System Security: Cryptography Technologies CPE Operating Systems

What does the fish mean?

Ichthys

User name / Password

Threat Ex: Wifi Packet Sniffers

Protection with Cryptography

Encryption and Decryption Symmetric – Uses a shared key Asymmetric – Added security with Public and Private keys

Symmetric Encryption I LOVE YOU Simple example: Add a constant to the ASCII value J MPWF ZPV Key = 1

The Enigma Machine German Encryption Machine For WWI

Enigma was cracked by the Allies in WWII Some say this helped shortened WWII by two years

Some Examples Data Encryption Standard (DES)  56 bit key for every 64 bit value Advanced Encryption Standard (AES)  256 bit key for every 128 bit value RC4  As used in WEP (Wired Equivalent Privacy) WPA, WPA2 (Wi-Fi Protected Access)  256 bit key

Asymmetric Encryption

Algorithm Example Public Key = (kd, N) Private Key = (ke, N) N = p.q (where p, q are prime numbers) Pick kd that is < N Calculate ke where  ke.kd mod (p-1)(q-1) = 1

Example If p = 7 and q = 13 N = 7.13 = 91 Pick Kd = 5 Find Ke  Ke.5 mod (7-1)(13-1) = 1  Ke = 29 Public Key = (5, 91) Private Key = (29, 91)

Encrypting and Decrypting Encrypt message = (input ^ ke ) mod N Decrypt message = (input ^ kd) mod N If we want to send the number 69 Encrypted message = 69 ^ 5 mod 91 = 62 Decrypted message = 62 ^ 29 mod 91 = 69 *Note: number must < N

Notes In reality p and q can be 512 bits each

Case Study: SSL (Secure Socket Layer Protocol)

An Online Bank Example Browser SCB Server Request Secure Connection (HTTPS) Sends a Public Key Encrypt & Send Login/Password Is there a problem with this method? Yes. A fake web site can also send a public key

SSL Certificate Verification Browser SCB Server Request SSL Sends key + Certificate Verify

SSL Protocol Browser SCB Server Request SSL Sends key + Certificate Verify Encrypt + send user/password Ok. Now the client can send secure info to the server. But how can the bank send secure information to the client?

SSL Protocol Browser SCB Server Request SSL Sends key + Certificate Verify Sends client’s public key Do we need to verify the Server’s second response? Yes. But now it is easier. Data encrypted with client’s public key

SSL Protocol Browser SCB Server Request SSL Sends key + Certificate Verify Sends client’s public key If the client can de-crypt the data with the server’s public key It verifies that data is sent from the server. Data encrypted with client’s public key Encrypt with server’s private key

Browser SCB Server SSL Protocol Data encrypted with client’s public key Encrypt with server’s private key Double encryption is too much work. Can we optimize?

Browser with New (pub/pri) keys Server with New (pub/pri) keys SSL Protocol Send a new public key Encrypt with server’s private key Yes. The server can send a new set of keys for future use Secure Data Encrypt with the new public key Encrypt with the new private key Encrypt with the client’s public key

Summary Browser SCB Server Request SSL Sends key + Certificate Verify Sends client’s public key Send new pub key Secure Data

Encryption is a cat & mouse game Encryption is becoming more complex (64bits, 128bits, …, 512bits, …, ?) Relies on Mathematical Models. Can be cracked. Never fully trust that your data is safe with encryption