ECE-8813 / CS Prof. John A. Copeland fax Office: GCATT Bldg 579 or call for office visit, or call Kathy Cheek, Chapter 4a - Kerberos

Kerberos, v4 and v5 Provides a complete protocol for authentication and secure communications for hosts connected by a data communications network Provides secure "tickets" to hosts that can be used to initiate a secure message exchange Standard message formats for encrypted and signed messages, or signed plaintext messages Formats for encoding expiration time, names,... Allows "read-only" slave KDC's (distributed KDCs) 2

Keberos uses Mediated Authentication (with a Key Distribution Center, KDC ) Jack Jip KDC Mary Paul Peter Harry Dick Tom Alice Bob Trudi KDC has unique Secret Keys with all legitimate hosts. K bob K alice 3

Bob has Shared Secret Key with KDC, K bob Alice {time, K ab },{K ab,Alice; K bob } ="Ticket" {time + 1, Kab} After the 1st exchange with the KDC, Alice has a session key, Ka, and a "Ticket-Granting Ticket" that she can use to request "Tickets" from KDC PC erases Alice's password and Kak from disk and RAM. Time(stamp) is used as nonce (seconds after 1/1/1970) Alice PC hashes Alice's passwork to get a DES Key, K alice= K a that KDC knows Key Dist. Ctr gen.s Kab Alice (human) logs on to Alice, (PC) {Ka,{TGT;K k }; Kak} Alice wants Bob,TGT, {time;Ka} {Bob,Kab,Ticket -Bob; Ka} 4 Kab: Session key for Alice and Bob (Alice gives to Bob)

5

Master KDC Slave KDC {db;Kmaster} Slave KDC Slave KDC Slave KDC Slave KDC Host Realm Replicated KDCs (slaves) are read only. Entire Host-KDC dasebase is downloaded periodically 6

Realm Wonderland KDC (Lion) Lion Lion can also be a "principal" in Wonderland (with the Queen's OK) Realm Oz KDC (Hatter) DorothyAlice Alice wants to talk to Dorothy 7

PlaintextCipher Block Chaining (PPCBC) m1m2m3 IV(+) EEEKey c1c2c3 The 1st 64-bit message segment is XOR'ed with an initial vector (IV). Each following message segment is XOR'ed with the preceding ciphertext and plaintext segments-for privacy & integrity. 8

Kerberos Message Integrity Check (Message Digest) MIC is Hash( ) The Hash algorithm was never published (but source code can be obtained) It is based on a checksum algorithm designed by Juneman to use mod 2^31-1 (prime), but changed to use 2^63-1 (not prime). Cryptographers worry that it might be breakable, or reversible (to get K session ). 9

Network Layer (IP) Addresses in Tickets Only 4 bytes available, so limited to Internet Protocol (Novel, IBM, Appletalk, IPv6... longer) Makes "spoofing" harder, IP address must be stolen from network as well as Ticket from Alice. Prevents delegation, giving the ticket to another host to represent you (which is allowed by Kerberos V5) 10

Why Study Kerberos v4 (Why doesn't everyone switch to v5) Kerberos V4 is working well in many systems Switching to V5 requires stopping the network and upgrading every host at once before restart Kerberos V5 is inefficient in some ways compared to V4 Specified in ASN.1 (abstraction good and bad) Example: 11 bytes required for 4-byte IP address. 11

Kerberos v5 Cryptographic Algorithms Kerberos v4 used Plaintext Cipher Block Chaining and modified Juneman hash Kerberos v5 can use a variety of encryptions (DES in practice) and hashes (MD4, MD5). One primary MIC uses { confounder + MD5(confounder & message)}K' K' = Kalice-bob (+) F0F0F0F0F0F0F0F0 A more modern MIC that is not used is MD5(Kalice-bob & message) 12

Password security Do not send in clear except over short secure channels Choose had to guess passwords, enforce. Force changing passwords periodically Avoid keeping password in memory longer than necessary to generate the user's master key (w KDC) Send hash of (key+nonce) to KDC for authentication Add salt before hashing passwords for pw database Add realm name to password before hashing for pw db Originally UNIX stored a hash of each User’s password in a globally readable account. This can be attacked by hashing all common words for a reverse lookup table. 13

Message Security and Integrity Only exchange messages with authenticated hosts Develop a session key and separate MIC key using initial password exchange Encrypt Diffie-Hellman exchanges to prevent Bucket Brigade (man-in-middle) attacks. Use MICs, especially with self-synchronizing encryptions (e.g., PCBC) which survive permutations of message blocks. Get "random" numbers from true sources Protect Master KDC Key and hashed-key database 14

Bonus Entropy of Data, H H = sum [i=1 to k] {P i * log 2 (1/P i )} (bits of information per symbol) Where: k = number of states (or symbols) P i = probability of the i’th state (n i /N) If the symbols are binary numbers with 8 bits: H = 8 -> complete disorder or randomness H some order (ASCII text, H = bits) 15

16