KSKS KBKB + Internet D() KBKB - KSKS m E K S (m )

Network Security7-18 Secure Message (continued) Alice wants to provide sender authentication message integrity. Alice digitally signs message. sends both message (in the clear) and digital signature. H( ). K A ( ) H(m ) m KAKA - Internet m K A ( ). + KAKA + m H( ). H(m ) compare

Network Security7-19 Secure Message (continued) Alice wants to provide secrecy, sender authentication, message integrity. Alice uses three keys: her private key, Bob’s public key, newly created symmetric session key H( ). K A ( ). - + m KAKA - m K S ( ). K B ( ). + + KSKS KBKB + Internet KSKS