Preventing Attackers From Using Verifiers: A-PAKE With PK-Id
|
|
|
- Martina O’Neal’
- 6 years ago
- Views:
Transcription
1 Preventing Attackers From Using Verifiers: A-PAKE With PK-Id Sean Parkinson RSA, The Security Division of EMC Session ID: ARCH R02 Session Classification: Advanced
2 Outline Introduction A-PAKE with PK-Id Alternatives and Trade-offs Conclusions
3 Introduction
4 Problem Domain
5 Authentication Server to User User to Server
6 Attacker: Man-in-the-Middle Steal password database Create a fake server certificate Create a fake client certificate
7 Server Authentication Authenticating a computer Certificate and Private Key
8 User Authentication Authenticating a person User Certificate and Private Key
9 User Authentication
10 Passwords in the Database Mechanism Form Security Clear password None Hash H(P) Depends on length of password Hash with Salt H(S, P) Depends on length of password Different sites, different value N*Hash with Salt H( H(S, P).)^ Longer to break Exponentiation g H(S,P) Brute force not practical ^ Password Based Key Derivation Function (PBKDF)
11 PAKE Password Authenticated Key Exchange Strong security from weak passwords Hash(Password)
12 A-PAKE Augmented Password Authenticated Key Exchange g H(S,I,P) Verifier
13 Vulnerability Change Password
14 A-PAKE with PK-Id: Aim New protocol that is standardized Easy identity management for User Secure storage of password on Server Without password Attacker cannot impersonate User or Server
15 A-PAKE with PK-Id
16 A-PAKE with PK-Id Verifier = g Hash(PK,S,I,P)
17 A-PAKE with PK-Id: General Identity Calculate Hash Shared Key Server Verified Anon Key Exchange Verification Messages Lookup Parameters User Parameters Shared Key Client Verified
18 1 A-PAKE with PK-Id: SRP-PK Identity Lookup Parameters Identity: Alice Anderson Salt = 0x Verifier = 0xa73b24
19 2 A-PAKE with PK-Id: SRP-PK Calculate Hash s = Salt I = Identity P = password x = Hash(PK, Hash(s, Hash(I, :,P)) s, User Parameters Salt = 0x PK = 0xf389da
20 A-PAKE with PK-Id: SRP-PK 3 Shared Key Anon Key Exchange Shared Key A = g a Verify(PK, sig, s, g, N, B) B = kv + g b sig = Sign(PrivK, s, g, N, B) v= Verifier a,b = random k = Hash(N,g)
21 A-PAKE Scheme: SRP-PK 3 Shared Key Anon Key Exchange Shared Key u= Hash(A,B) u= Hash(A,B) S = (B kg x ) a+ux S = (Av u ) b K = Hash(S) K = Hash(S) k = Hash(N,g)
22 A-PAKE with PK-Id: SRP-PK 4 Server Verified Verification Messages Client Verified M 1 = Hash(Hash(N) Hash(g),Hash(I),s,A,B,K) M 1 (verify M 2 ) (verify M 1 ) M 2 = Hash(A,M 1,K)
23 A-PAKE with PK-Id: Security Server signs with the private key Provides proof of ownership Salt is unique to each user and B is random Different signature generated in each handshake If Man-in-the-Middle replays previously signed B Private random, b, unknown b is required to complete the handshake If Man-in-the-Middle uses a fake certificate Public key used in verifier Different keys results in different verifiers
24 A-PAKE with PK-Id: Optional If A sent in clear No security issue Client encrypts A A is random Different message generated in each handshake Advantage Server knows Client is using the public key Client used the public key in verifier
25 TLS with SRP RFC 5054: Informational only Experimental Implementations Server certificate optional
26 TLS with SRP-PK 1 Client Hello Identity (TLS Ext): Alice Anderson
27 TLS with SRP-PK 2 From Server s Certificate x = Hash(s, Hash(PK, s, Hash(I, :,P)) Server Certificate Server Key Exchange Server s Cert Chain s=0x12,n=0xf9 g=0x02,b=0x91 Signed
28 TLS with SRP-PK 3 Client Key Exchange A = 0x8617E3
29 A-PAKE-PK with Stored PK Public Key Verifier No certificate No chain verification [Encrypt A]
30 Alternatives and Trade-offs
31 Alternative: Client Certificate Difficult to create/use/deploy Many non-technical users Only useable on a device with private key Separately issued device Difficult to verify Chain verification on server Hash lookup in LDAP CRLs and OCSP Hackers can create fake certificates
32 Architecture: User Auth in TLS Separation of Layers Which service or website needs authentication? Single authentication domain per server TLS Server requires access to Password store Certificate verification infrastructure
33 Trade-offs: Protocol Timing Protocol Client Server Round trips SRP 3DH 3DH 3 SRP PK 3DH+1RSA+Cert Chain 3DH+1RSA 3 TLS SRP 3DH(+1RSA+Cert 3DH(+1RSA) 2 Chain) TLS SRP PK 3DH+1RSA+Cert Chain 3DH+1RSA 2 Secure against Server Impersonation
34 Trade-offs: Protocol Timing Protocol Client Server Round trips SRP 3DH 3DH 3 SRP PK 3DH+1RSA+Cert Chain 3DH+1RSA 3 TLS SRP 3DH(+1RSA+Cert 3DH(+1RSA) 2 Chain) TLS SRP PK 3DH+1RSA+Cert Chain 3DH+1RSA 2 TLS Client Auth 2RSA+Cert Chain 2RSA+Cert Chain 2 (RSA) TLS Client Auth (DHE RSA) 2DH+2RSA+Cert Chain 2DH+2RSA+Cert Chain 2 3 Diffie-Hellman + 1 RSA Sign 1 RSA Vfy & Dec + Cert Chain 2 DH + 1 RSA Sign & Vfy + Cert Chain
35 Trade-offs: Protocol Timing 3xDH for 1xRSA Public + Chain Vfy Protocol Client Server Round trips SRP 3DH 3DH 3 SRP PK 3DH+1RSA+Cert Chain 3DH+1RSA 3 TLS SRP 3DH(+1RSA+Cert 3DH(+1RSA) 2 Chain) TLS SRP PK 3DH+1RSA+Cert Chain 3DH+1RSA 2 TLS Client Auth 2RSA+Cert Chain 2RSA+Cert Chain 2 (RSA) TLS Client Auth (DHE RSA) 2DH+2RSA+Cert Chain 2DH+2RSA+Cert Chain 2 1xDH for 1xRSA Public + Chain Vfy
36 Trade-offs: Password/Certificate Issue Password Client Certificate Cert on Token Sensitive Data Safety Attacks Social engineering Computer compromise Certificate Expiration Reused Unique Physically secure Reset password (overlap period) User gets new certificate issued Steal token (and passcode) Update token or get new token
37 Conclusions
38 User Authentication Options Mechanism Attack Speed Management Hashed Password Pre generated values Fastest Simplest Salted Hashed Password Salted Multi Hashed Password Brute force Faster Simpler Brute force (Slower) Fast Simpler Verifier Server impersonation Slow Simple Verifier PK Id Secure Slower Simple Client Certificate Secure (Fake certs) Slowest Difficult
39 TLS Protocol Comparison Protocol Client Server Security TLS A PAKE PK 3DH+1RSA +Cert Chain 3DH+1RSA Protocol secure from Attacker. User must protect password. TLS Client Auth (RSA) 2RSA +Cert Chain 2RSA +Cert Chain Only as secure as the Certificate. Lifetime of certificate. TLS Client Auth (DHE RSA) 2DH+1RSA +Cert Chain 2DH+1RSA +Cert Chain Only as secure as the Certificate.
40 A-PAKE-PK Verifier = g H(PK,S,I,P)
41 Standards TLS IPsec SSH
42
43 Thank you! Sean Parkinson RSA, The Security Division of EMC
44 TLS with AugPAKE IETF Draft - draft-shin-tls-augpake-01 Augmented Password-Authenticated Key Exchange for Transport Layer Security (TLS) Expires: March 08, 2014 No Server Certificate message Verifier W = g w mod p where w is password or W = g w mod p where w = H (0x00 U S w)
45 TLS with AugPAKE-PK Add Server Certificate message Verifier W = g w mod p where w = H (0x00 U S PK w) Alternatively replace server identity with public key Server Key Exchange Message Y is signed
46 A-EKE-PK Server sends public key with identity and cryptographic algorithm proposal Client hashes password + public key and calculates verifier Client calculates C based on verifier Server sends E B and signature of E B Client verifies E B Client sends encrypted E A and EP A Server decrypts E A and EP A with private key
47 B-SPEKE-PK Server sends public key and signature of (g, p, Q B, U) Client verifies signature Client hashes password + salt and public key Client sends encrypted Q A Server decrypts Q A with private key
48 SSH with SRP IETF Draft draft-nisse-secsh-srp-01 Expired in September 2001 Adds SRP to Transport Layer Protocol Defines new Key Exchange messages Verifier v = g x where x = Hash(s, Hash(I : P))
49 SSH and SRP-PK Server sends RSA Public key Verifier v = g x where x = Hash(Pub, s, Hash(I : P))
50 IPsec with A-PAKE Internet Key Exchange Protocol Version 2 (IKEv2) RFC 5996 Key exchange protocol performs mutual authentication Server sends certificate that client uses to verify authentication fields Extensible Authentication Protocol (EAP) Framework for implementing authentication mechanisms A-EKE (RFC 6124) and SRP (expired draft)
51 IPsec EAP-EKE-PK Server must supply a certificate during authentication Server has proven ownership of private key Verifier P = prf(0+, password salt pub)
Password. authentication through passwords
Password authentication through passwords Human beings Short keys; possibly used to generate longer keys Dictionary attack: adversary tries more common keys (easy with a large set of users) Trojan horse
Understand the TLS handshake Understand client/server authentication in TLS. Understand session resumption Understand the limitations of TLS
Last Updated: Oct 31, 2017 Understand the TLS handshake Understand client/server authentication in TLS RSA key exchange DHE key exchange Explain certificate ownership proofs in detail What cryptographic
for Compound Authentication
Verified Contributive Channel Bindings for Compound Authentication Antoine Delignat-Lavaud, Inria Paris Joint work with Karthikeyan Bhargavan and Alfredo Pironti Motivation: Authentication Composition
Strong Password Protocols
Strong Password Protocols Strong Password Protocols Password authentication over a network Transmit password in the clear. Open to password sniffing. Open to impersonation of server. Do Diffie-Hellman
Real-time protocol. Chapter 16: Real-Time Communication Security
Chapter 16: Real-Time Communication Security Mohammad Almalag Dept. of Computer Science Old Dominion University Spring 2013 1 Real-time protocol Parties negotiate interactively (Mutual) Authentication
L13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
Authentication. Strong Password Protocol. IT352 Network Security Najwa AlGhamdi
Authentication Strong Password Protocol 1 Strong Password Protocol Scenario : Alice uses any workstation to log to the server B, using a password to authenticate her self. Various way to do that? Use Ur
MTAT Applied Cryptography
MTAT.07.017 Applied Cryptography Transport Layer Security (TLS) Advanced Features University of Tartu Spring 2016 1 / 16 Client Server Authenticated TLS ClientHello ServerHello, Certificate, ServerHelloDone
Auth. Key Exchange. Dan Boneh
Auth. Key Exchange Review: key exchange Alice and want to generate a secret key Saw key exchange secure against eavesdropping Alice k eavesdropper?? k This lecture: Authenticated Key Exchange (AKE) key
SSL/TLS & 3D Secure. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk SSL/TLS & 3DSec 1
SSL/TLS & 3D Secure CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk SSL/TLS & 3DSec 1 SSLv2 Brief History of SSL/TLS Released in 1995 with Netscape 1.1 Key generation algorithm
Lecture 15 PKI & Authenticated Key Exchange. COSC-260 Codes and Ciphers Adam O Neill Adapted from
Lecture 15 PKI & Authenticated Key Exchange COSC-260 Codes and Ciphers Adam O Neill Adapted from http://cseweb.ucsd.edu/~mihir/cse107/ Today We will see how signatures are used to create public-key infrastructures
CS 494/594 Computer and Network Security
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Real-Time Communication Security Network layers
Cristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.
CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How
Lecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall Nitesh Saxena
Lecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall 2009 Nitesh Saxena *Adopted from a previous lecture by Gene Tsudik Course Admin HW3 Problem 3 due Friday midnight
Proceedings of the 10 th USENIX Security Symposium
USENIX Association Proceedings of the 10 th USENIX Security Symposium Washington, D.C., USA August 13 17, 2001 THE ADVANCED COMPUTING SYSTEMS ASSOCIATION 2001 by The USENIX Association All Rights Reserved
1.264 Lecture 28. Cryptography: Asymmetric keys
1.264 Lecture 28 Cryptography: Asymmetric keys Next class: Anderson chapters 20. Exercise due before class (Reading doesn t cover same topics as lecture) 1 Asymmetric or public key encryption Receiver
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
CSC/ECE 774 Advanced Network Security
Computer Science CSC/ECE 774 Advanced Network Security Topic 2. Network Security Primitives CSC/ECE 774 Dr. Peng Ning 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange;
Password Authenticated Key Exchange by Juggling
A key exchange protocol without PKI Feng Hao Centre for Computational Science University College London Security Protocols Workshop 08 Outline 1 Introduction 2 Related work 3 Our Solution 4 Evaluation
Alice in Cyber world
Alice in Cyber world Protecting Secrets in The Connected World K.S.Sreedharan Director IT Zoho Cast Alice Claude Eve Bob Govan Story So Far Symmetric Key Asymmetric Key Twist in the Tale Claude Convenience
Cryptographic Protocols 1
Cryptographic Protocols 1 Luke Anderson luke@lukeanderson.com.au 5 th May 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Problem with Diffie-Hellman 2.1 Session Hijacking 2.2 Encrypted Key Exchange
Key Agreement Schemes
Key Agreement Schemes CSG 252 Lecture 9 November 25, 2008 Riccardo Pucella Key Establishment Problem PK cryptosystems have advantages over SK cryptosystems PKCs do not need a secure channel to establish
Lecture 15 Public Key Distribution (certification)
0 < i < 2 n = N X i,y i random secret keys index i = random (secret) value Merkle s Puzzles (1974) Puzzle P i = {index i,x i,s} Y i S fixed string, e.g., " Alice to Bob" { P 0 < i < 2 i n } Pick random
Wireless LAN Security. Gabriel Clothier
Wireless LAN Security Gabriel Clothier Timeline 1997: 802.11 standard released 1999: 802.11b released, WEP proposed [1] 2003: WiFi alliance certifies for WPA 2004: 802.11i released 2005: 802.11w task group
Network Security: TLS/SSL. Tuomas Aura T Network security Aalto University, Nov-Dec 2010
Network Security: TLS/SSL Tuomas Aura T-110.5240 Network security Aalto University, Nov-Dec 2010 Outline 1. Diffie-Hellman 2. Key exchange using public-key encryption 3. Goals of authenticated key exchange
Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.
![Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.](/thumbs/84/91191448.jpg "Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.")
Lecture 13 Public Key Distribution (certification) 1 PK-based Needham-Schroeder TTP 1. A, B 4. B, A 2. {PKb, B}SKT B}SKs 5. {PK a, A} SKT SKs A 3. [N a, A] PKb 6. [N a, N b ] PKa B 7. [N b ] PKb Here,
Public-Key Infrastructure NETS E2008
Public-Key Infrastructure NETS E2008 Many slides from Vitaly Shmatikov, UT Austin slide 1 Authenticity of Public Keys? private key Alice Bob public key Problem: How does Alice know that the public key
Lecture 6.2: Protocols - Authentication and Key Exchange II. CS 436/636/736 Spring Nitesh Saxena. Course Admin
Lecture 6.2: Protocols - Authentication and Key II CS 436/636/736 Spring 2012 Nitesh Saxena Mid-Term Grading Course Admin Will be done over the break Scores will be posted online and graded exams distribute
Digital Signatures. Public-Key Signatures. Arbitrated Signatures. Digital Signatures With Encryption. Terminology. Message Authentication Code (MAC)
Message Authentication Code (MAC) Key-dependent one-way hash function Only someone with a correct key can verify the hash value Easy way to turn one-way hash function into MAC is to encrypt hash value
Crypto meets Web Security: Certificates and SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Crypto meets Web Security: Certificates and SSL/TLS Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
CIS 6930/4930 Computer and Network Security. Topic 8.2 Internet Key Management
CIS 6930/4930 Computer and Network Security Topic 8.2 Internet Key Management 1 Key Management Why do we need Internet key management AH and ESP require encryption and authentication keys Process to negotiate
Encryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
Other Uses of Cryptography. Cryptography Goals. Basic Problem and Terminology. Other Uses of Cryptography. What Can Go Wrong? Why Do We Need a Key?
ryptography Goals Protect private communication in the public world and are shouting messages over a crowded room no one can understand what they are saying 1 Other Uses of ryptography Authentication should
Test 2 Review. 1. (10 points) Timestamps and nonces are both used in security protocols to prevent replay attacks.
Test 2 Review Name Student ID number Notation: {X} Bob Apply Bob s public key to X [Y ] Bob Apply Bob s private key to Y E(P, K) Encrypt P with symmetric key K D(C, K) Decrypt C with symmetric key K h(x)
Transport Layer Security
Cryptography and Security in Communication Networks Transport Layer Security ETTI - Master - Advanced Wireless Telecommunications Secure channels Secure data delivery on insecure networks Create a secure
Public-Key Cryptography. Professor Yanmin Gong Week 3: Sep. 7
Public-Key Cryptography Professor Yanmin Gong Week 3: Sep. 7 Outline Key exchange and Diffie-Hellman protocol Mathematical backgrounds for modular arithmetic RSA Digital Signatures Key management Problem:
Securing Internet Communication: TLS
Securing Internet Communication: TLS CS 161: Computer Security Prof. David Wagner March 11, 2016 Today s Lecture Applying crypto technology in practice Two simple abstractions cover 80% of the use cases
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Applied Cryptography and Computer Security CSE 664 Spring 2017
Applied Cryptography and Computer Security Lecture 18: Key Distribution and Agreement Department of Computer Science and Engineering University at Buffalo 1 Key Distribution Mechanisms Secret-key encryption
E-commerce security: SSL/TLS, SET and others. 4.1
E-commerce security: SSL/TLS, SET and others. 4.1 1 Electronic payment systems Purpose: facilitate the safe and secure transfer of monetary value electronically between multiple parties Participating parties:
Test 2 Review. (b) Give one significant advantage of a nonce over a timestamp.
Test 2 Review Name Student ID number Notation: {X} Bob Apply Bob s public key to X [Y ] Bob Apply Bob s private key to Y E(P, K) Encrypt P with symmetric key K D(C, K) Decrypt C with symmetric key K h(x)
Public Key Algorithms
Public Key Algorithms 1 Public Key Algorithms It is necessary to know some number theory to really understand how and why public key algorithms work Most of the public key algorithms are based on modular
CSC/ECE 574 Computer and Network Security. Outline. Key Management. Key Management. Internet Key Management. Why do we need Internet key management
Computer Science CSC/ECE 574 Computer and Network Security Topic 8.2 Internet Key Management CSC/ECE 574 Dr. Peng Ning 1 Outline Key Management Security Principles Internet Key Management Manual Exchange
Key Encryption as per T10/06-103
1 T10/06-144r0 Key Encryption as per T10/06-103 David L. Black (author) Jack Harwood (presenter) 2 Problem and Design Goals 05-446 only specifies encryption key transfer in clear Keys can be entirely too
Outline. Key Management. Security Principles. Security Principles (Cont d) Escrow Foilage Protection
Outline CSCI 454/554 Computer and Network Security Topic 8.2 Internet Key Management Key Management Security Principles Internet Key Management Manual Exchange SKIP Oakley ISAKMP IKE 2 Key Management Why
Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010
Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Photuris and SKIP PHASE 1 IKE PHASE 2 IKE How is SA established? How do parties negotiate
Outline. CSC/ECE 574 Computer and Network Security. Key Management. Security Principles. Security Principles (Cont d) Internet Key Management
Outline Computer Science CSC/ECE 574 Computer and Network Security Topic 8.2 Internet Key Management Key Management Security Principles Internet Key Management Manual Exchange SKIP Oakley ISAKMP IKE CSC/ECE
Outline. Key Management. CSCI 454/554 Computer and Network Security. Key Management
CSCI 454/554 Computer and Network Security Topic 8.2 Internet Key Management Key Management Outline Security Principles Internet Key Management Manual Exchange SKIP Oakley ISAKMP IKE 2 Key Management Why
Protecting TLS from Legacy Crypto
Protecting TLS from Legacy Crypto http://mitls.org Karthikeyan Bhargavan + many, many others. (INRIA, Microsoft Research, LORIA, IMDEA, Univ of Pennsylvania, Univ of Michigan, JHU) Popular cryptographic
CSCI 454/554 Computer and Network Security. Topic 8.2 Internet Key Management
CSCI 454/554 Computer and Network Security Topic 8.2 Internet Key Management Outline Key Management Security Principles Internet Key Management Manual Exchange SKIP Oakley ISAKMP IKE 2 Key Management Why
Public Key Algorithms
CSE597B: Special Topics in Network and Systems Security Public Key Cryptography Instructor: Sencun Zhu The Pennsylvania State University Public Key Algorithms Public key algorithms RSA: encryption and
Using SRP for TLS Authentication
Using SRP for TLS Authentication Internet Draft Transport Layer Security Working Group D. Taylor Forge Research Pty Ltd Expires: March 5, 2003 September 4, 2002 Using SRP for TLS Authentication draft-ietf-tls-srp-03
Authentication in Distributed Systems
Authentication in Distributed Systems Introduction Crypto transforms (communications) security problems into key management problems. To use encryption, digital signatures, or MACs, the parties involved
Network Security: TLS/SSL. Tuomas Aura T Network security Aalto University, Nov-Dec 2014
Network Security: TLS/SSL Tuomas Aura T-110.5241 Network security Aalto University, Nov-Dec 2014 Outline 1. Diffie-Hellman key exchange (recall from earlier) 2. Key exchange using public-key encryption
Protocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh
Protocols II Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 17th February 2011 Outline Introduction Shared-key Authentication Asymmetric authentication protocols
Proving who you are. Passwords and TLS
Proving who you are Passwords and TLS Basic, fundamental problem Client ( user ) How do you prove to someone that you are who you claim to be? Any system with access control must solve this Users and servers
EE 418 Network Security and Cryptography Lecture #18
EE 418 Network Security and Cryptography Lecture #18 December 6, 2016 Public Key Infrastructure. Authentication. Internet Security Lecture notes prepared by Professor Radha Poovendran. Tamara Bonaci Department
CIS 4360 Secure Computer Systems Applied Cryptography
CIS 4360 Secure Computer Systems Applied Cryptography Professor Qiang Zeng Spring 2017 Symmetric vs. Asymmetric Cryptography Symmetric cipher is much faster With asymmetric ciphers, you can post your Public
Total points: 71. Total time: 75 minutes. 9 problems over 7 pages. No book, notes, or calculator
CMSC 414 F08 Exam 1 Page 1 of 10 Name: Total points: 71. Total time: 75 minutes. 9 problems over 7 pages. No book, notes, or calculator 1. [14 points] a. Are n=221 and e=3 valid numbers for RSA. Explain.
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
Network Security Chapter 8
Network Security Chapter 8 Cryptography Symmetric-Key Algorithms Public-Key Algorithms Digital Signatures Management of Public Keys Communication Security Authentication Protocols Email Security Web Security
Verifying Real-World Security Protocols from finding attacks to proving security theorems
Verifying Real-World Security Protocols from finding attacks to proving security theorems Karthik Bhargavan http://prosecco.inria.fr + many co-authors at INRIA, Microsoft Research, Formal security analysis
Chapter 4: Securing TCP connections
Managing and Securing Computer Networks Guy Leduc Chapter 5: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Security Handshake Pitfalls
Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr 1 Cryptographic Authentication Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response
Internet security and privacy
Internet security and privacy IPsec 1 Layer 3 App. TCP/UDP IP L2 L1 2 Operating system layers App. TCP/UDP IP L2 L1 User process Kernel process Interface specific Socket API Device driver 3 IPsec Create
Summary on Crypto Primitives and Protocols
Summary on Crypto Primitives and Protocols Levente Buttyán CrySyS Lab, BME www.crysys.hu 2015 Levente Buttyán Basic model of cryptography sender key data ENCODING attacker e.g.: message spatial distance
Configuring SSH with x509 authentication on IOS devices
Configuring SSH with x509 authentication on IOS devices Contents Introduction Prerequisites Requirements Components Used Configure Network Diagram Deployment considerations Configurations (Optional) Integration
Authenticating People and Machines over Insecure Networks
Authenticating People and Machines over Insecure Networks EECE 571B Computer Security Konstantin Beznosov authenticating people objective Alice The Internet Bob Password= sesame Password= sesame! authenticate
CSCI 454/554 Computer and Network Security. Topic 5.2 Public Key Cryptography
CSCI 454/554 Computer and Network Security Topic 5.2 Public Key Cryptography Outline 1. Introduction 2. RSA 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard 2 Introduction Public Key Cryptography
CSC 5930/9010 Modern Cryptography: Public-Key Infrastructure
CSC 5930/9010 Modern Cryptography: Public-Key Infrastructure Professor Henry Carter Fall 2018 Recap Digital signatures provide message authenticity and integrity in the public-key setting As well as public
Network Security (NetSec)
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Network Security (NetSec) IN2101 WS 16/17 Prof. Dr.-Ing. Georg Carle Dr. Heiko Niedermayer Cornelius
Spring 2010: CS419 Computer Security
Spring 2010: CS419 Computer Security Vinod Ganapathy Lecture 7 Topic: Key exchange protocols Material: Class handout (lecture7_handout.pdf) Chapter 2 in Anderson's book. Today s agenda Key exchange basics
CS 161 Computer Security
Raluca Ada Popa Spring 2018 CS 161 Computer Security Discussion 6 Week of February 26, 2018 Question 1 TLS threats (10 min) An attacker is trying to attack the company Boogle and its users. Assume that
Outline. CSCI 454/554 Computer and Network Security. Introduction. Topic 5.2 Public Key Cryptography. 1. Introduction 2. RSA
CSCI 454/554 Computer and Network Security Topic 5.2 Public Key Cryptography 1. Introduction 2. RSA Outline 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard 2 Introduction Public Key Cryptography
KEY AGREEMENT PROTOCOLS. CIS 400/628 Spring 2005 Introduction to Cryptography. This is based on Chapter 13 of Trappe and Washington
KEY AGREEMENT PROTOCOLS CIS 400/628 Spring 2005 Introduction to Cryptography This is based on Chapter 13 of Trappe and Washington DIFFIE-HELLMAN KEY EXCHANGE Alice & want to exchange a ton of data using
Configuring OpenVPN on pfsense
Configuring OpenVPN on pfsense Configuring OpenVPN on pfsense Posted by Glenn on Dec 29, 2013 in Networking 0 comments In this article I will go through the configuration of OpenVPN on the pfsense platform.
FIPS Compliance of Industry Protocols in Edward Morris September 25, 2013
FIPS 140-2 Compliance of Industry Protocols in 2014 Edward Morris September 25, 2013 Topics Abstract Background DES SP 800-57 SP 800-131 The Protocols IPsec TLS SSH Others Challenges & Recommendations
Lecture 9a: Secure Sockets Layer (SSL) March, 2004
Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Security Achieved by
Session key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
Security Handshake Pitfalls
Cryptographic Authentication Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response
Digital Certificates Demystified
Digital Certificates Demystified Ross Cooper, CISSP IBM Corporation RACF/PKI Development Poughkeepsie, NY Email: rdc@us.ibm.com August 9 th, 2012 Session 11622 Agenda Cryptography What are Digital Certificates
Session key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
Integrated Key Exchange Protocol Capable of Revealing Spoofing and Resisting Dictionary Attacks
Integrated Key Exchange Protocol Capable of Revealing Spoofing and Resisting Dictionary Attacks David Lai and Zhongwei Zhang Department of Mathematics and Computing, University of Southern Queensland,
CSE484 Final Study Guide
CSE484 Final Study Guide Winter 2013 NOTE: This study guide presents a list of ideas and topics that the TAs find useful to know, and may not represent all the topics that could appear on the final exam.
Authentication Protocols. Outline. Who Is Authenticated?
Authentication Protocols Guevara Noubir College of Computer and Information Science Northeastern University noubir@ccs.neu.edu Outline Overview of Authentication Systems [Chapter 9] Authentication of People
WAP Security. Helsinki University of Technology S Security of Communication Protocols
WAP Security Helsinki University of Technology S-38.153 Security of Communication Protocols Mikko.Kerava@iki.fi 15.4.2003 Contents 1. Introduction to WAP 2. Wireless Transport Layer Security 3. Other WAP
Outline. Public Key Cryptography. Applications of Public Key Crypto. Applications (Cont d)
Outline AIT 682: Network and Systems Security 1. Introduction 2. RSA 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard Topic 5.2 Public Key Cryptography Instructor: Dr. Kun Sun 2 Public Key
ECE 646 Lecture 3. Key management
ECE 646 Lecture 3 Key management Required Reading Stallings, Cryptography and Network Security: Principles and Practice, 5/E or 6/E Chapter 14 Key Management and Distribution Using the same key for multiple
Outline. Login w/ Shared Secret: Variant 1. Login With Shared Secret: Variant 2. Login Only Authentication (One Way) Mutual Authentication
Outline Security Handshake Pitfalls (Chapter 11 & 12.2) Login Only Authentication (One Way) Login i w/ Shared Secret One-way Public Key Lamport s Hash Mutual Authentication Shared Secret Public Keys Timestamps
Virtual Private Networks
EN-2000 Reference Manual Document 8 Virtual Private Networks O ne of the principal features of routers is their support of virtual private networks (VPNs). This document discusses transmission security,
Authentication Handshakes
AIT 682: Network and Systems Security Topic 6.2 Authentication Protocols Instructor: Dr. Kun Sun Authentication Handshakes Secure communication almost always includes an initial authentication handshake.
CS 6324: Information Security More Info on Key Establishment: RSA, DH & QKD
ERIK JONSSON SCHOOL OF ENGINEERING & COMPUTER SCIENCE Cyber Security Research and Education Institute CS 6324: Information Security Dr. Junia Valente Department of Computer Science The University of Texas
Configuration of an IPSec VPN Server on RV130 and RV130W
Configuration of an IPSec VPN Server on RV130 and RV130W Objective IPSec VPN (Virtual Private Network) enables you to securely obtain remote access to corporate resources by establishing an encrypted tunnel
The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
Security Association Creation
1 Security Association Creation David L. Black November 2006 2 The Big Picture: Three Proposals Framework: 06-369 specifies Security Associations (SAs) Connect key generation to key usage (and identify
This chapter continues our overview of public-key cryptography systems (PKCSs), and begins with a description of one of the earliest and simplest
1 2 3 This chapter continues our overview of public-key cryptography systems (PKCSs), and begins with a description of one of the earliest and simplest PKCS, Diffie- Hellman key exchange. This first published
(2½ hours) Total Marks: 75
(2½ hours) Total Marks: 75 N. B.: (1) All questions are compulsory. (2) Makesuitable assumptions wherever necessary and state the assumptions made. (3) Answers to the same question must be written together.
HIP Host Identity Protocol. October 2007 Patrik Salmela Ericsson
HIP Host Identity Protocol October 2007 Patrik Salmela Ericsson Agenda What is the Host Identity Protocol (HIP) What does HIP try to solve HIP basics Architecture The HIP base exchange HIP basic features
CSC 774 Network Security
CSC 774 Network Security Topic 2. Review of Cryptographic Techniques CSC 774 Dr. Peng Ning 1 Outline Encryption/Decryption Digital signatures Hash functions Pseudo random functions Key exchange/agreement/distribution