An Interface Specification Language for Automatically Analyzing Cryptographic Protocols
|
|
|
- Milo Cooper
- 6 years ago
- Views:
Transcription
1 An Interface Specification Language for Automatically Analyzing Cryptographic Protocols Internet Society Symposium on Network and Distributed System Security February 10-11, 1997 San Diego Princess Resort, San Diego, CA Dr. Stephen H. Brackin Arca Systems, Inc. 303 E. Yates St., Ithaca, NY (607) or (607) Supported by Arca Systems, Inc., by ESC/AXS through PRISM, and by Rome Laboratory Page - 1
2 Overview of Talk Problem and basic solution idea Cryptographic protocols and network model Protocol failure, TMN example Belief logics Examples of what the Automatic Authentication Protocol Analyzer (AAPA) can do Interface Specification Language (ISL) TMN specification Terminal output, failed-goals files, other files High points of (unnamed) commercial application Plans for the future Thorough, but still fast and automatic, analyses Good-guy deductions vrs. Bad-guy searches Lessons for protocol users and designers Page - 2
3 Cryptographic Protocols and Network Model Goal: Secure communication over insecure networks Networks, principals, and messages No other communications Worst case: enemy can read, or be true source, of everything Confidentiality and authentication Tools for achieving goal Shared or confirmable secrets Symmetric- and public-key encryption Effectively 1-to-1 hash functions Timestamps, nonces, signatures, etc. Protocols Distributed algorithms carried out by stages Abort if something not as expected Page - 3
4 Protocol Failure Example: TMN (Tatebayeshi-Matsuzaki-Newman) key-distribution protocol 1. A -> S: A, S, B, {SkA}Rsa(PkS) 2. S -> B: S, B, A 3. B -> S: B, S, A, {SkB}Rsa(PkS) 4. S -> A: S, A, B, {SkB}Xor(SkA) ISL notation, but more-or-less standard Published (CRYPTO 89), recommended by experts It s wrong, and has lots of company Page - 4
5 Belief Logics Formalize authentication reasoning that assumes Page - 5 Good encryption and hash functions Correct distributions of secrets Sample deduction If P believes only P and Q know K, and P receives an M that K decrypts to something meaningful, then P believes Q sent M -- though not necessarily recently or to P AAPA s BGNY logic Derived from Gong-Needham-Yahalom (GNY) logic Sending, receiving, belief, freshness, conveyence, shared secrets, possession, recognizability, trustworthiness, not-fromhere checks, message extensions, feasibility constraints Many extensions and corrections to GNY (e.g., stages, keyexchange functions, hash codes as keys)
6 Sample AAPA Analysis: ISL (1) /* Tatebayashi, Matsuzaki, Newman (TMN) Protocol */ DEFINITIONS: PRINCIPALS: A,B,S; PRIVATE KEYS: ^PkS; PUBLIC KEYS: PkS; SYMMETRIC KEYS: SkA,SkB; ENCRYPT FUNCTIONS: Xor,Rsa; Xor WITH ANYKEY HASINVERSE Xor WITH ANYKEY; Rsa WITH PkS HASINVERSE Rsa WITH ^PkS; Page - 6
7 Sample AAPA Analysis: ISL (2) INITIALCONDITIONS: A Received Xor,Rsa,A,B,S,PkS,SkA; A Believes (Fresh SkA; PublicKey S Rsa PkS; SharedSecret A S SkA; Trustworthy B; Trustworthy S); B Received Xor,Rsa,A,B,S,PkS,SkB; B Believes (Fresh SkB; PublicKey S Rsa PkS; SharedSecret A B SkB; Trustworthy A; Trustworthy S); S Received Xor,Rsa,^PkS; S Believes (PrivateKey S Rsa ^PkS; Trustworthy A; Trustworthy B); Page - 7
8 Sample AAPA Analysis: ISL (3) PROTOCOL: 1. A->S : A,S,B,{SkA}Rsa(PkS); 2. S ->B : S,B,A; 3. B ->S : B,S,A,{SkB}Rsa(PkS) (SharedSecret A B SkB); 4. S ->A : S,A,B,{SkB}Xor(SkA) (SharedSecret A B SkB); GOALS: 1. S Possesses SkA; 3. S Possesses SkB; S Believes SharedSecret A B SkB; 4. A Possesses SkB; A Believes SharedSecret A B SkB; Page - 8
9 Sample AAPA Analysis: Terminal Output Creating theory tmn Beginning tmn proofs Initializing globals Proving default goals, stage 1 Retrying failed default goals, stage 1 Proving user goals, stage 1 Proving default goals, stage 2 Proving user goals, stage 2 Proving default goals, stage 3 Retrying failed default goals, stage 3 Proving user goals, stage 3 User-goal failure, stage: 3! Goal statement: S Believes (SharedSecret A B SkB); Page - 9
10 Sample AAPA Analysis:.fail file (1) /* ######## Failed default goal from stage 3: ######## */ S Believes (B Conveyed {SkB}Rsa(PkS) (SharedSecret A B SkB)); /* ============ Unproved subgoals: =========== */ S Believes (S Recognizes SkB); S Believes (SharedSecret S B SkB); S Believes (Fresh {SkB}Rsa(PkS) (SharedSecret A B SkB)); /* ============= Proved subgoals: ============ */ S Received {SkB}Rsa(PkS) (SharedSecret A B SkB); S Possesses Rsa,UNPkS; S Believes (PrivateKey S Rsa UNPkS); Page - 10
11 Sample AAPA Analysis:.fail file (2) /* ######## Failed default goal from stage 1: ######## */ S Believes (A Conveyed {SkA}Rsa(PkS)); /* ============ Unproved subgoals: =========== */ S Believes (S Recognizes SkA); S Believes (SharedSecret S A SkA); S Believes (Fresh {SkA}Rsa(PkS) (SharedSecret A S SkA)); /* ============= Proved subgoals: ============ */ S Received {SkA}Rsa(PkS); S Possesses Rsa,UNPkS; S Believes (PrivateKey S Rsa UNPkS); Page - 11
12 Sample AAPA Analysis: Other Files Have a.thms file giving ISL versions of all theorems In TMN case, all interesting theorems are proved subgoals In other cases, useful for figuring out what happened Have option of producing Higher Order Logic (HOL) theory of protocol HOL translation of ISL input Optional outputs mainly used for debugging AAPA Page - 12
13 AAPA Analysis of Commercial Protocols Customer requested confidentiality Protocols moderately complicated, and huge Roughly 100 items or subitems in some messages Most of detail irrelevant to AAPA analysis -- but which? Biggest formally analyzed examples known to author Results of analyses of two protocols Did not find failures in protocols Found omissions, errors and inconsistencies in documentation Produced basis for much better documentation AAPA additions necessary for effort ISL abbreviation capacity (X = Y as in C) New diagnostics for feasibility failures Page - 13
14 Page - 14 Plans for the Future Belief logics vs. attack construction Simplicity and speed vs. thoroughness and rigor How to gain one without losing the other: Replace searches with using theorems about searches Research program Find failed protocols in literature Analyze them with AAPA For failures AAPA misses, ask where belief logic allowed false beliefs during attacks Adjust logic and repeat process; time always polynomial User interfaces Use CAPSL (Common Authentication Protocol Specification Language) by Millen and protocol-analysis community Make sure ISL virtues survive in CAPSL
15 Lessons for Protocol Users and Designers Protocol failure is a little-known, but very real problem Easy design problem is actually a weak link About half of published protocols fail -- estimate based on Lowe s and my own experiences An AAPA analysis is worth performing Finds common failures Gives overview, corrects documentation, identifies information flows, and identifies trust assumptions It s fast and cheap A near-future AAPA could make protocol failure, for practical purposes, into a solved problem Page - 15
A HOL Extension of GNY for Automatically Analyzing. Cryptographic Protocols. Stephen H. Brackin ESC/ENS
A HOL Extension of GNY for Automatically Analyzing Cryptographic Protocols Stephen H. Brackin Arca Systems, Inc. ESC/ENS Hanscom AFB, MA 01731-2116 Abstract This paper describes a Higher Order Logic (HOL)
Presented by Jack G. Nestell. Topics for Discussion. I. Introduction. Discussion on the different logics and methods of reasonings of Formal Methods
A Discussion on Security Protocols over open networks and distributed Systems: Formal methods for their Analysis, Design, and Verification S. Gritzalis, D. Spinellis, and P. Georgiadis Presented by Jack
Extending CAPSL for Logic-Based Verifications
Extending CAPSL for Logic-Based Verifications LIANG TIAN, REINER DOJEN, TOM COFFEY Data Communications Security Laboratory Department of Electronic and Computer Engineering University of Limerick IRELAND
Security protocols. Correctness of protocols. Correctness of protocols. II. Logical representation and analysis of protocols.i
Security protocols Logical representation and analysis of protocols.i A security protocol is a set of rules, adhered to by the communication parties in order to ensure achieving various security or privacy
Outline More Security Protocols CS 239 Computer Security February 6, 2006
Outline More Security Protocols CS 239 Computer Security February 6, 2006 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and Authentication
CSE BAN Logic Presentation
(Mike Burrows Marin Abadi Roger Needham Published 1989 SRC Research Report 9 Presentation by Heather Goldsby Michelle Pirtle "! #! $ % Problem Solution BAN Logic Goals of BAN Terms Symbols Notation and
Cryptography CS 555. Topic 16: Key Management and The Need for Public Key Cryptography. CS555 Spring 2012/Topic 16 1
Cryptography CS 555 Topic 16: Key Management and The Need for Public Key Cryptography CS555 Spring 2012/Topic 16 1 Outline and Readings Outline Private key management between two parties Key management
Outline More Security Protocols CS 239 Computer Security February 4, 2004
Outline More Security Protocols CS 239 Computer Security February 4, 2004 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and Authentication
Authentication Handshakes
AIT 682: Network and Systems Security Topic 6.2 Authentication Protocols Instructor: Dr. Kun Sun Authentication Handshakes Secure communication almost always includes an initial authentication handshake.
SEMINAR REPORT ON BAN LOGIC
SEMINAR REPORT ON BAN LOGIC Submitted by Name : Abhijeet Chatarjee Roll No.: 14IT60R11 SCHOOL OF INFORMATION TECHNOLOGY INDIAN INSTITUTE OF TECHNOLOGY, KHARAGPUR-721302 (INDIA) Abstract: Authentication
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 3.3: Security Handshake Pitfalls CSC 474/574 Dr. Peng Ning 1 Authentication Handshakes Secure communication almost always includes an initial authentication
BAN Logic. Logic of Authentication 1. BAN Logic. Source. The language of BAN. The language of BAN. Protocol 1 (Needham-Schroeder Shared-Key) [NS78]
![BAN Logic. Logic of Authentication 1. BAN Logic. Source. The language of BAN. The language of BAN. Protocol 1 (Needham-Schroeder Shared-Key) [NS78]](/thumbs/77/75728779.jpg "BAN Logic. Logic of Authentication 1. BAN Logic. Source. The language of BAN. The language of BAN. Protocol 1 (Needham-Schroeder Shared-Key) [NS78]")
Logic of Authentication 1. BAN Logic Ravi Sandhu BAN Logic BAN is a logic of belief. In an analysis, the protocol is first idealized into messages containing assertions, then assumptions are stated, and
Outline. More Security Protocols CS 239 Security for System Software April 22, Needham-Schroeder Key Exchange
Outline More Security Protocols CS 239 Security for System Software April 22, 2002 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and
A Limitation of BAN Logic Analysis on a Man-in-the-middle Attack
ISS 1746-7659, England, U Journal of Information and Computing Science Vol. 1, o. 3, 2006, pp. 131-138 Limitation of Logic nalysis on a Man-in-the-middle ttack + Shiping Yang, Xiang Li Computer Software
Logic of Authentication
Logic of Authentication Dennis Kafura Derived from materials authored by: Burrows, Abadi, Needham 1 Goals and Scope Goals develop a formalism to reason about authentication protocols uses determine guarantees
Protocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh
Protocols II Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 17th February 2011 Outline Introduction Shared-key Authentication Asymmetric authentication protocols
Security Handshake Pitfalls
Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr 1 Cryptographic Authentication Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response
Logics of authentication
Archive material from Edition 2 of Distributed Systems: Concepts and Design George Coulouris, Jean Dollimore & Tim indberg 1994 Permission to copy for all non-commercial purposes is hereby granted Originally
Cryptography and Network Security. Prof. D. Mukhopadhyay. Department of Computer Science and Engineering. Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 38 A Tutorial on Network Protocols
Lecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall Nitesh Saxena
Lecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall 2009 Nitesh Saxena *Adopted from a previous lecture by Gene Tsudik Course Admin HW3 Problem 3 due Friday midnight
Security Handshake Pitfalls
Cryptographic Authentication Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response
Message authentication. Why message authentication. Authentication primitives. and secure hashing. To prevent against:
Message authentication and secure hashing Why message authentication To prevent against: Masquerade/impersonation Modification of message content Modification of message sequence Acceptance of replayed/delayed
Extensions of BAN. Overview. BAN Logic by Heather Goldsby Michelle Pirtle
Extensions of BAN by Heather Goldsby Michelle Pirtle Overview BAN Logic Burrows, Abadi, and Needham GNY Gong, Needham, Yahalom RV AT Abadi and Tuttle VO van Oorschot SVO Syverson and van Oorschot Wenbo
User Authentication Protocols
User Authentication Protocols Class 5 Stallings: Ch 15 CIS-5370: 26.September.2016 1 Announcement Homework 1 is due today by end of class CIS-5370: 26.September.2016 2 User Authentication The process of
CIS 6930/4930 Computer and Network Security. Topic 6.2 Authentication Protocols
CIS 6930/4930 Computer and Network Security Topic 6.2 Authentication Protocols 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake. Authenticate
Security protocols and their verification. Mark Ryan University of Birmingham
Security protocols and their verification Mark Ryan University of Birmingham Contents 1. Authentication protocols (this lecture) 2. Electronic voting protocols 3. Fair exchange protocols 4. Digital cash
Cryptographic Protocols 1
Cryptographic Protocols 1 Luke Anderson luke@lukeanderson.com.au 5 th May 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Problem with Diffie-Hellman 2.1 Session Hijacking 2.2 Encrypted Key Exchange
Formal Methods for Assuring Security of Computer Networks
for Assuring of Computer Networks May 8, 2012 Outline Testing 1 Testing 2 Tools for formal methods Model based software development 3 Principals of security Key security properties Assessing security protocols
Computer Networks & Security 2016/2017
Computer Networks & Security 2016/2017 Network Security Protocols (10) Dr. Tanir Ozcelebi Courtesy: Jerry den Hartog Courtesy: Kurose and Ross TU/e Computer Science Security and Embedded Networked Systems
User Authentication Protocols Week 7
User Authentication Protocols Week 7 CEN-5079: 2.October.2017 1 Announcement Homework 1 is posted on the class webpage Due in 2 weeks 10 points (out of 100) subtracted each late day CEN-5079: 2.October.2017
Lecture 19: cryptographic algorithms
Lecture 19: cryptographic algorithms Operating Systems and Networks Behzad Bordbar School of Computer Science, University of Birmingham, UK 179 Overview Cryptographic algorithms symmetric: TEA asymmetric:
0/41. Alice Who? Authentication Protocols. Andreas Zeller/Stephan Neuhaus. Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken
0/41 Alice Who? Authentication Protocols Andreas Zeller/Stephan Neuhaus Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken The Menu 1/41 Simple Authentication Protocols The Menu 1/41 Simple
Lecture 15: Cryptographic algorithms
06-06798 Distributed Systems Lecture 15: Cryptographic algorithms 22 March, 2002 1 Overview Cryptographic algorithms symmetric: TEA asymmetric: RSA Digital signatures digital signatures with public key
UNIT - IV Cryptographic Hash Function 31.1
UNIT - IV Cryptographic Hash Function 31.1 31-11 SECURITY SERVICES Network security can provide five services. Four of these services are related to the message exchanged using the network. The fifth service
CS Protocol Design. Prof. Clarkson Spring 2017
CS 5430 Protocol Design Prof. Clarkson Spring 2017 Review Cryptography: Encryption, block ciphers, block cipher modes, MACs, cryptographic hash functions, digital signatures, authenticated encryption,
Modelling and Analysing of Security Protocol: Lecture 1. Introductions to Modelling Protocols. Tom Chothia CWI
Modelling and Analysing of Security Protocol: Lecture 1 Introductions to Modelling Protocols Tom Chothia CWI This Course This course will primarily teaching you: How to design your own secure communication
Grenzen der Kryptographie
Microsoft Research Grenzen der Kryptographie Dieter Gollmann Microsoft Research 1 Summary Crypto does not solve security problems Crypto transforms security problems Typically, the new problems relate
Mechanising BAN Kerberos by the Inductive Method
Mechanising BAN Kerberos by the Inductive Method Giampaolo Bella Lawrence C Paulson Computer Laboratory University of Cambridge New Museums Site, Pembroke Street Cambridge CB2 3QG (UK) {gb221,lcp}@cl.cam.ac.uk
Security Handshake Pitfalls
Hello Challenge R f(k, R f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone can send the challenge R. f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone
Module: Cryptographic Protocols. Professor Patrick McDaniel Spring CMPSC443 - Introduction to Computer and Network Security
CMPSC443 - Introduction to Computer and Network Security Module: Cryptographic Protocols Professor Patrick McDaniel Spring 2009 1 Key Distribution/Agreement Key Distribution is the process where we assign
On the Security of a Certificateless Public-Key Encryption
On the Security of a Certificateless Public-Key Encryption Zhenfeng Zhang, Dengguo Feng State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing 100080,
Lecture 1: Course Introduction
Lecture 1: Course Introduction Thomas Johansson T. Johansson (Lund University) 1 / 37 Chapter 9: Symmetric Key Distribution To understand the problems associated with managing and distributing secret keys.
Test Conditions. Closed book, closed notes, no calculator, no laptop just brains 75 minutes. Steven M. Bellovin October 19,
Test Conditions Closed book, closed notes, no calculator, no laptop just brains 75 minutes Steven M. Bellovin October 19, 2005 1 Form 8 questions I m not asking you to write programs or even pseudo-code
Diffie-Hellman. Part 1 Cryptography 136
Diffie-Hellman Part 1 Cryptography 136 Diffie-Hellman Invented by Williamson (GCHQ) and, independently, by D and H (Stanford) A key exchange algorithm o Used to establish a shared symmetric key Not for
Introduction to Security
Introduction to Security Avinanta Tarigan Universitas Gunadarma 1 Avinanta Tarigan Introduction to Security Layout Problems General Security Cryptography & Protocol reviewed 2 Avinanta Tarigan Introduction
Key Management. Digital signatures: classical and public key Classic and Public Key exchange. Handwritten Signature
Key Management Digital signatures: classical and public key Classic and Public Key exchange 1 Handwritten Signature Used everyday in a letter, on a check, sign a contract A signature on a signed paper
Lecture 1: Perfect Security
CS 290G (Fall 2014) Introduction to Cryptography Oct 2nd, 2014 Instructor: Rachel Lin 1 Recap Lecture 1: Perfect Security Scribe: John Retterer-Moore Last class, we introduced modern cryptography and gave
Implementing Cryptography: Good Theory vs. Bad Practice
Implementing Cryptography: Good Theory vs. Bad Practice Viet Pham Information Security Group, Department of Mathematics Royal Holloway, University of London Outline News report What is cryptography? Why
Cryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology
Cryptography & Key Exchange Protocols Faculty of Computer Science & Engineering HCMC University of Technology Outline 1 Cryptography-related concepts 2 3 4 5 6 7 Key channel for symmetric cryptosystems
Acknowledgments. CSE565: Computer Security Lectures 16 & 17 Authentication & Applications
CSE565: Computer Security Lectures 16 & 17 Authentication & Applications Shambhu Upadhyaya Computer Science & Eng. University at Buffalo Buffalo, New York 14260 Lec 16.1 Acknowledgments Material for some
Lecture 6.2: Protocols - Authentication and Key Exchange II. CS 436/636/736 Spring Nitesh Saxena. Course Admin
Lecture 6.2: Protocols - Authentication and Key II CS 436/636/736 Spring 2012 Nitesh Saxena Mid-Term Grading Course Admin Will be done over the break Scores will be posted online and graded exams distribute
Session key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
Summary on Crypto Primitives and Protocols
Summary on Crypto Primitives and Protocols Levente Buttyán CrySyS Lab, BME www.crysys.hu 2015 Levente Buttyán Basic model of cryptography sender key data ENCODING attacker e.g.: message spatial distance
Issues. Separation of. Distributed system security. Security services. Security policies. Security mechanism
Module 9 - Security Issues Separation of Security policies Precise definition of which entities in the system can take what actions Security mechanism Means of enforcing that policy Distributed system
Session key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
Network Security CHAPTER 31. Solutions to Review Questions and Exercises. Review Questions
CHAPTER 3 Network Security Solutions to Review Questions and Exercises Review Questions. A nonce is a large random number that is used only once to help distinguish a fresh authentication request from
CS 161 Computer Security
Popa & Wagner Spring 2016 CS 161 Computer Security Discussion 5 Week of February 19, 2017 Question 1 Diffie Hellman key exchange (15 min) Recall that in a Diffie-Hellman key exchange, there are values
CS 395T. Analyzing SET with Inductive Method
CS 395T Analyzing SET with Inductive Method Theorem Proving for Protocol Analysis Prove correctness instead of looking for bugs Use higher-order logic to reason about all possible protocol executions No
Network Security (NetSec)
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Network Security (NetSec) IN2101 WS 16/17 Prof. Dr.-Ing. Georg Carle Dr. Heiko Niedermayer Cornelius
Network Working Group. Category: Standards Track September The SRP Authentication and Key Exchange System
Network Working Group T. Wu Request for Comments: 2945 Stanford University Category: Standards Track September 2000 Status of this Memo The SRP Authentication and Key Exchange System This document specifies
Robbing the Bank with a Theorem Prover
Robbing the Bank with a Theorem Prover (Transcript of Discussion) Jolyon Clulow Cambridge University So it s a fairly provocative title, how did we get to that? Well automated tools have been successfully
Formal Methods for Security Protocols
Role of Temur.Kutsia@risc.uni-linz.ac.at Formal Methods Seminar January 26, 2005 Role of Outline 1 Role of 2 Security Properties Attacker Models Keys Symmetric and Asymmetric Systems 3 Notation and Examples
Introduction to Cryptography. Ramki Thurimella
Introduction to Cryptography Ramki Thurimella Encryption & Decryption 2 Generic Setting 3 Kerckhoff s Principle Security of the encryption scheme must depend only on The secret key NOT on the secrecy of
Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
Security. Communication security. System Security
Security Communication security security of data channel typical assumption: adversary has access to the physical link over which data is transmitted cryptographic separation is necessary System Security
Outline Key Management CS 239 Computer Security February 9, 2004
Outline Key Management CS 239 Computer Security February 9, 2004 Properties of keys Key management Key servers Certificates Page 1 Page 2 Introduction Properties of Keys It doesn t matter how strong your
Security in ECE Systems
Lecture 11 Information Security ECE 197SA Systems Appreciation Security in ECE Systems Information security Information can be very valuable Secure communication important to protect information Today
CS Protocols. Prof. Clarkson Spring 2016
CS 5430 Protocols Prof. Clarkson Spring 2016 Review: Secure channel When we last left off, we were building a secure channel The channel does not reveal anything about messages except for their timing
Cryptography: More Primitives
Design and Analysis of Algorithms May 8, 2015 Massachusetts Institute of Technology 6.046J/18.410J Profs. Erik Demaine, Srini Devadas and Nancy Lynch Recitation 11 Cryptography: More Primitives 1 Digital
Distributed Systems. 25. Authentication Paul Krzyzanowski. Rutgers University. Fall 2018
Distributed Systems 25. Authentication Paul Krzyzanowski Rutgers University Fall 2018 2018 Paul Krzyzanowski 1 Authentication For a user (or process): Establish & verify identity Then decide whether to
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 24a December 2, 2013 CPSC 467, Lecture 24a 1/20 Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management and Trusted
CS November 2018
Authentication Distributed Systems 25. Authentication For a user (or process): Establish & verify identity Then decide whether to allow access to resources (= authorization) Paul Krzyzanowski Rutgers University
Securing Internet Communication: TLS
Securing Internet Communication: TLS CS 161: Computer Security Prof. David Wagner March 11, 2016 Today s Lecture Applying crypto technology in practice Two simple abstractions cover 80% of the use cases
Proving who you are. Passwords and TLS
Proving who you are Passwords and TLS Basic, fundamental problem Client ( user ) How do you prove to someone that you are who you claim to be? Any system with access control must solve this Users and servers
Contents Digital Signatures Digital Signature Properties Direct Digital Signatures
Contents Digital Signatures... 197 Digital Signature Properties... 198 Direct Digital Signatures... 198 199...قابلداوری Arbitrated Digital Signatures Arbitrated Digital Signature Technaiques... 200 Authentication
Lecture 15 PKI & Authenticated Key Exchange. COSC-260 Codes and Ciphers Adam O Neill Adapted from
Lecture 15 PKI & Authenticated Key Exchange COSC-260 Codes and Ciphers Adam O Neill Adapted from http://cseweb.ucsd.edu/~mihir/cse107/ Today We will see how signatures are used to create public-key infrastructures
Crypto-systems all around us ATM machines Remote logins using SSH Web browsers (https invokes Secure Socket Layer (SSL))
Introduction (Mihir Bellare Text/Notes: http://cseweb.ucsd.edu/users/mihir/cse207/) Cryptography provides: Data Privacy Data Integrity and Authenticity Crypto-systems all around us ATM machines Remote
Chapter 9: Key Management
Chapter 9: Key Management Session and Interchange Keys Key Exchange Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #9-1 Overview Key exchange Session vs. interchange
Lecture Nov. 21 st 2006 Dan Wendlandt ISP D ISP B ISP C ISP A. Bob. Alice. Denial-of-Service. Password Cracking. Traffic.
15-441 Lecture Nov. 21 st 2006 Dan Wendlandt Worms & Viruses Phishing End-host impersonation Denial-of-Service Route Hijacks Traffic modification Spyware Trojan Horse Password Cracking IP Spoofing DNS
Chapter 10 : Private-Key Management and the Public-Key Revolution
COMP547 Claude Crépeau INTRODUCTION TO MODERN CRYPTOGRAPHY _ Second Edition _ Jonathan Katz Yehuda Lindell Chapter 10 : Private-Key Management and the Public-Key Revolution 1 Chapter 10 Private-Key Management
Introduction. CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell
Introduction CSE 5351: Introduction to cryptography Reading assignment: Chapter 1 of Katz & Lindell 1 Cryptography Merriam-Webster Online Dictionary: 1. secret writing 2. the enciphering and deciphering
Data Integrity. Modified by: Dr. Ramzi Saifan
Data Integrity Modified by: Dr. Ramzi Saifan Encryption/Decryption Provides message confidentiality. Does it provide message authentication? 2 Message Authentication Bob receives a message m from Alice,
Core Security Services and Bootstrapping in the Cherubim Security System
Core Security Services and Bootstrapping in the Cherubim Security System Charles Willis cfwillis@uiuc.edu Technical Report 2 July 1998 University of Illinois at Urbana-Champaign Department of Computer
Lecture 4: Authentication Protocols
Graduate Course on Computer Security Lecture 4: Authentication Protocols Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ DIMI, Universita
More on Cryptography CS 136 Computer Security Peter Reiher January 19, 2017
More on Cryptography CS 136 Computer Security Peter Reiher January 19, 2017 Page 1 Outline Desirable characteristics of ciphers Stream and block ciphers Cryptographic modes Uses of cryptography Symmetric
10/1/2015. Authentication. Outline. Authentication. Authentication Mechanisms. Authentication Mechanisms. Authentication Mechanisms
Authentication IT443 Network Security Administration Instructor: Bo Sheng Authentication Mechanisms Key Distribution Center and Certificate Authorities Session Key 1 2 Authentication Authentication is
Secure Multiparty Computation
CS573 Data Privacy and Security Secure Multiparty Computation Problem and security definitions Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
Secure digital certificates with a blockchain protocol
Secure digital certificates with a blockchain protocol Federico Pintore 1 Trento, 10 th February 2017 1 University of Trento Federico Pintore Blockchain and innovative applications Trento, 10 th February
HOST Authentication Overview ECE 525
Authentication Overview Authentication refers to the process of verifying the identity of the communicating principals to one another Usually sub-divided into Entity authentication Authentication in real-time
Overview of Cryptography
18739A: Foundations of Security and Privacy Overview of Cryptography Anupam Datta CMU Fall 2007-08 Is Cryptography A tremendous tool The basis for many security mechanisms Is not The solution to all security
Elements of Security
Elements of Security Dr. Bill Young Department of Computer Sciences University of Texas at Austin Last updated: April 8, 2015 at 12:47 Slideset 7: 1 Car Talk Puzzler You have a friend in a police state
Automotive Security An Overview of Standardization in AUTOSAR
Automotive Security An Overview of Standardization in AUTOSAR Dr. Marcel Wille 31. VDI/VW-Gemeinschaftstagung Automotive Security 21. Oktober 2015, Wolfsburg Hackers take over steering from smart car driver
Digital Signatures. Public-Key Signatures. Arbitrated Signatures. Digital Signatures With Encryption. Terminology. Message Authentication Code (MAC)
Message Authentication Code (MAC) Key-dependent one-way hash function Only someone with a correct key can verify the hash value Easy way to turn one-way hash function into MAC is to encrypt hash value
Brief Introduction to Provable Security
Brief Introduction to Provable Security Michel Abdalla Département d Informatique, École normale supérieure michel.abdalla@ens.fr http://www.di.ens.fr/users/mabdalla 1 Introduction The primary goal of
Authentication in Distributed Systems
Authentication in Distributed Systems Butler W. Lampson Huygens Systems Research Laboratory Universiteit Twente Enschede 1 Security Concerned with Allowing or denying access to data access-control lists
Cryptography and Network Security Chapter 14
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
Distributed ID-based Signature Using Tamper-Resistant Module
, pp.13-18 http://dx.doi.org/10.14257/astl.2013.29.03 Distributed ID-based Signature Using Tamper-Resistant Module Shinsaku Kiyomoto, Tsukasa Ishiguro, and Yutaka Miyake KDDI R & D Laboratories Inc., 2-1-15,
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
What did we talk about last time? Public key cryptography A little number theory
Week 4 - Friday What did we talk about last time? Public key cryptography A little number theory If p is prime and a is a positive integer not divisible by p, then: a p 1 1 (mod p) Assume a is positive
Cryptography. Lecture 12. Arpita Patra
Cryptography Lecture 12 Arpita Patra Digital Signatures q In PK setting, privacy is provided by PKE q Integrity/authenticity is provided by digital signatures (counterpart of MACs in PK world) q Definition: