1. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285: Network Security CS 285 Network Security Message Authentication Code Data integrity + Source authentication Yuan Xue Fall 2012

2. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Review of Encryption Mechanisms Symmetric Encryption Single block  How to verify the plaintext is legitimate? Multiple-blocks  modes of operation  Blocks can be rearranged/modified without being detected Asymmetric Encryptions similar issues

3. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security ECB (Electronic Codebook) Blocks can be rearranged/

4. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security CBC mode

5. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security OFB (Output Feedback Mode) E Output (Pi) can be manipulated by modification on (Ci)

6. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Confidentiality and Integrity Protection ECB Rearranging the blocks is undetectable. CBC Modifying ciphertext blocks and rearranging ciphertext blocks undetected are still possible. CFB No integrity protection; Better in detecting alterations than OFB OFB Able to make controlled changes to recovered plaintext. No integrity protection; not as good as CFB CTR Same as OFB

7. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Outline MAC Design Hash Function

8. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Encryption – Lessons learned Encryption can achieve data confidentiality Using encryption for data integrity & source authentication faces the following issues Without a structure, legitimate plaintext can not be identified automatically Modes of operation provides no data integrity protection Sometimes only data integrity is required but not confidentiality. And encrypting the whole message introduces unnecessary overhead Note that some modes of operation provides both confidentiality and authentication (e.g. OCB mode), but they typically include a MAC in their designs.

9. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Intuition We need a structure/redundant information on the plaintext How about Error Detection Code?

10. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Limit of Error Detection Code Error detection code (non-cryptographic checksum) Provides redundant information for automatically data integrity checking Using the code directly can only provide integrity protection against data modification due to natural causes, but not malicious alteration Encrypting the error detection code does not work either  Attackers can identify the messages that generate the same error detection code  Attackers can still change the message without being detected even without knowing the value of the code Encrypting (message + CRC) still suffers from subtle attacks if CRC is short Suffer attacks as well

11. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Message Authentication Code MAC (Cryptographic checksum, Keyed/cryptographic hash function) MAC = C(K, M)  accepts as input a secret key and an arbitrary-length message to be authenticated  outputs a MAC MAC value protects both a message's data integrity as well as its authenticity, by allowing verifiers (who also possess the secret key) to detect any changes to the message content. Approaches to MAC generation  CBC/DES-based MAC generation algorithm Data Authentication Algorithm  Hash-based MAC generation HMAC

12. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Usage of MAC

13. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security CBC-based MAC generation algorithm The message is encrypted with some block cipher algorithm in CBC mode to create a chain of blocks such that each block depends on the proper encryption of the previous block. This interdependence ensures that a change to any of the plaintext bits will cause the final encrypted block to change in a way that cannot be predicted or counteracted without knowing the key to the block cipher. Data Authentication Algorithm (DAA) = CBC-MAC + DES former U.S. government standard for producing MAC. code produced by the DAA is called a Data Authentication Code (DAC). The algorithm is not considered secure by today's standards. 0 

14. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Issues with CBC+MAC Issue 1 -- When same keys are used for MAC and encryption Can both confidentiality and integrity be achieved? no. only confidentiality as the ciphertext is transmitted. there is no integrity protection the last block c n+1 is the ciphertext of a “0” block, and independent of the input. If any block (other than the last one) in ciphertext is modified, it will not be detected. Solution -- Always use two different keys for MAC and encryption

15. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Issues with CBC+MAC Issue 2 -- CBC-MAC is secure for fixed-length messages. It is not secure for variable-length messages. 1. Assume that an attacker who knows the correct message-MAC pairs (m, mac) and (m', mac') 2. generate a third message m'' = m||[p 1 ’  mac||p 2 ’ …||p m ’ ] 3. Mac of m’’ will be mac’, even the attacker does not know the value of K. 4. Solution – Encrypt the mac with another key K’. 0  mac  mac  P 1 ’ mac’ M’ = p 1 ’ ||p 2 ’ ||p m ’ P2’P2’P m-1 ’Pm’Pm’ C1’C1’C2’C2’C m-1 ’

16. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Summary Message authentication code Use a shared secret key Provide data integrity protection + source authentication Limitations Use of MAC needs a shared secret key between the communicating parties MAC does not provide digital signature CBC-based MAC generation still involves high computation overhead More Approaches to MAC generation Hash-based MAC  HMAC  UMAC (http://en.wikipedia.org/wiki/UMAC)http://en.wikipedia.org/wiki/UMAC CMAC ([WS] 12.4, http://en.wikipedia.org/wiki/CMAC)http://en.wikipedia.org/wiki/CMAC

17. @Yuan Xue (yuan.xue@vanderbilt.edu)CS 285 Network Security Readings Required reading [WS] 12.1-12.3, 12.6 Recommended reading [KPS] 4.3 http://en.wikipedia.org/wiki/Message_authentication_cod e http://en.wikipedia.org/wiki/Message_authentication_cod e http://en.wikipedia.org/wiki/CBC-MAC