1. Information Security of Embedded Systems 3.2.2010: Algorithms and Measures Prof. Dr. Holger Schlingloff Institut für Informatik und Fraunhofer FIRST

2. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20102 Structure 1. Introductory example 2. Embedded systems engineering 1.definitions and terms 2.design principles 3. Foundations of security 1.threats, attacks, measures 2.construction of safe systems 4. Design of secure systems 1.design challenges 2.safety modelling and assessment 3.cryptographic algorithms 5. Communication of embedded systems 1.remote access 2.sensor networks 6. Algorithms and measures 1.digital signatures 2.key management 3.authentication 4.authorization 7. Formal methods for security 1.protocol verification 2.logics and proof methods

3. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20103 Digital Signatures Public-key cryptography  A publishes his/her public key on his blog, mail and web site  If A encodes some text with the private key, anybody can decrypt it with this public key (or, vice versa, anybody encrypts with public key)  Hence, if we trust in A’s private key’s privacy, we know that A must have encrypted it (or, vice versa, only A can read it)  Or do we? Public key cryptography – privacy  no unauthorized reading of content Hash codes – integrity  no modification of messages Digital signatures – authenticity  no faking of sender’s identity

4. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20104 Digital Certificates and Key Integrity Problem in the above approach: attribution of private key to a person (attacker can generate a key and substitute it) Authenticity of public key? Solutions:  social processes (e.g., ebay)  guaranteed by trust centre or other certification authority Technique  TC generates public/private key pair K A E, K A D for A  TC signs public key K A D by encoding it with its own private key K TC E  A receives K A E and {K A D }K TC E  B can check authenticity of {K A D }K TC E via K TC D  problem: authenticity of K TC E !

5. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20105 PKI (public key infrastructure) Functionality of a “real” signature:  identification of signed  originality of document  contract, agreement to content  emphasis of importance Problems: forged signatures, fax machines, signature machines Hierarchy of certification authorities (witnesses, notary etc) Digital equivalents: Hierarchy of certification authorities (Trust centre, BSI) Personalisation of private key (smart cards, picture ID) Inhibit publication or transfer of private key by  black lists, white lists  penalties  legal measures

6. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20106 Key exchange and -management Problem of authenticity of the communication partners: How do communication partners know their mutual identity? (the same problem appears in ordinary surface mail) Solutions  Personalausweis, social security card  smart cards and trust centres: a trustworthy third party. User inserts card into machine, types in his PIN, the rest is automated Which protocols/algorithms are used? Def.: A protocol is a distributed algorithm involving several parties, which is defined by a sequence of steps which fix the actions and messages between the parties to achieve the desired goal

7. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20107 Key Establishment Def.: Key establishment (Schlüsselfestlegung) is the process or protocol to establish a common secret between two or more parties for later cryptographic use Two variants of key establishment:  Key transport (Schlüsselaustausch) - One party creates the key and sends it to the other(s)  Key agreement (Schlüsselvereinbarung) - The key is calculated by all involved parties from information contributed by all parties. Keys by itself can be symmetric or asymmetric, and dynamic (for one session only) or static (a priori, for several sessions)

8. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20108 Prerequisites for key establishment Trusted third party (Trusted server, authentication server) S  stepwise building of trust Assumptions on A and S, e.g., each communication partner A received from S a key which is only known to A and S  A must identify him/herself personally with S  S must keep the key secret (prevention against house braking, burglary, fraud,...)  A must keep the key secret (e.g. by SmartCard+PIN; legal consequences) Assumptions on attackers  recording, modification, deletion, detour, or replay of packets  initiation of the protocol or interference with it  no possibility for cryptanalysis  known-key-attack: does a breaking of the key for one session lead to the possibility of calculating subsequent keys?

9. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 20109 Protocols for key exchange

10. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201010 Exchange of symmetric keys with authentication server

11. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201011

12. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201012 Key Agreement

13. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201013 Symmetric keys with authentication server

14. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201014 Kerberos key distribution protocol

15. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201015

16. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201016 A protocol with asymmetric keys

17. 3.2.2010Embedded Security © Prof. Dr. H. Schlingloff 201017