(In-)secure messaging with SCimp
|
|
|
- Darrell Porter
- 6 years ago
- Views:
Transcription
1 (In-)secure messaging with SCimp Sebastian R. Verschoor and Tanja Lange (with many slides and pictures by Sebastian) University of Waterloo / Eindhoven University of Technology CryptoAction Symposium March Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 1
2 Secure Messaging protocols EFF ad in Wired magazine (source) Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 2
3 History of online secure messaging (1/2) 1991: Phil Zimmermann creates PGP 2004: Nikita Borisov, Ian Goldberg and Eric Brewer create OTR Secure, but requires synchronous environment 2011: Gary Belvin introduces SecureSMS (master s thesis) 2012: SCimp (Silent Circle instant messaging protocol) By Vinnie Moscaritolo, Gary Belvin and Phil Zimmermann SecureSMS for XMPP Even copies variable names and equation numbering from Belvin s thesis (despite creating internal inconsistencies) February 2014: Open Whisper Systems releases TextSecure v2 Allows offline initial user message Later renamed to Signal Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 3
4 History of online secure messaging (2/2) May 2014: Silent Circle updates to SCimp v2 Allows offline initial user message August 2015: Silent Circle releases code for SCimp v2 Adds more inconsistencies between code and documentation September 2015: Silent Circle discontinues SCimp, switches to Signal-based protocol October 2015: Andreas Straub proposes OMEMO Multi-device Signal for XMPP Oct-Nov 2016: Trevor Perrin and Moxie Marlinspike release official specification for the Signal protocol Dec 7th 2016: OMEMO gets standardized by the XMPP Standard Foundation: XEP-0384 (experimental) Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 4
5 Blackphone by Silent Circle Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 5
6 Blackphone by Silent Circle Android-based smart phone running Silent OS operating system. Rather expensive (2016: 799 USD); now 599 USD. Promise of higher security and privacy: Blackphone puts privacy first. The Blackphone 1 (summer 2014) came with service subscriptions for encrypted phone (Silent Phone) and chat (Silent Text). Silent Text was available as free Apple and Android apps but subscription fee for servers. No public security analysis or code; after intense online discussion (Wilcox-O Hearn s open letter to Phil Zimmermann and Jon Callas) some source code for on GitHub. Callas suggested analysis of SCimp as topic for Verschoor s thesis. Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 6
7 Our involvement December 2015: Verschoor s Master s thesis (at TU/e) on SCimp SCimp v1 is formally verified by ProVerif to be secure SCimp v2 contains cryptographic flaws the implementation contains many security bugs June 2016: Verschoor s cryptographic report on OMEMO Minor bug found in multidevice setting Developer patches it the same day as reported July 2016: Sebastian Verschoor and I release SCimp preprint paper Some of Silent Circle s code (copied from SCimp implementation) still contains bugs that were reported in Verschoor s thesis Bugs got patched a few days later Initial bug report: September 2015 Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 7
8 SCimp v1: Key negotiation Alice genkeypair() DH(sk a, pk b ) hash(pk a ) pk b pk a, mac a mac b Bob genkeypair() DH(sk b, pk a ) Keys derived from DH Out of band Confirm SAS Authenticated SAS: short authentication string Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 8
9 SCimp v1: Key negotiation ECDHE gives shared secret Z, from which are derived: k snd,0, k rcv,0, i snd,0, i rcv,0 ; for message encryption and authentication mac a, mac b ; to confirm knowledge of Z SAS; for authentication of identity cs; for rekeying User messages can be sent after four key exchange messages genkeypair() DH(sk a, pk b ) Alice hash(pk a ) pk b pk a, mac a mac b Bob genkeypair() DH(sk b, pk a ) Keys derived from DH Out of band Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 9
10 SCimp v1: Key negotiation SAS confirms identity all previous communication Requires commitment to pk a to prevent collision attack genkeypair() DH(sk a, pk b ) Alice hash(pk a ) pk b pk a, mac a mac b Bob genkeypair() DH(sk b, pk a ) Keys derived from DH Out of band Confirm SAS Authenticated Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 10
11 SCimp v1: Rekeying Alice Bob Alice and Bob share cs hash(pk a ), MAC cs (pk a ) pk b, MAC cs (pk b ) Verify MAC cs pk a, mac a Verify MAC cs mac b Keys derived from DH and cs cs used for key continuity; gets updated at end up rekeying. Description speaks of self-healing. Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 11
12 SCimp v1: Rekeying First: store old decryption key (messages might arrive out of order) Optional: SAS comparison only after several rekeyings Rekeying ensures future secrecy It is not specified when to rekey Protocol aborts on error Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 12
13 SCimp v1: Sending user messages Encrypt ciphertext = AESkj (i j,plaintext) Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 13
14 SCimp v1: Sending user messages Encrypt ciphertext = AESkj (i j,plaintext) Update keys (ratchet) k j+1 = MAC kj (i j ) i j+1 = i j + 1 Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 13
15 SCimp v1: Sending user messages Encrypt ciphertext = AESkj (i j,plaintext) Update keys (ratchet) k j+1 = MAC kj (i j ) i j+1 = i j + 1 Send message: i j ciphertext Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 13
16 SCimp v1: Sending user messages Encrypt ciphertext = AESkj (i j,plaintext) Update keys (ratchet) k j+1 = MAC kj (i j ) i j+1 = i j + 1 Send message: i j ciphertext No message signatures: deniable Ratchet enables key erasure, but: Out of order messages require you to store old keys Old keys compromise future keys Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 13
17 Proverif results for SCimp v1 First key negotiation (if SAS confirmed over authenticated channel) Confidentiality of keys Authenticity of keys and other party identity Rekeying Confidentiality of keys Authenticity of keys and other party identity Future secrecy When attacker misses first rekeying after compromise When users reconfirm the SAS Sending user message Confidentiality of keys Strong secrecy of messages Authenticity of messages and keys Forward secrecy (if keys can be erased) Deniability Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 14
18 SCimp v2: Progressive encryption Alice Server Bob pk B Bob? pk B genkeypairs(): (sk 0, pk 0 ), (sk a, pk a ) Z 0 = DH(sk 0, pk B ) ct = AES k0 (i 0, pt) pk 0, ct; hash(pk a ) (Temporary) keys derived from Z 0 From here on: regular key negotiation in parallel to user messages Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 15
19 Proverif results for SCimp v2 Progressive encryption Confidentiality/authenticity of first message Confidentiality/authenticity of all messages and keys (after SAS) Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 16
20 SCimp ProVerif reports that the initial message of SCimp v2 is not confidential This does not impact SCimp v1 But, ProVerif also verifies that users can detect this when confirming the SAS later To determine the impact of this vulnerability, we had to look at the source code Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 17
21 SCimp ProVerif reports that the initial message of SCimp v2 is not confidential This does not impact SCimp v1 But, ProVerif also verifies that users can detect this when confirming the SAS later To determine the impact of this vulnerability, we had to look at the source code We, that means Sebastian. Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 17
22 SCimp Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 18
23 SCimp A short example to give a flavor of the code u n s i g n e d l o n g c t x S t r L e n = 0 ; s i z e t kdklen ; i n t keylen = s c S C i m p C i p h e r B i t s ( c t x >c i p h e r S u i t e ) ; ctxstrlen length in bytes (computing function returns size t) kdklen length in bytes keylen function name suggests bit-length, but k snd is 2 keylen bits long Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 19
24 Stealth MitM in SCimp Each message has a plaintext tag identifying the type: keying message; or user message The adversary can block the key negotiation using just this tag, thereby having set up a succesful MitM The vigilant user might detect this Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 20
25 Stealth MitM in SCimp Each message has a plaintext tag identifying the type: keying message; or user message The adversary can block the key negotiation using just this tag, thereby having set up a succesful MitM The vigilant user might detect this But the code contains another bug: the receiver overreacts when a keying message is received out of order Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 20
26 Stealth MitM in SCimp Each message has a plaintext tag identifying the type: keying message; or user message The adversary can block the key negotiation using just this tag, thereby having set up a succesful MitM The vigilant user might detect this But the code contains another bug: the receiver overreacts when a keying message is received out of order only the message tag is inspected the receiver deletes all local key material thereby annulling any security set up in the past The adversary can desynchronize any secure session with a single out-of-order key message and set up a MitM undetected Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 20
27 More on SCimp Other discrepancies between the model and the implementation Group messages have a single symmetric key Relies on trust in the SC server Subject to a trivial MitM attack CCM-mode implementation did not validate authentication tags Problem in LibTomCrypt (fixed) Code contains many timing side-channel vulnerabilities The message parsing queue has a race condition Unchecked function error codes Including memory allocations State machine based design: good coding style and helps in making a model of the code in case of SCimp: helps find where specs and code differ seemed to have been an add on state matchine not actually used in SCimp implementation Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 21
28 More on SCimp extra features SCimp file transfer Convergent encryption key = hash(file) send as SCimp message ciphertext = AES CCM key (file) upload to cloud Known vulnerabilities of CE: confirmation of a file learn the remaining information Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 22
29 More on SCimp extra features SCimp file transfer Convergent encryption key = hash(file) send as SCimp message ciphertext = AES CCM key (file) upload to cloud Known vulnerabilities of CE: confirmation of a file learn the remaining information SCimp: receiver does not check hash(file) = key file injection attack Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 22
30 More on SCimp extra features SCimp file transfer Convergent encryption key = hash(file) send as SCimp message ciphertext = AES CCM key (file) upload to cloud Known vulnerabilities of CE: confirmation of a file learn the remaining information SCimp: receiver does not check hash(file) = key file injection attack This attack remained in the code until July 2016, independent of the upgrade of the messaging protocol Other features, e.g., group messaging, usually fewer security guarantees. Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 22
31 Further reading Sebastian s homepage including tutorial given at ShmooCon: ProVerif models are available: Sebastian s thesis about SCimp: Preprint about SCimp: Get Signal (Android/iPhone): Try OMEMO (on Android): OMEMO audit report (by Sebastian): Sebastian R. Verschoor and Tanja Lange (In-)secure messaging with SCimp 23
Cryptography. Andreas Hülsing. 6 September 2016
Cryptography Andreas Hülsing 6 September 2016 1 / 21 Announcements Homepage: http: //www.hyperelliptic.org/tanja/teaching/crypto16/ Lecture is recorded First row might be on recordings. Anything organizational:
Tungsten Security Whitepaper
Tungsten Labs UG (haftungsbeschränkt) Email: contact@tungsten-labs.com Web: http://tungsten-labs.com Monbijouplatz 5, 10178 Berlin Tungsten Security Whitepaper Berlin, May 2018 Version 1 Contents Introduction
SECURE COMMUNICATIONS: PAST, PRESENT, FUTURE
SECURE COMMUNICATIONS: PAST, PRESENT, FUTURE Jean-Philippe Aumasson P U B L I C THE SPEAKER PhD in cryptography from EPFL & FHNW, 2009 Principal Cryptographer at Kudelski Security Designed popular algorithms:
WhatsApp Encryption Overview. Technical white paper
WhatsApp Encryption Overview Technical white paper July 6, 2017 Originally published April 5, 2016 Contents Introduction................................... 3 Terms......................................
Encrypted Data Deduplication in Cloud Storage
Encrypted Data Deduplication in Cloud Storage Chun- I Fan, Shi- Yuan Huang, Wen- Che Hsu Department of Computer Science and Engineering Na>onal Sun Yat- sen University Kaohsiung, Taiwan AsiaJCIS 2015 Outline
Man in the middle attack on TextSecure Signal. David Wind IT SeCX 2015
Man in the middle attack on TextSecure Signal David Wind IT SeCX 2015 $ whoami David Wind Information Security Master student @ University of Applied Science St. Pölten Working for XSEC infosec GmbH since
Pretty Good Privacy (PGP)
Pretty Good Privacy (PGP) -- PGP services -- PGP key management (c) Levente Buttyán (buttyan@crysys.hu) What is PGP? general purpose application to protect (encrypt and/or sign) files can be used to protect
Lecture 9a: Secure Sockets Layer (SSL) March, 2004
Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Security Achieved by
Crypto Background & Concepts SGX Software Attestation
CSE 5095 & ECE 4451 & ECE 5451 Spring 2017 Lecture 4b Slide deck extracted from Kamran s tutorial on SGX, presented during ECE 6095 Spring 2017 on Secure Computation and Storage, a precursor to this course
TLS1.2 IS DEAD BE READY FOR TLS1.3
TLS1.2 IS DEAD BE READY FOR TLS1.3 28 March 2017 Enterprise Architecture Technology & Operations Presenter Photo Motaz Alturayef Jubial Cyber Security Conference 70% Privacy and security concerns are
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 11 October 4, 2017 CPSC 467, Lecture 11 1/39 ElGamal Cryptosystem Message Integrity and Authenticity Message authentication codes
Cryptography III. Public-Key Cryptography Digital Signatures. 2/1/18 Cryptography III
Cryptography III Public-Key Cryptography Digital Signatures 2/1/18 Cryptography III 1 Public Key Cryptography 2/1/18 Cryptography III 2 Key pair Public key: shared with everyone Secret key: kept secret,
HPE Secur & HPE Secur Cloud
HPE SecureMail & HPE SecureMail Cloud Product Lifecycle Status October 27, 207 207 HPE Security - Data Security INTRODUCTION HPE SecureMail Product Lifecycle Status The Product Lifecycle Status lists the
Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
CSE 127: Computer Security Cryptography. Kirill Levchenko
CSE 127: Computer Security Cryptography Kirill Levchenko October 24, 2017 Motivation Two parties want to communicate securely Secrecy: No one else can read messages Integrity: messages cannot be modified
Introduction. CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell
Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell 1 Cryptography Merriam-Webster Online Dictionary: 1. secret writing 2. the enciphering and deciphering
Viber Encryption Overview
Introduction Terms Preparations for Session Setup Secure Session Setup Exchanging Messages Encrypted Calls Photo, Video and File Sharing Secure Groups Secondary Device Registration Authentication Viber
UNIT - IV Cryptographic Hash Function 31.1
UNIT - IV Cryptographic Hash Function 31.1 31-11 SECURITY SERVICES Network security can provide five services. Four of these services are related to the message exchanged using the network. The fifth service
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.1 Introduction to Cryptography CSC 474/574 By Dr. Peng Ning 1 Cryptography Cryptography Original meaning: The art of secret writing Becoming a science that
Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
A Remote Biometric Authentication Protocol for Online Banking
International Journal of Electrical Energy, Vol. 1, No. 4, December 2013 A Remote Biometric Authentication Protocol for Online Banking Anongporn Salaiwarakul Department of Computer Science and Information
Chapter 8 Network Security
Chapter 8 Network Security A note on the use of these ppt slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you can add, modify, and
L13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
Cryptography (cont.)
CSE 484 / CSE M 584 (Autumn 2011) Cryptography (cont.) Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others
CSE484 Final Study Guide
CSE484 Final Study Guide Winter 2013 NOTE: This study guide presents a list of ideas and topics that the TAs find useful to know, and may not represent all the topics that could appear on the final exam.
Decentralised Communication: The challenge of balancing interoperability and privacy.
Decentralised Communication: The challenge of balancing interoperability and privacy. matthew@matrix.org http://www.matrix.org Privacy in Matrix 2 Two basic types of privacy: 1. Can attackers see what
AoT: Authentication and Access Control for the Entire IoT Device Life-Cycle
AoT: Authentication and Access Control for the Entire IoT Device Life-Cycle Noura Alomar November 7th, 2018 1 AoT The AoT paper is one of the earliest and most cited papers on IoT defense and it considers
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
Protocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh
Protocols II Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 17th February 2011 Outline Introduction Shared-key Authentication Asymmetric authentication protocols
Lecture 6: Symmetric Cryptography. CS 5430 February 21, 2018
Lecture 6: Symmetric Cryptography CS 5430 February 21, 2018 The Big Picture Thus Far Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures.
Introduction to Cryptography (cont.)
CSE 484 / CSE M 584 (Autumn 2011) Introduction to Cryptography (cont.) Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee,
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives
Foundations of Cryptography CS Shweta Agrawal
Foundations of Cryptography CS 6111 Shweta Agrawal Course Information 4-5 homeworks (20% total) A midsem (25%) A major (35%) A project (20%) Attendance required as per institute policy Challenge questions
Feedback Week 4 - Problem Set
4/26/13 Homework Feedback Introduction to Cryptography Feedback Week 4 - Problem Set You submitted this homework on Mon 17 Dec 2012 11:40 PM GMT +0000. You got a score of 10.00 out of 10.00. Question 1
Programming Project #1
CS255: Cryptography and Computer Security Winter 2008 Due: Friday, February 8th, 2008. Programming Project #1 1 Overview For the first programming assignment you will be implementing a password manager,
Authenticated Encryption in TLS
Authenticated Encryption in TLS Same modelling & verification approach concrete security: each lossy step documented by a game and a reduction (or an assumption) on paper Standardized complications - multiple
Introduction and Overview. Why CSCI 454/554?
Introduction and Overview CSCI 454/554 Why CSCI 454/554? Get Credits and Graduate Security is important More job opportunities More research funds 1 Workload Five homework assignments Two exams (open book
Crypto meets Web Security: Certificates and SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Crypto meets Web Security: Certificates and SSL/TLS Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Lecture 15 PKI & Authenticated Key Exchange. COSC-260 Codes and Ciphers Adam O Neill Adapted from
Lecture 15 PKI & Authenticated Key Exchange COSC-260 Codes and Ciphers Adam O Neill Adapted from http://cseweb.ucsd.edu/~mihir/cse107/ Today We will see how signatures are used to create public-key infrastructures
Cryptographic hash functions and MACs
Cryptographic hash functions and MACs Myrto Arapinis School of Informatics University of Edinburgh October 05, 2017 1 / 21 Introduction Encryption confidentiality against eavesdropping 2 / 21 Introduction
Symmetric Cryptography
CSE 484 (Winter 2010) Symmetric Cryptography Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
Unit 8 Review. Secure your network! CS144, Stanford University
Unit 8 Review Secure your network! 1 Basic Problem Internet To first approximation, attackers control the network Can snoop, replay, suppress, send How do we defend against this? Communicate securely despite
APNIC elearning: Cryptography Basics
APNIC elearning: Cryptography Basics 27 MAY 2015 03:00 PM AEST Brisbane (UTC+10) Issue Date: Revision: Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security
Cryptography CS 555. Topic 16: Key Management and The Need for Public Key Cryptography. CS555 Spring 2012/Topic 16 1
Cryptography CS 555 Topic 16: Key Management and The Need for Public Key Cryptography CS555 Spring 2012/Topic 16 1 Outline and Readings Outline Private key management between two parties Key management
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu Thanks
CS 494/594 Computer and Network Security
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Real-Time Communication Security Network layers
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 20 th November 2017 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
Encryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
Amorphic Encryption. Egger Mielberg
Amorphic Encryption Egger Mielberg egger.mielberg@gmail.com 27.01.2019 Abstract. As a symmetric as an asymmetric scheme requires a key (session or private) to be hidden. In this case, an attacker gets
SSL/TLS & 3D Secure. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk SSL/TLS & 3DSec 1
SSL/TLS & 3D Secure CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk SSL/TLS & 3DSec 1 SSLv2 Brief History of SSL/TLS Released in 1995 with Netscape 1.1 Key generation algorithm
Real-time protocol. Chapter 16: Real-Time Communication Security
Chapter 16: Real-Time Communication Security Mohammad Almalag Dept. of Computer Science Old Dominion University Spring 2013 1 Real-time protocol Parties negotiate interactively (Mutual) Authentication
Cryptography Introduction
Cryptography Introduction Last Updated: Aug 20, 2013 Terminology Access Control o Authentication Assurance that entities are who they claim to be o Authorization Assurance that entities have permission
Cryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology
Cryptography & Key Exchange Protocols Faculty of Computer Science & Engineering HCMC University of Technology Outline 1 Cryptography-related concepts 2 3 4 5 6 7 Key channel for symmetric cryptosystems
Distributed Systems. 26. Cryptographic Systems: An Introduction. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 26. Cryptographic Systems: An Introduction Paul Krzyzanowski Rutgers University Fall 2015 1 Cryptography Security Cryptography may be a component of a secure system Adding cryptography
Auth. Key Exchange. Dan Boneh
Auth. Key Exchange Review: key exchange Alice and want to generate a secret key Saw key exchange secure against eavesdropping Alice k eavesdropper?? k This lecture: Authenticated Key Exchange (AKE) key
ECEN 5022 Cryptography
Introduction University of Colorado Spring 2008 Historically, cryptography is the science and study of secret writing (Greek: kryptos = hidden, graphein = to write). Modern cryptography also includes such
Cryptographic Concepts
Outline Identify the different types of cryptography Learn about current cryptographic methods Chapter #23: Cryptography Understand how cryptography is applied for security Given a scenario, utilize general
Modern cryptography 2. CSCI 470: Web Science Keith Vertanen
Modern cryptography 2 CSCI 470: Web Science Keith Vertanen Modern cryptography Overview Asymmetric cryptography Diffie-Hellman key exchange (last time) Pubic key: RSA Pretty Good Privacy (PGP) Digital
PROVING WHO YOU ARE TLS & THE PKI
PROVING WHO YOU ARE TLS & THE PKI CMSC 414 MAR 29 2018 RECALL OUR PROBLEM WITH DIFFIE-HELLMAN The two communicating parties thought, but did not confirm, that they were talking to one another. Therefore,
Cryptographic Systems
CPSC 426/526 Cryptographic Systems Ennan Zhai Computer Science Department Yale University Recall: Lec-10 In lec-10, we learned: - Consistency models - Two-phase commit - Consensus - Paxos Lecture Roadmap
Cryptography CS 555. Topic 1: Course Overview & What is Cryptography
Cryptography CS 555 Topic 1: Course Overview & What is Cryptography 1 Administrative Note Professor Blocki is traveling and will be back on Wednesday. E-mail: jblocki@purdue.edu Thanks to Professor Spafford
Randomness Extractors. Secure Communication in Practice. Lecture 17
Randomness Extractors. Secure Communication in Practice Lecture 17 11:00-12:30 What is MPC? Manoj Monday 2:00-3:00 Zero Knowledge Muthu 3:30-5:00 Garbled Circuits Arpita Yuval Ishai Technion & UCLA 9:00-10:30
Authenticating People and Machines over Insecure Networks
Authenticating People and Machines over Insecure Networks EECE 571B Computer Security Konstantin Beznosov authenticating people objective Alice The Internet Bob Password= sesame Password= sesame! authenticate
Designing a Secret Handshake: Authenticated Key Exchange as a Capability System
Designing a Secret Handshake: Authenticated Key Exchange as a Capability System Dominic Tarr July 10, 2015 Abstract Capability Based Security is a conceptual framework for designing decentralized access
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Computer Networking. What is network security? Chapter 7: Network security. Symmetric key cryptography. The language of cryptography
Chapter 7: Network security 15-441 Computer Networking Network Security: Cryptography, Authentication, Integrity Foundations: what is security? cryptography authentication message integrity key distribution
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu
CSE 3461/5461: Introduction to Computer Networking and Internet Technologies. Network Security. Presentation L
CS 3461/5461: Introduction to Computer Networking and Internet Technologies Network Security Study: 21.1 21.5 Kannan Srinivasan 11-27-2012 Security Attacks, Services and Mechanisms Security Attack: Any
A User Study of Off-the-Record Messaging
A User Study of Off-the-Record Messaging Ryan Stedman Kayo Yoshida Ian Goldberg University of Waterloo 200 University Avenue West Waterloo, Ontario, Canada N2L 3G1 {rstedman@cs,k2yoshid@math,iang@cs}.uwaterloo.ca
CIS 6930/4930 Computer and Network Security. Topic 6.2 Authentication Protocols
CIS 6930/4930 Computer and Network Security Topic 6.2 Authentication Protocols 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake. Authenticate
CS 161 Computer Security
Raluca Popa Spring 2018 CS 161 Computer Security Homework 2 Due: Wednesday, February 14, at 11:59pm Instructions. This homework is due Wednesday, February 14, at 11:59pm. No late homeworks will be accepted.
Network Security Essentials
Network Security Essentials Applications and Standards Third Edition William Stallings Chapter 2 Symmetric Encryption and Message Confidentiality Dr. BHARGAVI H. GOSWAMI Department of Computer Science
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 2 Cryptographic Tools First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Cryptographic Tools cryptographic algorithms
Noise Protocol Framework. Trevor Perrin
Noise Protocol Framework Trevor Perrin Cryptography Public Key (DH, RSA, ECC etc) Symmetric Key (AES etc) AKE Authenticated Key Exchange (or Agreement) Goals Shared symmetric key Authentication Forward
Cryptography (Overview)
Cryptography (Overview) Some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) Modern secret key cryptography DES, AES Public key cryptography RSA, digital signatures Cryptography
Cristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.
CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How
Progressive Authentication in ios
Progressive Authentication in ios Genghis Chau, Denis Plotnikov, Edwin Zhang December 12 th, 2014 1 Overview In today s increasingly mobile-centric world, more people are beginning to use their smartphones
CS408 Cryptography & Internet Security
CS408 Cryptography & Internet Security Lecture 18: Cryptographic hash functions, Message authentication codes Functions Definition Given two sets, X and Y, a function f : X Y (from set X to set Y), is
(More) cryptographic protocols
(More) cryptographic protocols Myrto Arapinis School of Informatics University of Edinburgh October 19, 2017 1/24 Authentication and key agreement protocols 2/24 Authentication and key agreement Long-term
Key Establishment and Authentication Protocols EECE 412
Key Establishment and Authentication Protocols EECE 412 1 where we are Protection Authorization Accountability Availability Access Control Data Protection Audit Non- Repudiation Authentication Cryptography
Homework 1 CS161 Computer Security, Spring 2008 Assigned 2/4/08 Due 2/13/08
Homework 1 CS161 Computer Security, Spring 2008 Assigned 2/4/08 Due 2/13/08 This homework assignment is due Wednesday, February 13 at the beginning of lecture. Please bring a hard copy to class; either
Chapter 4: Securing TCP connections
Managing and Securing Computer Networks Guy Leduc Chapter 5: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
Goals of Modern Cryptography
Goals of Modern Cryptography Providing information security: Data Privacy Data Integrity and Authenticity in various computational settings. Data Privacy M Alice Bob The goal is to ensure that the adversary
Symmetric Crypto MAC. Pierre-Alain Fouque
Symmetric Crypto MAC Pierre-Alain Fouque Message Authentication Code (MAC) Warning: Encryption does not provide integrity Eg: CTR mode ensures confidentiality if the blockcipher used is secure. However,
Verifying Real-World Security Protocols from finding attacks to proving security theorems
Verifying Real-World Security Protocols from finding attacks to proving security theorems Karthik Bhargavan http://prosecco.inria.fr + many co-authors at INRIA, Microsoft Research, Formal security analysis
Secure Multiparty Computation
Secure Multiparty Computation Li Xiong CS573 Data Privacy and Security Outline Secure multiparty computation Problem and security definitions Basic cryptographic tools and general constructions Yao s Millionnare
Lecture 02: Historical Encryption Schemes. Lecture 02: Historical Encryption Schemes
What is Encryption Parties involved: Alice: The Sender Bob: The Receiver Eve: The Eavesdropper Aim of Encryption Alice wants to send a message to Bob The message should remain hidden from Eve What distinguishes
A robust smart card-based anonymous user authentication protocol for wireless communications
University of Wollongong Research Online Faculty of Engineering and Information Sciences - Papers: Part A Faculty of Engineering and Information Sciences 2014 A robust smart card-based anonymous user authentication
Formal Verification of the WireGuard Protocol
Formal Verification of the WireGuard Protocol www.wireguard.com Jason A. Donenfeld jason@zx2c4.com Kevin Milner Oxford University kevin.milner@cs.ox.ac.uk Draft Revision Abstract WireGuard, the secure
Improvements of an XMPP API for the use in distributed pair programming
Improvements of an XMPP API for the use in distributed pair programming Diploma Thesis by Henning Staib Tutor: Karl Beecher and Stephan Salinger Overview What is Smack? How is Smack used in Saros? Problems
Introduction to Cryptography. Ramki Thurimella
Introduction to Cryptography Ramki Thurimella Encryption & Decryption 2 Generic Setting 3 Kerckhoff s Principle Security of the encryption scheme must depend only on The secret key NOT on the secrecy of
CS 6324: Information Security More Info on Key Establishment: RSA, DH & QKD
ERIK JONSSON SCHOOL OF ENGINEERING & COMPUTER SCIENCE Cyber Security Research and Education Institute CS 6324: Information Security Dr. Junia Valente Department of Computer Science The University of Texas
Computer Security. 10. Exam 2 Review. Paul Krzyzanowski. Rutgers University. Spring 2017
Computer Security 10. Exam 2 Review Paul Krzyzanowski Rutgers University Spring 2017 March 23, 2018 CS 419 2017 Paul Krzyzanowski 1 Question 1(a) Suppose you come across some old text in the form GEPPQ
Anonymity. Assumption: If we know IP address, we know identity
03--4 Anonymity Some degree of anonymity from using pseudonyms However, anonymity is always limited by address TCP will reveal your address address together with ISP cooperation Anonymity is broken We
CS Paul Krzyzanowski
Question 1 Explain why hypervisor rootkits are more difficult to detect than user-mode or kernel-mode rootkits. Computer Security 2018 Exam 2 Review Paul Krzyzanowski Rutgers University Spring 2018 The
Computer Security Exam 2 Review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 2018 Exam 2 Review Paul Krzyzanowski Rutgers University Spring 2018 April 16, 2018 CS 419 2018 Paul Krzyzanowski 1 Question 1 Explain why hypervisor rootkits are more difficult to detect
Garantía y Seguridad en Sistemas y Redes
Garantía y Seguridad en Sistemas y Redes Tema 2. Cryptographic Tools Esteban Stafford Departamento de Ingeniería Informá2ca y Electrónica Este tema se publica bajo Licencia: Crea2ve Commons BY- NC- SA
Improved KRACK Attacks Against WPA2 Implementations. Mathy OPCDE, Dubai, 7 April 2018
Improved KRACK Attacks Against WPA2 Implementations Mathy Vanhoef @vanhoefm OPCDE, Dubai, 7 April 2018 Overview Key reinstalls in 4-way handshake New KRACKs Practical impact Lessons learned 2 Overview
Ref:
Cryptography & digital signature Dec. 2013 Ref: http://cis.poly.edu/~ross/ 2 Cryptography Overview Symmetric Key Cryptography Public Key Cryptography Message integrity and digital signatures References: