1. EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 9 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University wenbing@ieee.org

2. 2 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Outline Announcement –Midterm#1: March 20 th, 4-6pm (moved from March 27 th ) Secure Socket Layer Pretty Good Privacy

3. 3 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL: The Secure Sockets Layer SSL (Secure Sockets Layer): a security package for secure communication over Internet –Introduced in 1995, Netscape Communications Corp SSL builds a secure connection between two sockets, including –Parameter negotiation between client and server –Mutual authentication of client and server –Secret communication –Data integrity protection

4. 4 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Secure Sockets Layer Documentation The SSL Protocol version 3.0 Internet Draft: http://home.netscape.com/eng/ssl3/ssl-toc.html http://home.netscape.com/eng/ssl3/ssl-toc.html The TLS Protocol version 1.0 Internet Draft: http://www.ietf.org/rfc/rfc2246.txt http://www.ietf.org/rfc/rfc2246.txt "HTTP Over TLS" Information RFC: http://www.ietf.org/rfc/rfc2818.txt http://www.ietf.org/rfc/rfc2818.txt SSL and TLS: Designing and Building Secure Systems by Eric Rescorla. Addison Wesley Professional, 2000 Analysis of the SSL 3.0 Protocol, by David Wagner and Bruce Schneier, http://www.schneier.com/paper-ssl- revised.pdf

5. 5 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL: The Secure Sockets Layer HTTPS (Secure HTTP): HTTP over SSL –Sometimes it is available at a new port (443) instead of the standard port (80) Layers (and protocols) for home user using HTTPS

6. 6 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL: The Secure Sockets Layer SSL consists of two main subprotocols: –handshake protocol –record protocol SSL supports multiple cryptographic algorithms –The strongest one uses triple DES with three separate keys for encryption and SHA-1 for message integrity –For ordinary e-commerce applications, RC4 is used with a 128-bit key for encryption and MD5 is used for message authentication

7. 7 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL: The Secure Sockets Layer TCP SSL Record Layer Protocol Application Data SSL Handshake Protocol SSL Alert Protocol Application software SSL Change Cipher Spec Protocol

8. 8 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol ClientKeyEx

9. 9 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Message #1: Client hello –SSL version; Random structure (timestamp and nonce); Session id; CipherSuites; Compression methods Message #2: Server hello –SSL version*; Random structure (timestamp and nonce); Session id; CipherSuite*; Compression method* * selection based on client’s preference by the server

10. 10 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Message #3: Server certificate (server key exchange message would be sent if there is no certificate) Message #4: Server hello done –To indicate the end of the server hello and associated messages

11. 11 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Message #5: ClientKeyExchange - RSA encrypted premaster secret message –48-byte long (version number and random bytes), encrypted using server’s public key

12. 12 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Message #6&8: Change cipher spec –Sent by both client and server to notify receiving party that subsequent records will be protected under the new CipherSpec and keys –The client sends a change cipher spec message following handshake key exchange and certificate verify messages (if any) –The server sends one after successfully processing the key exchange message it received from the client

13. 13 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol The Change cipher spec message is an independent SSL Protocol content type, and is not actually an SSL handshake message –This is designed as a performance improvement –This message cannot be combined with the finished message (change cipher spec is unencrypted [or encrypted using the previous session key] and the finished message is encrypted using the new session key)

14. 14 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Message #7&9: Finished –Sent immediately after a change cipher specs msg –The finished message is the first protected with the just-negotiated algorithms, keys, and secrets –No acknowledgment of the finished message is required; parties may begin sending confidential data immediately after sending the finished message

15. 15 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Output Pre-master Secret Client Random Server Random Master Secret Key Block Clint MAC Server MAC Client Write Server Write Client IV Server IV

16. 16 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Output Master secret: computed based on the premaster secret and the nonces proposed by the client and the server master_secret = MD5(pre_master_secret + SHA('A' + pre_master_secret + ClientHello.random + ServerHello.random)) + MD5(pre_master_secret + SHA('BB' + pre_master_secret + ClientHello.random + ServerHello.random)) + MD5(pre_master_secret + SHA('CCC' + pre_master_secret + ClientHello.random + ServerHello.random)); Session keys, MAC secrets, and IVs: the master secret is used as an entropy source, and the random values provide unencrypted salt material and IVs for exportable ciphers

17. 17 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Output To generate the key material, compute key_block = MD5(master_secret + SHA('A' + master_secret + ServerHello.random + ClientHello.random)) + MD5(master_secret + SHA('BB' + master_secret + ServerHello.random + ClientHello.random)) + MD5(master_secret + SHA('CCC' + master_secret + ServerHello.random + ClientHello.random)) + [...]; until enough output has been generated

18. 18 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Handshake Protocol Output Then the key_block is partitioned as follows: client_write_MAC_secret[CipherSpec.hash_size] server_write_MAC_secret[CipherSpec.hash_size] client_write_key[CipherSpec.key_material] server_write_key[CipherSPec.key_material] client_write_IV[CipherSpec.IV_size] /* non-export ciphers */ server_write_IV[CipherSpec.IV_size] /* non-export ciphers */

19. 19 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL Record Protocol MAC = hash(MAC_write_secret + pad_2 + hash(MAC_write_secret + pad_1 + seq_num + length + content)); <= 16 KB each Why?

20. 20 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao SSL and TLS In 1996, Netscape Communications Corp. turned SSL over to IETF for standardization. The result was TLS (Transport Layer Security) –It is described in RFC 2246 –The changes made to SSL were relatively small, but just enough that SSL version 3 and TLS cannot interoperate –The TLS version is also known as SSL version 3.1

21. 21 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao E-Mail Security PGP– Pretty Good Privacy PEM – Privacy Enhanced Mail S/MIME

22. 22 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao PGP – Pretty Good Privacy PGP (Pretty Good Privacy): e-mail security package that provides privacy, authentication, digital signatures, and compression, all in an easy-to-use form –Created by Zimmermann, released in 1991 –Zimmermann is a privacy advocate whose motto is: If privacy is outlawed, only outlaws will have privacy –The complete package, including all the source code, is distributed free of charge via the Internet –Due to its quality, price (zero), and easy availability on UNIX, Linux, Windows, and Mac OS platforms, it is widely used today

23. 23 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao PGP – Pretty Good Privacy PGP encrypts data by using a block cipher called IDEA (International Data Encryption Algorithm) –It has been patented and OpenPGP has stopped using it Key management uses RSA Data integrity uses MD5 Compression uses the ZIP program, which uses the Ziv-Lempel algorithm (Ziv and Lempel, 1977) –Compression saves bandwidth –It also wipes out the frequency information contained in the plaintext. In effect, it converts the plaintext into junk

24. 24 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao PGP – Pretty Good Privacy PGP in operation for sending a message

25. 25 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao PGP – Pretty Good Privacy Alice sends an email P to Bob using PGP: –Both Alice and Bob have private (D X ) and public (E X ) RSA keys. Assume that each one knows the other's public key –PGP first hashes Alice’s message, P, using MD5, and then encrypts the resulting hash using her private RSA key, D A –The encrypted hash and the original message are concatenated into a single message, P1, and compressed using the ZIP program, the output of this step is P1.Z

26. 26 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao PGP – Pretty Good Privacy –Next, PGP prompts Alice for some random input. Both the content and the typing speed are used to generate a 128-bit IDEA message key, K M –K M is now used to encrypt P1.Z with IDEA in cipher feedback mode –In addition, K M is encrypted with Bob's public key, E B. These two components are then concatenated and converted to base64