1. Network security and Hot topics in networking EECS 489 Computer Networks http://www.eecs.umich.edu/courses/eecs489/w07 Z. Morley Mao Wednesday, April 11, 2007

2. Announcements r Agenda today: m Icecream to celebrate almost finishing EECS489 m Finish up network security m Where to go from here? Hot topics in networks. m Course evaluation (need volunteer) r Practice final is posted (announcement page) m Solution available next Monday r Mandatory PA3 Demo: m Starting Thursday (4/12), last day is Friday (4/20), signup available. r Next Monday 4/16 m Course summary and review for final r Final exam: 4/19

3. Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Authentication 8.4 Integrity 8.5 Key Distribution and certification 8.6 Access control: firewalls 8.7 Attacks and counter measures 8.8 Security in many layers 8.8.1. Secure email 8.8.2. Secure sockets 8.8.3. IPsec 8.8.4. Security in 802.11

4. Secure e-mail Alice:  generates random symmetric private key, K S.  encrypts message with K S (for efficiency)  also encrypts K S with Bob’s public key.  sends both K S (m) and K B (K S ) to Bob.  Alice wants to send confidential e-mail, m, to Bob. K S ( ). K B ( ). + + - K S (m ) K B (K S ) + m KSKS KSKS KBKB + Internet K S ( ). K B ( ). - KBKB - KSKS m K S (m ) K B (K S ) +

5. Secure e-mail Bob:  uses his private key to decrypt and recover K S  uses K S to decrypt K S (m) to recover m  Alice wants to send confidential e-mail, m, to Bob. K S ( ). K B ( ). + + - K S (m ) K B (K S ) + m KSKS KSKS KBKB + Internet K S ( ). K B ( ). - KBKB - KSKS m K S (m ) K B (K S ) +

6. Secure e-mail (continued) Alice wants to provide sender authentication message integrity. Alice digitally signs message. sends both message (in the clear) and digital signature. H( ). K A ( ). - + - H(m ) K A (H(m)) - m KAKA - Internet m K A ( ). + KAKA + K A (H(m)) - m H( ). H(m ) compare

7. Secure e-mail (continued) Alice wants to provide secrecy, sender authentication, message integrity. Alice uses three keys: her private key, Bob’s public key, newly created symmetric key H( ). K A ( ). - + K A (H(m)) - m KAKA - m K S ( ). K B ( ). + + K B (K S ) + KSKS KBKB + Internet KSKS

8. Pretty good privacy (PGP) r Internet e-mail encryption scheme, de- facto standard. r uses symmetric key cryptography, public key cryptography, hash function, and digital signature as described. r provides secrecy, sender authentication, integrity. r inventor, Phil Zimmerman, was target of 3-year federal investigation due to US export regulations. ---BEGIN PGP SIGNED MESSAGE-- - Hash: SHA1 Alice: I developed a new worm that can exploit the zero- day flaw on Windows Vista. Bob ---BEGIN PGP SIGNATURE--- Version: PGP 5.0 Charset: noconv yhHJRHhGJGhgg/12EpJ+lo8gE4vB3 mqJhFEvZP9t6n7G6m5Gw2 ---END PGP SIGNATURE--- A PGP signed message:

9. Secure sockets layer (SSL) r transport layer security to any TCP- based app using SSL services. r used between Web browsers, servers for e-commerce (https). r security services: m server authentication m data encryption m client authentication (optional) r server authentication: m SSL-enabled browser includes public keys for trusted CAs. m Browser requests server certificate, issued by trusted CA. m Browser uses CA’s public key to extract server’s public key from certificate. r check your browser’s security menu to see its trusted CAs.

10. SSL (continued) Encrypted SSL session: r Browser generates symmetric session key, encrypts it with server’s public key, sends encrypted key to server. r Using private key, server decrypts session key. r Browser, server know session key m All data sent into TCP socket (by client or server) encrypted with session key. r SSL: basis of IETF Transport Layer Security (TLS). r SSL can be used for non-Web applications, e.g., IMAP. r Client authentication can be done with client certificates.

11. IPsec: Network Layer Security r Network-layer secrecy: m sending host encrypts the data in IP datagram m TCP and UDP segments; ICMP and SNMP messages. r Network-layer authentication m destination host can authenticate source IP address r Two principle protocols: m authentication header (AH) protocol m encapsulation security payload (ESP) protocol r For both AH and ESP, source, destination handshake: m create network-layer logical channel called a security association (SA) r Each SA unidirectional. r Uniquely determined by: m security protocol (AH or ESP) m source IP address m 32-bit connection ID

12. Authentication Header (AH) Protocol r provides source authentication, data integrity, no confidentiality r AH header inserted between IP header, data field. r protocol field: 51 r intermediate routers process datagrams as usual AH header includes: r connection identifier r authentication data: source-signed message digest calculated over original IP datagram. r next header field: specifies type of data (e.g., TCP, UDP, ICMP) IP headerdata (e.g., TCP, UDP segment) AH header

13. ESP Protocol r provides secrecy, host authentication, data integrity. r data, ESP trailer encrypted. r next header field is in ESP trailer. r ESP authentication field is similar to AH authentication field. r Protocol = 50. IP header TCP/UDP segment ESP header ESP trailer ESP authent. encrypted authenticated

14. IEEE 802.11 security r War-driving: drive around Bay Area, see what 802.11 networks available? m More than 9000 accessible from public roadways m 85% use no encryption/authentication m packet-sniffing and various attacks easy! r Securing 802.11 m encryption, authentication m first attempt at 802.11 security: Wired Equivalent Privacy (WEP): a failure m current attempt: 802.11i

15. Wired Equivalent Privacy (WEP): r authentication as in protocol ap4.0 m host requests authentication from access point m access point sends 128 bit nonce m host encrypts nonce using shared symmetric key m access point decrypts nonce, authenticates host r no key distribution mechanism r authentication: knowing the shared key is enough

16. WEP data encryption r Host/AP share 40 bit symmetric key (semi- permanent) r Host appends 24-bit initialization vector (IV) to create 64-bit key r 64 bit key used to generate stream of keys, k i IV r k i IV used to encrypt ith byte, d i, in frame: c i = d i XOR k i IV r IV and encrypted bytes, c i sent in frame

17. 802.11 WEP encryption Sender-side WEP encryption

18. Breaking 802.11 WEP encryption Security hole: r 24-bit IV, one IV per frame, -> IV’s eventually reused r IV transmitted in plaintext -> IV reuse detected r Attack: m Trudy causes Alice to encrypt known plaintext d 1 d 2 d 3 d 4 … m Trudy sees: c i = d i XOR k i IV m Trudy knows c i d i, so can compute k i IV m Trudy knows encrypting key sequence k 1 IV k 2 IV k 3 IV … m Next time IV is used, Trudy can decrypt!

19. 802.11i: improved security r numerous (stronger) forms of encryption possible r provides key distribution r uses authentication server separate from access point r Wi-Fi Protected Access (WPA) m implements the majority of this standard

20. AP: access point AS: Authentication server wired network STA: client station 1 Discovery of security capabilities 3 STA and AS mutually authenticate, together generate Master Key (MK). AP servers as “pass through” 2 3 STA derives Pairwise Master Key (PMK) AS derives same PMK, sends to AP 4 STA, AP use PMK to derive Temporal Key (TK) used for message encryption, integrity 802.11i: four phases of operation

21. wired network EAP TLS EAP EAP over LAN (EAPoL) IEEE 802.11 RADIUS UDP/IP EAP: extensible authentication protocol r EAP: end-end client (mobile) to authentication server protocol r EAP sent over separate “links” m mobile-to-AP (EAP over LAN) m AP to authentication server (RADIUS over UDP)

22. SSH (rfc4251) r Establishes a secure channel between a local and remote computer r Uses public-key crypto to authenticate remote host and user r Provides confidentiality, integrity r Authentication m Password-based m Public-key based Public and private key pair generation using ssh-keygen

23. Host keys r ssh liberty.eecs.umich.edu r @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@@@ r @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ r @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@@@ r IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! r Someone could be eavesdropping on you right now (man-in-the-middle attack)! r It is also possible that the RSA host key has just been changed. r The fingerprint for the RSA key sent by the remote host is r 00:61:14:7c:76:02:5a:94:42:a1:8e:ce:e1:ef:d7:9a. r Please contact your system administrator. r Add correct host key in /n/edinburgh/x/zmao/.ssh/known_hosts to get rid of this message. r Offending key in /n/edinburgh/x/zmao/.ssh/known_hosts:276 r Password authentication is disabled to avoid man-in-the-middle attacks. r Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks. r Enter passphrase for key '/n/edinburgh/x/zmao/.ssh/id_rsa':

24. One time password r Opposite of static passwords m constantly altering passwords r Password generation algorithms m math algorithm: generates next password based on the previous one, e.g., hash chain. m time sychronization btw. client and authentication server m math algorithm: next password based on a challenge and counter (e.g., used by smart cards). RSA SecurID tokens (has a built-in accurate clock)

25. Network Security (summary) Basic techniques…... m cryptography (symmetric and public) m authentication m message integrity m key distribution …. used in many different security scenarios m secure email m secure transport (SSL) m IP sec m 802.11

26. What are hot topics in networking? r Information sharing m Fighting Coordinated Attackers with Cross- Organizational Information Sharing r Social networks m SPACE: Secure Protocol for Address Book based Connection Establishment m Exploiting Social Networks for Internet Search m Detect Sybil Attacks r Revisiting Internet design m Decongestion control m IP multicast r Evolutionary PKI, security through publicity

27. What are hot topics in networking? r next-generation Internet m new addressing, routing schemes r Churn in distributed systems r Troubleshooting, diagnosis, mitigation r Detecting Evasion Attacks at High Speeds without Reassembly r New network applications

28. Internet is not the only network r “New” networks m vehicular networks m sensor networks m wireless networks m cellular networks m delay-tolerant networks m networks in rural areas m integration with Internet r Biggest problem with today’s Internet: m Lack of security m Lack of manageability and QoS assurance m Other desirable properties: mobility, fault- resilience.

29. Network security is an ongoing arms race r Measuring Internet-scale Adversaries m Endemic worms, malicious scanning m Huge dataset headache m Huge privacy/legal/policy/commercial hurdles m Attacks on passive monitoring state, analysis flooding bugs in analyzers: adversary crafts such a packet, overruns buffer, causes analyzer to execute arbitrary code evasion, confuse monitoring analysis algorithms r Defense m Automated response

30. Unwanted traffic r spam r reconnaissance, probe traffic r attack traffic r misconfigurations