1. Secure Transmission of Instant Messages CS522 Final Project Presented by Akbar Khan Kaushal.S.Chandrashekar

2. Secure Transmission of Instant Messages  An application that enables real time communication on-line  Real-time conversations with other logged-on IM users  Users see the availability of others  Users set their own status.  Interface for direct and private conversation.

3. Secure Transmission of Instant Messages Advantages  Less intrusive than a telephone  Quicker & more personal than email  Free Disadvantages  Weak security.

4. Secure Transmission of Instant Messages IM Clients  Often use both P2P and Client Server Architecture  AOL Instant Messenger (AIM)  Mirabilis ICQ  Yahoo Instant Messenger  Jabber

5. Secure Transmission of Instant Messages Security Issues  Symmetric key Encryption (Fast way)  Encryption at one end and Decryption on other end.  Need for secure key transport  Allow both secure and non-secure communication simultaneously

6. Secure Transmission of Instant Messages DES (Data Encryption Standard)  Actual message Encryption  Symmetric key Encryption method  Uses 64-bit input block and 56-bit key  Output is 64-bit  Was the National Bureau of Standards approved Encryption method for non-military use

7. Secure Transmission of Instant Messages Public key Cryptography  Each participant in the transaction gets a pair of keys (Public, Private)  The Public key is published and Private key is kept secret  Need for sender and receiver to share the secret information is eliminated  Data Encrypted using a participants Public key can only be decrypted using the corresponding Private key and vice versa.  No private key is ever transmitted or shared

8. Secure Transmission of Instant Messages RSA (Rivest, Shamir, Adleman)  Used for key transport  Public key Encryption method  we have used 512-bit Public and Private keys

9. Secure Transmission of Instant Messages Initial Design Client – A PU A, PR A, PU B Client – B PU B, PR B, PU A Key = RandomKey() EKey = E(PU B, Key) Msg = SD(Key, EMsg) Key = D(PR B, EKey) EMsg = SE(Key, Msg)

10. Initial Design Fault Client – A PU A, PR A, PU B Client – B PU B, PR B, PU A Key = RandomKey() EKey = E(PU B, Key) Msg = SD(Key, EMsg) Key2 = D(PR B, EKey) EMsg = SE(Key2, Msg) Attacker PU X, PR X, PU B Key2 = RandomKey() EKey2 = E(PU B, Key2) Msg = SD(Key2, EMsg) Packet Intercepted

11. Revised Design Client – A PU A, PR A, PU B Client – B PU B, PR B, PU A Key = RandomKey() EKey = E(PU B, Key) H = hash (EKey) Sig = E(PR A, H) Msg = SD(Key, EMsg) H2 = hash (EKey) H = D (PU A, Sig) IF H2 = H THEN Verfied ELSE Reject Key = D(PR B, EKey) EMsg = SE(Key, Msg) Sig + EKey Provides security and authentication

12. Secure Transmission of Instant Messages Libraries used  Libyahoo2-Opensource yahoo messaging library  OpenSSL Crypto Library

13. Secure Transmission of Instant Messages Future Improvements  Use of trusted third party for authenticated distribution of public keys  Porting to GUI-based messenger from current command line version

14. Secure Transmission of Instant Messages References Cryptography and Network Security by William Stallings  http://sourceforge.net/projects/libyahoo/ http://sourceforge.net/projects/libyahoo/  http://www.openssl.org www.openssl.org  http://www.venkydude.com/articles/yahoo.htm