Lecture 5.2: Key Distribution: Private Key Setting CS 436/636/736 Spring 2012 Nitesh Saxena

Course Administration HW2 due – Tuesday, 11am – Feb 28 HW1 to be distributed – Please remind if I forget 11/20/ Lecture 5.2: Private Key Distribution

Course Admin Mid-Term Exam – On March 08 (Thursday) – In class, from 11am-12:15pm Covers lectures up to Feb 23 (this week) In-class review on Mar 06 (Tuesday) Strictly closed-book (no cheat-sheets are allowed) A sample exam will be provided as we near the exam date 11/20/ Lecture 5.2: Private Key Distribution

Course Admin Next Lecture will be short – I have to attend our big Security Center event /?instance_id=21 Entertain the guests at the luncheon – We will stop at 11:40am 11/20/2015 Lecture 5.2: Private Key Distribution 4

Outline of Today’s lecture Key Distribution Introduction Protocol for private key distribution Kerberos: Real-world system 11/20/ Lecture 5.2: Private Key Distribution

Some questions from last time Can OTP make for a good MAC? Can H(K||m) make for a good MAC? Does HMAC provide non-repudiation? 11/20/ Lecture 5.2: Private Key Distribution

Key Distribution Cryptographic primitives seen so far assume – In private key setting: Alice and Bob share a secret key which is unknown to Oscar. – In public key setting: Alice has a “trusted” (or authenticated) copy of Bob’s public key. But how does this happen in the first place? Alice and Bob meet and exchange key(s) Not always practical or possible. We need key distribution, first and foremost! Idea: make use of a trusted third party (TTP) 11/20/ Lecture 5.2: Private Key Distribution

“Private Key” Distribution: an attempt Protocol assumes that Alice and Bob share a session key K A and K B with a Key Distribution Center (KDC). – Alice calls Trent (Trusted KDC) and requests a session key to communicate with Bob. – Trent generates random session key K and sends E K A (K) to Alice and E K B (K) to Bob. – Alice and Bob decrypt with K A and K B respectively to get K. This is a key distribution protocol. Susceptible to replay attack! 8

Session Key Exchange with KDC – Needham- Schroeder Protocol A -> KDC ID A || ID B || N 1 (Hello, I am Alice, I want to talk to Bob, I need a session Key and here is a random nonce identifying this request) KDC -> A E K A ( K || ID B || N 1 || E K B (K || ID A )) Encrypted(Here is a key, for you to talk to Bob as per your request N 1 and also an envelope to Bob containing the same key) A -> B E K B (K || ID A ) (I would like to talk using key in envelope sent by KDC) B -> A E K (N 2 ) (OK Alice, But can you prove to me that you are indeed Alice and know the key?) A -> B E K (f(N 2 )) (Sure I can!) Dennig-Sacco (replay) attack on the protocol 11/20/ Lecture 5.2: Private Key Distribution

Session Key Exchange with KDC – Needham- Schroeder Protocol (corrected version with mutual authentication) A -> KDC: ID A || ID B || N 1 (Hello, I am Alice, I want to talk to Bob, I need a session Key and here is a random nonce identifying this request) KDC -> A: E K A ( K || ID B || N 1 || E K B (TS1, K || ID A )) Encrypted(Here is a key, for you to talk to Bob as per your request N 1 and also an envelope to Bob containing the same key) A -> B: E K (TS2), E K B (TS1, K || ID A ) (I would like to talk using key in envelope sent by KDC; here is an authenticator) B -> A: E K (TS2+1) (OK Alice, here is a proof that I am really Bob) 11/20/ Lecture 5.2: Private Key Distribution

Kerberos - Goals Security – Next slide. Reliability Transparency – Minimum modification to existing network applications. Scalability – Modular distributed architecture. 11/20/ Lecture 5.2: Private Key Distribution

Kerberos – Security Goals No cleartext passwords over network. No cleartext passwords stored on servers. Minimum exposure of client and server keys. Compromise of a session should only affect that session Require password only at login. 11/20/ Lecture 5.2: Private Key Distribution

Kerberos - Assumptions Global clock. There is a way to distribute authorization data. – Kerberos provides authentication and not authorization. 11/20/ Lecture 5.2: Private Key Distribution

Kerberos Key Distribution (1) JoeKDC I would like to Talk to the File Server KDC Step 1 Joe to KDC Step 2 KDC Session key for User Session key for service 11/20/ Lecture 5.2: Private Key Distribution

Kerberos Key Distribution (2) Step 3 KDC Session Key for Joe Dear Joe, This key for File server Box 1 Locked With Joe’s key Session Key for File server Dear File server, This key for Use with Joe Box 2 Locked With File Server’s key JoeKDC Step 4 KDC to Joe Box 1Box 2 11/20/ Lecture 5.2: Private Key Distribution

Kerberos Key Distribution (3) Dear Joe, This key for File server Opened Box 1 Session Key for File server Dear File server, This key for Use with Joe Box 2 Locked With File Server’s key Step 5 Joe Step 6 Joe Session Key for File server Dear File server, This key for Use with Joe Box 2 Locked With File Server’s key Dear File server, The time is 3:40 pm Box 3 Locked With Session key 11/20/ Lecture 5.2: Private Key Distribution

Kerberos Key Distribution (4) Joe File Server Step 7 Joe to File server Box 2Box 3 Step 8 File server Dear File server, This key for Use with Joe Unlocked Box 2 Dear File server, The time is 3:40 pm Unlocked Box 3 11/20/ Lecture 5.2: Private Key Distribution

Kerberos Key Distribution (5) For mutual authentication, file server can create box 4 with time stamp and encrypt with session key and send to Joe. Box 2 is called ticket. KDC issues ticket only after authenticating password To avoid entering passwords every time access needed, KDC split into two – authenticating server and ticket granting server. 11/20/ Lecture 5.2: Private Key Distribution

Kerberos– One Slide Overview 11/20/

Version 4 Summary 11/20/ Lecture 5.2: Private Key Distribution

Kerberos - Limitations Every network service must be individually modified for use with Kerberos. Requires a global clock Requires secure Kerberos server. Requires continuously available or online server. 11/20/ Lecture 5.2: Private Key Distribution

Further Reading Stallings Chapter 15 HAC Chapter 12 11/20/ Lecture 5.2: Private Key Distribution

Some questions Can a KDC learn communication between Alice and Bob, to whom it issued keys? What if the KDC server is down or congested? What if the KDC server is compromised? 11/20/ Lecture 5.2: Private Key Distribution