1. Advanced Computer Networks
CS716
Advanced Computer Networks
By Dr. Amir Qayyum 1

2. Lecture No. 41

3. Message Integrity Protocols
Digital signature using RSA
Special case of a message integrity where the code can only have been generated by one participant
Compute signature with private key and verify with public key

4. Message Integrity Protocols
Keyed MD5
Sender: m + MD5 (m + k) + E(E(k, rcv-pub), private)
Receiver
recovers random key using the sender’s public key
applies MD5 to the concatenation of this random key message

5. Message Integrity Protocols
MD5 with RSA signature
Sender: m + E(MD5(m), private)
Receiver
Decrypts signature with sender’s public key
Compares result with MD5 checksum sent with message

6. Authentication

7. Session Key Communication

8. Session Key Communication

9. Key Distribution Center

10. Kerberos

11. Man-in-the-Middle Attack in Diffie-Hellman

12. Key Distribution Certificate
Special type of digitally signed document:
“I certify that the public key in this document belongs to the entity named in this document, signed X.”
The name of the entity being certified
The public key of the entity
The name of the certification authority
A digital signature

13. Certification Authority (CA)
Key Distribution
Certification Authority (CA)
Administrative entity that issues certificates
Useful only to someone that already holds the CA’s public key.

14. Tree-structured CA Hierarchy

15. Key Distribution (cont)
Chain of Trust
If X certifies that a certain public key belongs to Y, and Y certifies that another public key belongs to Z, then there exists a chain of certificates from X to Z
Someone that wants to verify Z’s public key has to know X’s public key and follow the chain
Certificate Revocation List

16. PGP Message Integrity and Authentication
Sender identity and message
integrity confirmed
if checksums match
Calculate MD5 checksum on
received message and compare
against received value
Calculate MD5 checksum
over message contents
Sign checksum using RSA
with sender‘s private key
Decrypt signed checksum
with sender‘s private key
Transmitted message

17. PGP Message Encryption
Original message
Create a random secret key k
Encrypt message using
DES with secret key k
Decrypt message using
DES with secret key k
Encrypt k using RSA with
recipient s public key
Decrypt E(k) using RSA with
my private key k
Encode message + E(k)
in ASCII for transmission
Convert ASCII message
Transmitted message

18. Example (PGP)

19. SSH Port Forwarding

20. Secure Transport Layer
Application (e.g. HTTP)
Secure transport layer
TCP IP
Subnet

21. TLS Handshake Protocol
Client
Server
Hello
[Certificate] Keys
[Cert. Verify] Finished
Finished
Data

22. TLS Handshake Protocol

23. IPSEC Authentication Header

24. IPSEC ESP Header

25. ESP Packet

26. Firewalls

27. Firewalls Filter-Based Solution Example
Rest of the Internet
Local site
Filter-Based Solution
Example
( , 1234, , 80 )
(*,*, , 80 )
Default: forward or not forward?
How dynamic?

28. Proxy-Based Firewalls
Problem: complex policy
Example: web server
Remote
Company
User
Firewall
Web
Server
Internet
Company net
Random
External
User

29. Proxy-Based Firewalls
Solution: proxy
Design: transparent vs classical
Limitations: Internal attacks
Firewall
External
Client
Local
Server
Proxy
External HTTP/TCP connection
Internal HTTP/TCP connection

30. Simple Proxy Scenario S R P

31. Denial of Service Attacks on end hosts Attacks on routers
SYN attack
Attacks on routers
Christmas tree packets
Pollute route cache
Authentication attacks
Distributed DoS attacks