ZFONE  Philip Zimmermann’s new secure VOIP application  Interoperates with SIP signaling  Communication with AES by SRTP  Successor of PGPfone  Does.

Slides:

Advertisements

Similar presentations

Chapter 10 Real world security protocols

Advertisements

Off-the-Record Communication, or, Why Not To Use PGP

ECE454/CS594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2011.

Last Class: The Problem BobAlice Eve Private Message Eavesdropping.

Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York.

CS470, A.SelcukSSL/TLS & SET1 CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk.

1 Security Handshake Pitfalls. 2 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: –Authenticate.

IPSec: Authentication Header, Encapsulating Security Payload Protocols CSCI 5931 Web Security Edward Murphy.

Security at the Network Layer: IPSec

Impacts of Security Protocols on Real- time Multimedia Communications Kihun Hong 1, Souhwan Jung 1, Luigi Lo Iacono 2, Christoph.

Chapter 5 Network Security Protocols in Practice Part I

Chapter 13 IPsec. IPsec (IP Security)  A collection of protocols used to create VPNs  A network layer security protocol providing cryptographic security.

Henric Johnson1 Ola Flygt Växjö University, Sweden IP Security.

CS470, A.SelcukReal-Time Communication Issues1 Real-Time Communication Security IPsec & SSL Issues CS 470 Introduction to Applied Cryptography Instructor:

Public Key Algorithms …….. RAIT M. Chatterjee.

WEB SECURITY. WEB ATTACK TYPES Buffer OverflowsXML InjectionsSession Hijacking Attacks WEB Attack Types.

Symmetric Key Distribution Protocol with Hybrid Crypto Systems Tony Nguyen.

Chap 3: Key exchange protocols In most systems, we distinguish the short term keys from the long term ones: –A short term key (session key) is used to.

CMSC 414 Computer and Network Security Lecture 22 Jonathan Katz.

CMSC 414 Computer and Network Security Lecture 18 Jonathan Katz.

Just Fast Keying (JFK) Protocol 18739A: Foundations of Security and Privacy Anupam Datta CMU Fall

CMSC 414 Computer and Network Security Lecture 17 Jonathan Katz.

W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T IKE Tutorial.

Internet Security CSCE 813 IPsec. CSCE Farkas2 Reading Today: – Oppliger: IPSec: Chapter 14 – Stalllings: Network Security Essentials, 3 rd edition,

K. Salah1 Security Protocols in the Internet IPSec.

CMSC 414 Computer (and Network) Security Lecture 25 Jonathan Katz.

Cryptography and Network Security Chapter 10. Chapter 10 – Key Management; Other Public Key Cryptosystems No Singhalese, whether man or woman, would venture.

Network Security. Contents Security Requirements and Attacks Confidentiality with Conventional Encryption Message Authentication and Hash Functions Public-Key.

Alexander Potapov.  Authentication definition  Protocol architectures  Cryptographic properties  Freshness  Types of attack on protocols  Two-way.

Sorting Out Digital Certificates Bill blog.codingoutloud.com ··· Boston Azure ··· 13·Dec·2012 ···

Pretty Good Privacy by Philip Zimmerman presented by: Chris Ward.

IPsec: IKE, Internet Key Exchange IPsec does not use Public Key Infrastructure and exchanging keys before an IPsec connection is established is a problem.

32.1 Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction.

SSL / TLS in ITDS Arun Vishwanathan 23 rd Dec 2003.

1 Lecture 14: Real-Time Communication Security real-time communication – two parties interact in real time (as opposed to delayed communication like )

ECE 454/CS 594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall.

Secure phone for Vigor2820Vn-ZRTP DrayTek Corp 2010.

1 Section 10.9 Internet Security Association and Key Management Protocol ISAKMP.

1 Firewalls. 2 What is a firewall? Device that provides secure connectivity between networks (internal/external; varying levels of trust) Used to implement.

Lecture 14 ISAKMP / IKE Internet Security Association and Key Management Protocol / Internet Key Exchange CIS CIS 5357 Network Security.

ECE 454/CS 594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall.

Information management 1 Groep T Leuven – Information department 1/26 IPSec IP Security (IPSec)

1 Cryptography NOTES. 2 Secret Key Cryptography Single key used to encrypt and decrypt. Key must be known by both parties. Assuming we live in a hostile.

Network Security David Lazăr.

IPsec IPsec (IP security) Security for transmission over IP networks –The Internet –Internal corporate IP networks –IP packets sent over public switched.

Encryption Questions answered in this lecture: How does encryption provide privacy? How does encryption provide authentication? What is public key encryption?

ZRTP: Media Path Key Agreement for Unicast Secure RTP April 2011, RFC 6189 Author(s): P. Zimmermann, A. Johnston, J. Callas Speaker :Ted 1.

1 Lecture 9: Cryptographic Authentication objectives and classification one-way –secret key –public key mutual –secret key –public key establishing session.

Lecture 16: Security CDK4: Chapter 7 CDK5: Chapter 11 TvS: Chapter 9.

SSL (TLS) Part 2 Generating the Premaster and Master Secrets + Encryption.

Cryptography 1 Crypto Cryptography 2 Crypto  Cryptology  The art and science of making and breaking “secret codes”  Cryptography  making “secret.

1 Chapter 10: Key Management in Public key cryptosystems Fourth Edition by William Stallings Lecture slides by Lawrie Brown (Modified by Prof. M. Singhal,

The School of Electrical Engineering and Computer Science (EECS) CS/ECE Network Security Dr. Attila Altay Yavuz Authentication Protocols (I): Secure Handshake.

IPSec and TLS Lesson Introduction ●IPSec and the Internet key exchange protocol ●Transport layer security protocol.

Lecture 5.1: Message Authentication Codes, and Key Distribution

Presentation Road Map 1 Authenticated Encryption 2 Message Authentication Code (MAC) 3 Authencryption and its Application Objective Modes of Operation.

Key Management Network Systems Security Mort Anvari.

1 Authenticated Key Exchange Rocky K. C. Chang 20 March 2007.

1 Secure Key Exchange: Diffie-Hellman Exchange Dr. Rocky K. C. Chang 19 February, 2002.

K. Salah1 Security Protocols in the Internet IPSec.

Lesson Introduction ●Authentication protocols ●Key exchange protocols ●Kerberos Security Protocols.

@Yuan Xue CS 285 Network Security Key Distribution and Management Yuan Xue Fall 2012.

@Yuan Xue CS 285 Network Security Secure Socket Layer Yuan Xue Fall 2013.

Cryptography CSS 329 Lecture 13:SSL.

Whatsapp Security Ahmad Hijazi Systèmes de Télécommunications & Réseaux Informatiques (STRI) 20 April 2016.

Database Management Systems, 3ed, R. Ramakrishnan and J. Gehrke1 Database architecture and security Workshop 4.

- Richard Bhuleskar “At the end of the day, the goals are simple: safety and security” – Jodi Rell.

Key management issues in PGP

Assignment #4 – Solutions

Presentation transcript:

ZFONE  Philip Zimmermann’s new secure VOIP application  Interoperates with SIP signaling  Communication with AES by SRTP  Successor of PGPfone  Does not rely on a PKI  Authentication by ZRTP

ZRTP AliceBob Hello(A’s Zid, Hash, Enc, SAS….) Commit(B’s Zid, HVI, ….) DH1(pvr, Hash(secret), ….) DH2(pvi, Hash(secret), ….) SRTP with AES begins SAS(spoken Hash(Master Key))

SRTP Secure Real Time Transport Protocol  Goals Confidentiality Message Authentication/Integrity Replay Protection  Key Refresh / Master Key Expiration  Entire Packet is MACed  Payload is encrypted

ZFONE  Secrecy between 2 parties  Forward Secrecy  Authentication (untraditional) No PKI  Replay protection  Parties can distinguish voices

ZFONE Acknowledged Protocol Properties  Resourceful adversary can pose as anyone  Adversary can force a re-SAS  Privacy ZID’s are public  DOS

Hash Commitment  Hash collision attack on authentication  Small SAS read aloud  Attacker needs only to find collision on first 4 bytes of hash(master key)  Attacker cannot deterministically influence hash(Master Key)

Shared Secrets  Parties perform SAS once Cache shared secret s1  Master Secret – s0 Based on DH exchange and shared secret Becomes s1 (s1 -> s2, etc…)  Initiator sends HMAC(s1, “Initiator”)  Responder sends HMAC(s1, “Responder”)

ZRTP Modeled Really Really Ridiculously Good Looking AliceBob Hello(A’s Zid) Confirm(B’s Zid) DH1(pvr, hash) DH2(pvi, hash) SRTP with AES begins SAS(voice, SecretKey, sas) Conv(voice, SecretKey, text)

Attack Tensor  Attacker can simulate Initiator's voice  Attacker can simulate Responder's voice  Attacker can convert voice to his own in real time  Initiator knows Responder's voice in advance  Responder knows Initiator's voice in advance  Initiator remembers voice from one session to the next  Responder remembers voice from one session to the next

Results of Murphi Modeling  61 parameter assignments yielded attacks  After reduction, 5 independent attacks found! SAS Voice Forgery Attack Bill Clinton Attack 6 Month Attack Court Reporter Attack Hybrid Clinton-Court Reporter Attack

Alice MitM + 3 Bob Convert to attacker voice Court Reporter Attack Hello Confirm DH1(A) DH1(Ma) DH2(B) DH2(Mb) SAS(A, Mb) SAS(Mb, A) SAS(Ma, B) SAS(B, Ma) Confirm

Six Month Attack A and B don’t remember voices between sessions AliceBob Poses as B MitM Poses as A A and B have Shared Secret A and B have Shared Secret Attacker records and relays voice False shared secret causes SAS to be skipped

Bill Clinton Attack MitM can imitate the president’s voice Bill doesn’t know Alice’s voice Alice Bill (Clinton) MitM Intruder poses as Alice M and B have Shared Secret MitM imitates Bill Clinton’s voice for SAS Attacker records and relays voice Bill forgets voice of “A”

Solution: The Chrono-Gambit  Interpolate Hash(Master Key) between 0 and N seconds N is negotiated in Hello and HashCommit  Conversation must start ~N seconds from first message exchange  Probabilistically foils every attack Idea: Hard to interleave conversations starting at different times!

Conclusion  In normal use cases, ZFone is secure  In abnormal, but reasonable cases, ZFone can be attacked To mount attacks, adversary needs to be powerful and resourceful  Questions?