1. Advanced Computer Networks
CS716
Advanced Computer Networks
By Dr. Amir Qayyum 1

2. Lecture No. 40

3. Security Outline Encryption Algorithms Authentication Protocols
Message Integrity Protocols
Key Distribution
Firewalls

4. Overview Cryptography functions Security services
Secret key (e.g. DES)
Public key (e.g. RSA)
Message digest (e.g. MD5)
Security services
Privacy: preventing unauthorized release of information
Authentication: verifying identity of the remote participant
Integrity: making sure message has not been altered

5. Taxonomy of Network Security
Cryptography
Security
algorithms
services
Secret
Public
Message
Privacy
Authentication
Message
key
key
digest
integrity
(e.g. DES)
(e.g. RSA)
(e.g. MD5)

6. Secret Key Encryption

7. Secret Key Encryption (DES)
Plaintext
Plaintext
Encrypt with
Decrypt with
secret key
secret key
Ciphertext

8. DES Algorithm Each Round 64-bit key (56-bits + 8-bit parity) 16 rounds
Initial permutation
Round 1
Each Round
Round 2
56-bit L ─ 1 R ─ 1
key i i F K i +
Round 16 L R i i
Final permutation

9. Expansion Phase of DES 4-bit chunk Expanded to 6 bits by stealing
a bit from left and right chunks
■ ■ ■

10. Initialization Vector
Secret Key Encryption
Plaintext Block 3
Plaintext Block 2
Plaintext Block 1
Plaintext Block 0
Encryption Function
Blocks of Ciphertext
Initialization Vector
(For block 0 only)

11. Cipher Block Chaining (CBC)
Repeat for larger messages
Block
Block
Block
Block 1 2 3 4 IV + + + +
DES
DES
DES
DES
Cipher
Cipher
Cipher
Cipher 1 2 3 4

12. Public Key Encryption

13. Public Key Authentication

14. Public Key Encryption (RSA)
Plaintext
Plaintext
Encrypt with
Decrypt with
public key
private key
Ciphertext
Encryption & Decryption
c = memod n
m = cdmod n

15. RSA (cont) Choose two large prime numbers p and q (each 256 bits)
Multiply p and q together to get n
Choose the encryption key e, such that e and (p - 1) × (q - 1) are relatively prime.
Two numbers are relatively prime if they have no common factor greater than one

16. RSA (cont) Compute decryption key d such that
d = e-1mod ((p - 1) × (q - 1))
Construct public key as (e, n)
Construct private key as (d, n)
Discard (do not disclose) original primes p and q

17. Message Digest Cryptographic checksum
Just as a regular checksum protects the receiver from accidental changes to the message, a cryptographic checksum protects the receiver from malicious changes to the message.

18. Message Digest One-way function
Given a cryptographic checksum for a message, it is virtually impossible to figure out what message produced that checksum; it is not computationally feasible to find two messages that hash to the same cryptographic checksum.

19. Message Digest Relevance
If you are given a checksum for a message and you are able to compute exactly the same checksum for that message, then it is highly likely this message produced the checksum you were given.

20. Overview of Message Digest Operation
Initial “digest”
Message (padded)
(constant)
512 bits
512 bits
512 bits
■ ■ ■
Transform
Transform
Transform
Message digest

21. Authentication Protocols
Three-way handshake
Client
Server
ClientId, E (x, CHK)
E(x + 1, SHK), E(Y, SHK)
E(y + 1, CHK)
E(SK, SHK)

22. Third Party Authentication
Trusted third party (Kerberos) S A B
A, B
E((T, L, K, B), KA),
E((T, L, K, A), KB)
E((A, T), K),
E((T, L, K, A), KB)
E(T + 1, K)

23. Public Key Authentication( x
, Public )

24. Message Integrity

25. Message Integrity Protocols
Keyed MD5
Sender: m + MD5 (m + k) + E(E(k, rcv – pub), private)
Receiver
Recovers random key using the sender’s public key
Applies MD5 to the concatenation of this random key message

26. Message Integrity Protocols
MD5 with RSA signature
Sender: m + E(MD5(m), private)
Receiver
Decrypts signature with sender’s public key
Compares result with MD5 checksum sent with message

27. Tree-structured CA Hierarchy

28. Authentication

29. Session Key Communication

30. Session Key Communication

31. Key Distribution Center