1. Mid-term Review Network Security

2. Gene Itkis: CS558 Network Security2 Secure channel SSL SSL (and many others: incl. IPSEC) Shared key establishing Trusted party (Kerberos, etc. - to be covered)  Public key methods

3. Gene Itkis: CS558 Network Security3 Public Key techniques Diffie-Hellman RSA N=pq; ed  1 (mod  (N)) Public: e,N; Private: d,N Encrypt(m): c  m e modN Decrypt(c): m  c d modN Sign(m): s  m d modN Verify(s,m): s e  m (modN) AliceBob ab p, g m a  g a mod pm b  g b mod p mama mbmb m b a mod pm a b mod p=g ab mod p= shared secret key! Discrete log: Given y,p,b Find x: b x mod p = y ? Factoring: Given N=pq Find p,q

4. Gene Itkis: CS558 Network Security4 Discrete log based schemes DH, DSS (El-Gamal); Elliptic Curves Cryptography (ECC) Why modulus (p) is so large? Big-step/Little-step attack Pohlig-Hellman attack: Beware of primes p with only small factors φ(p) Safe primes: p=2q+1 for some prime q

5. Gene Itkis: CS558 Network Security5 Factoring based RSA Square Roots (=factoring) Rabin (Encryption,Signature) Fiat-Shamir (ID scheme, Signature)

6. Gene Itkis: CS558 Network Security6 World mod N How many objects? |Z * N |=  (N); for all z  Z * N, z  (N) mod N=1 If N=pq, then  (N)= (p-1)(q-1) [ If N=p, then  (N)= p-1 ] Blum integers: N=pq, p  q  3 (mod 4) Then x (p+1)/4 mod p= y; y 2  x (p+1)/2  x (p-1)/2 x  ±x mod p

7. Gene Itkis: CS558 Network Security7 Chinese Remainder Theorem (CRT) Given y 2 =x mod p; z 2 =x mod q; N=pq; Find s: s 2 =x mod N More generally: Given a,A, b,B; Find x: x=a mod A, x=b mod B Let u, v be s.t. uA=1 mod B, vB=1 modA Then x=uAb+vBa [indeed:x mod A = uAb+vBa = vBa = a; x mod B = uAb+vBa = uAb = b ] How to find u,v?

8. Gene Itkis: CS558 Network Security8 Extended GCD & Inverses Euclid’s GCD algorithm (greatest common divisor): gcd(a,b) = gcd(b, a mod b) =…= c Extended GCD gives in addition x,y: ax+by=c If gcd(a,b)=1: ax (mod b) =1 i.e., x=a –1 in Z * b

9. Gene Itkis: CS558 Network Security9 Summary RSA & Rabin RSA Given p,q; Can compute  (N), for N=pq; With Extended GCD, can compute e, d = 1/e mod  (N); [ gcd(e,  (N)) must be 1 ] Rabin Using Blum integers can compute SQRT mod p,q Using CRT can combine them to SQRT mod N

10. Gene Itkis: CS558 Network Security10 Efficiency for all Exponentiation: Repetitive Squaring b A mod N takes  1.5 lg A long multiplications Cost of multiplication  quadratic in length Optimization: mod N  mod p + mod q +CRT Watch out!

11. Gene Itkis: CS558 Network Security11 Attacks on factoring  (N), N => factoring (quadratic equation) Trick: obtain x, s.t. x=0 mod p, x  0 mod q gcd(x, N)=p SQRT modN => Factoring v  y 2 mod N; z  SQRT modN (v) If z  ±y, then x  y-z Computing mod p + mod q + CRT Random error mod p (or mod q) => factoring

12. Gene Itkis: CS558 Network Security12 Key Establishing Diffie-Hellman or RSA Watch out for man-in-the-middle attack!!! Authentication (signatures) PKI ARemember AKE: authenticated key establishment Beyond AKE Ciphers MACs

13. Gene Itkis: CS558 Network Security13 Ciphers Block ciphers DES, AES, 3DES, … Modes of operation: EDE, OFB, CBC, … Stream ciphers Pseudo-random pad

14. Gene Itkis: CS558 Network Security14 Later in the course Crypto Hashing MD5, SHA MAC Systems PKI Kerberos - key distribution (symmetric crypto) IPSec - security on another level Firewalls, IDS, etc.