Outline More Security Protocols CS 239 Computer Security February 4, 2004

Size: px
Start display at page:

Download "Outline More Security Protocols CS 239 Computer Security February 4, 2004"

Transcription

1 Outline More Security Protocols CS 239 Computer Security February 4, 2004 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and Authentication Usually the first requires the second Not much good to be sure the key is a secret if you don t know who you re sharing it with How can we achieve both goals? In a single protocol With relatively few messages Needham-Schroeder Key Exchange Uses symmetric cryptography equires a trusted authority Who takes care of generating the new key More complicated than some protocols we ve seen Page 3 Page 4 Needham-Schroeder, Step 1 What s the Point of A? A,, A A is nonce chosen by for this invocation of the protocol A random number Not used as a key, so quality of s random number generator not too important Helps defend against replay attacks Page 5 Page 6 1

2 A Needham-Schroeder, Step 2 E KA ( A,,, E KB (,)) What s all this stuff for? Including A prevents replay Including prevents attacker from replacing s identity Including the encrypted message for ensures that message can t be replaced Page 7 Needham-Schroeder, Step 3 E KB (,) So we re done, right? Wrong! KS Page 8 B Needham-Schroeder, Step 4 E KS ( B ) B B Needham-Schroeder, Step 5 E KS ( B -1) Now we re done! B B -1 Page 9 Page 10 What s All This Extra Stuff For? knows she s K K E KB (,) B A talking to K S said she was Can Can said he was E KA ( A,,, jump in later? jump in later? knows he s talking No, only No, all later E KB (,)) to could read the messages will use key package, which created doesn t know Page 11 What s All This Extra Stuff For? What about those random numbers? Page 12 2

3 Causes Problems and do something likes watches the messages they send to do so wants to make them do it again Can replay the conversation? Let s try it without the random numbers Waits For His Chance E KA (,, K A E KB (,)), Page 13 Page 14 What Will Do Now? The message could only have been created by It properly indicates she wants to talk to It contains a perfectly plausible key will probably go ahead with the protocol Page 15 The Protocol Continues steps aside for a bit E KB (,) With no random keys, we re done Page 16 So What s the Problem and agree is their key They both know the key definitely created the key for them Nobody else has the key But... Page 17 Steps Back Into the Picture E KS (Old message 2) can replay and s old conversation E KS (Old message 1) It s using the current key, so and will accept it Page 18 3

4 How Do the andom Numbers Help? s random number assures her that the reply from is fresh But why does need another random number? Page 19 Why Also Needs a andom Number Let s say doesn t want to talk to E KB (,) But wants to think wants to talk Page 20 So What? So, Everything s Fine, ight? E KS (Old message 1) can now play back an old message from to And will have no reason to be suspicious s random number exchange assured Not if any key ever gets divulged Once is divulged, can forge s response to s challenge And convince that he s talking to when he s really talking to him that really wanted to talk Page 21 Page 22 Cracks an Old Key E KS ( B ) E KB KS (K ( S B,) - 1) B B - 1 enlists 10,000 computers belonging to 10,000 grandmothers to crack Unfortunately, knows So can answer s challenge Page 23 Timestamps in Security Protocols One method of handling this kind of problem is timestamps Proper use of timestamps can limit the time during which an exposed key is dangerous But timestamps have their own problems Page 24 4

5 Using Timestamps in the Needham-Schroeder Protocol The trusted authority includes timestamps in his encrypted messages to and Based on a global clock When or decrypts, if the timestamp is too old, abort the protocol Page 25 Using Timestamps to Defeat E KB (,,T X ) E KB (,,T X ) T X << T now T now Now checks T X against his clock So, fearing replay, discards And s attack is foiled T X Page 26 Problems With Using Timestamps They require a globally synchronized set of clocks Hard to obtain, often Attacks on clocks become important They leave a window of vulnerability The Suppress-eplay Attack Assume two participants in a security protocol Using timestamps to avoid replay problems If the sender s clock is ahead of the receiver s, attacker can intercept message And replay later, when receiver s clock still allows it Page 27 Page 28 Handling Clock Problems 1). ely on clocks that are fairly synchronized and hard to tamper Perhaps GPS signals 2). Make all comparisons against the same clock So no two clocks need to be synchronized Page 29 Neuman-Stubblebine Protocol, Step 1, A A What does know? Someone claiming to be wants to talk securely A Page 30 5

6 A Neuman-Stubblebine Protocol, Step 2 knows thinks wants to talk to him But does she, B, E KB (, A,T B ), A,T B A B T B Neuman-Stubblebine Protocol, Step 3 really? Page 31 Page 32 A, A,,T B E KA (, A,,T B ), knows: E KB (,,T B ), B 1. heard her message 2. created a new key, A,T B B T B Neuman-Stubblebine Protocol, Step 4 E KB (,,T B ), B E KB (,,T B ), E KS ( B ) B guarantees knows T B guarantees it s a fresh session checks B and T B B B T B T B Page 33 What Has the Protocol Achieved? and share a key They know the key was generated by knows this key matches her recent request for a key knows this key matches s recent request and s agreement Page 34 What Has the Timestamp Done For and? knows that the whole agreement is timely Since the only timestamp originated with his clock, no danger of suppressreplay attacks What Else Can You Do With Security Protocols? Secret splitting and secret sharing Fair coin flips and other games Simultaneous contract signing Secure elections Zero knowledge proofs off-line Lots of other neat stuff Page 35 Page 36 6

7 Secret Splitting and Secret Sharing What if we have a secret that we need to recover later? We need to have it in other people s hands But we don t want anyone to be able to tell the secret Secret Splitting Divide the secret among two or more people They can combine to retrieve the secret But neither can guess the secret themselves Page 37 Page 38 Secret Splitting Example ecovering the Secret S S S? S S=? M wants to share secret M M` Page 39 Page 40 What If We Want To Do This Securely? What cryptographic steps would we perform to ensure security? That only and have secret components That they have components of the real secret What about ensuring that and both learn the secret if either does? Secret Sharing Say we have three participants,, Carol Can we arrange that: None of them know the secret alone Any pair of them can produce the secret Yes, using various secret sharing protocols Page 41 Page 42 7

8 Bit Commitment wants to make a choice now And prove to what that choice was Without telling him the choice now How can be sure that isn t cheating? E KS Basic Bit Commitment b E KS (,b) E KS (,b) can t tell yet what bit chose E KS (,b) Since doesn t have E KS Page 43 Page 44 E KS Now Claims the Bit Was 1 b E KS (,b) b == 1 E KS E KS (,b) How does prove it? If b == 1, told the truth,b E KS Why Does This Work? can t learn what b was until tells him gives a cryptographic package that she can t change Since the package includes, can t generate two keys, one for 0 and the other for 1 Page 45 Page 46 Making This Work Over the Network What would we have to do if was hanging around trying to screw things up? What if we wanted to keep the value of b secret from? What if we wanted to ensure that couldn t replace s choice? Page 47 Fair Coin Flips Two participants cryptographically flip a coin Based on clever use of bit commitment Cut and choose Basic version assumes no interfering third party And no need for secrecy Similar approaches can work for other games of chance Page 48 8

9 Simultaneous Contract Signing and want to sign a contract But only if each is sure the other also signs Basic method uses an arbitrator Non-arbitrated cryptographic method uses probabilistic outcome Verifying Security Protocols Security protocols are obviously very complicated And any flaw in the protocol can be very expensive Thus, verifying their correctness is of great value How to do it? Page 49 Page 50 Basic Approaches to Verifying Protocols Use standard specification and verification languages and tools Use expert systems Use logics for the analysis of knowledge and beliefs Use formal methods based on algebraic term-rewriting properties of cryptography Using Standard Specification and Verification Tools Treat protocol as a computer program and prove its correctness The oldest approach Using Finite state machines First-order predicate calculus Specification languages Page 51 Page 52 Problems With the Approach Using Expert Systems Very laborious Worse, correctness isn t the same as security The correctness you prove may not have even considered the possibility of certain attacks Too many protocols that have been proven have had security problems Develop an expert system that knows a lot about security protocols un it against proposed protocols In particular, use the expert system to determine if the protocol can reach an undesirable state Such as exposing a secret key Page 53 Page 54 9

10 Problems With the Expert System Approach Good at identifying flaws Provided they are based on already known problems Not so good at proving correctness or security Or at uncovering flaws based on new attacks Using Belief and Knowledge Logics An increasingly popular approach Describe certain properties that a security protocol should have Use logic to demonstrate the presence (or absence) of those properties Page 55 Page 56 BAN Logic Sample BAN Logic Statements Named for its creators (Burrows, Abadi, and Needham) The most popular method of this kind Used to reason about authentication Not other aspects of security Allows reasoning about beliefs in protocols believes X. sees X. said X. X is fresh. Page 57 Page 58 Steps in Applying BAN Logic What Can BAN Logic Do? Convert protocol to an idealized form Add all assumptions about initial state Attach logical formulae to the statements Apply logical postulates to the assertions and assumptions to discover the beliefs of protocol parties Discover flaws in protocols Found flaws in Needham-Schroeder Discover redundancies In Needham-Schroeder, Kerberos, etc. Page 59 Page 60 10

11 Critiques of BAN Logic Using Algebraic Term-ewriting Modeling Methods Translations into idealized protocols may not reflect the real protocol Doesn t address all important security issues for protocols Some feel that BAN logic can deduce characteristics that are obviously false Model the protocol as an algebraic system Express the state of the participants knowledge about the protocol Analyze the attainability of certain states Page 61 Page 62 Use of These Methods Specialized Approaches NL Protocol Analyzer Has discovered flaws in several protocols A relatively new method Weakest link seems to be formalizing protocol into an algebraic system Page 63 Stubblebine & Gligor s method of modeling weak crypto checksums Found problems in Kerberos and Privacy- Enhanced Mail Not useful for other types of analysis Woo-Lam s approach for key distribution protocols Pfitzmann s method for digital signatures There are others Page 64 An Entirely Different Approach Instead of using formal methods to verify security protocols, Use them to develop such protocols Some early work done using this approach Not clear if it will be fruitful Page 65 Bottom Line on Security Protocol Analysis Has been successful in finding some problems No one believes existing methods can find all problems Some knowledgeable observers think no method will ever be able to find all problems So, a useful tool, but not a panacea esearch in this area continues Page 66 11

Outline. More Security Protocols CS 239 Security for System Software April 22, Needham-Schroeder Key Exchange

Outline. More Security Protocols CS 239 Security for System Software April 22, Needham-Schroeder Key Exchange Outline More Security Protocols CS 239 Security for System Software April 22, 2002 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and

More information

Outline More Security Protocols CS 239 Computer Security February 6, 2006

Outline More Security Protocols CS 239 Computer Security February 6, 2006 Outline More Security Protocols CS 239 Computer Security February 6, 2006 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and Authentication

More information

Outline Key Management CS 239 Computer Security February 9, 2004

Outline Key Management CS 239 Computer Security February 9, 2004 Outline Key Management CS 239 Computer Security February 9, 2004 Properties of keys Key management Key servers Certificates Page 1 Page 2 Introduction Properties of Keys It doesn t matter how strong your

More information

Protocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh

Protocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh Protocols II Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 17th February 2011 Outline Introduction Shared-key Authentication Asymmetric authentication protocols

More information

Session key establishment protocols

Session key establishment protocols our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session

More information

Session key establishment protocols

Session key establishment protocols our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session

More information

SEMINAR REPORT ON BAN LOGIC

SEMINAR REPORT ON BAN LOGIC SEMINAR REPORT ON BAN LOGIC Submitted by Name : Abhijeet Chatarjee Roll No.: 14IT60R11 SCHOOL OF INFORMATION TECHNOLOGY INDIAN INSTITUTE OF TECHNOLOGY, KHARAGPUR-721302 (INDIA) Abstract: Authentication

More information

Authentication Handshakes

Authentication Handshakes AIT 682: Network and Systems Security Topic 6.2 Authentication Protocols Instructor: Dr. Kun Sun Authentication Handshakes Secure communication almost always includes an initial authentication handshake.

More information

CSC 474/574 Information Systems Security

CSC 474/574 Information Systems Security CSC 474/574 Information Systems Security Topic 3.3: Security Handshake Pitfalls CSC 474/574 Dr. Peng Ning 1 Authentication Handshakes Secure communication almost always includes an initial authentication

More information

Applied Cryptography Basic Protocols

Applied Cryptography Basic Protocols Applied Cryptography Basic Protocols Sape J. Mullender Huygens Systems Research Laboratory Universiteit Twente Enschede 1 Session keys It is prudent practice to use a different key for each session. This

More information

Elements of Security

Elements of Security Elements of Security Dr. Bill Young Department of Computer Sciences University of Texas at Austin Last updated: April 8, 2015 at 12:47 Slideset 7: 1 Car Talk Puzzler You have a friend in a police state

More information

0/41. Alice Who? Authentication Protocols. Andreas Zeller/Stephan Neuhaus. Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken

0/41. Alice Who? Authentication Protocols. Andreas Zeller/Stephan Neuhaus. Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken 0/41 Alice Who? Authentication Protocols Andreas Zeller/Stephan Neuhaus Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken The Menu 1/41 Simple Authentication Protocols The Menu 1/41 Simple

More information

Applied Cryptography and Computer Security CSE 664 Spring 2017

Applied Cryptography and Computer Security CSE 664 Spring 2017 Applied Cryptography and Computer Security Lecture 18: Key Distribution and Agreement Department of Computer Science and Engineering University at Buffalo 1 Key Distribution Mechanisms Secret-key encryption

More information

Crypto-systems all around us ATM machines Remote logins using SSH Web browsers (https invokes Secure Socket Layer (SSL))

Crypto-systems all around us ATM machines Remote logins using SSH Web browsers (https invokes Secure Socket Layer (SSL)) Introduction (Mihir Bellare Text/Notes: http://cseweb.ucsd.edu/users/mihir/cse207/) Cryptography provides: Data Privacy Data Integrity and Authenticity Crypto-systems all around us ATM machines Remote

More information

BAN Logic. Logic of Authentication 1. BAN Logic. Source. The language of BAN. The language of BAN. Protocol 1 (Needham-Schroeder Shared-Key) [NS78]

BAN Logic. Logic of Authentication 1. BAN Logic. Source. The language of BAN. The language of BAN. Protocol 1 (Needham-Schroeder Shared-Key) [NS78] Logic of Authentication 1. BAN Logic Ravi Sandhu BAN Logic BAN is a logic of belief. In an analysis, the protocol is first idealized into messages containing assertions, then assumptions are stated, and

More information

Security protocols and their verification. Mark Ryan University of Birmingham

Security protocols and their verification. Mark Ryan University of Birmingham Security protocols and their verification Mark Ryan University of Birmingham Contents 1. Authentication protocols (this lecture) 2. Electronic voting protocols 3. Fair exchange protocols 4. Digital cash

More information

Logic of Authentication

Logic of Authentication Logic of Authentication Dennis Kafura Derived from materials authored by: Burrows, Abadi, Needham 1 Goals and Scope Goals develop a formalism to reason about authentication protocols uses determine guarantees

More information

Cryptography and Network Security. Prof. D. Mukhopadhyay. Department of Computer Science and Engineering. Indian Institute of Technology, Kharagpur

Cryptography and Network Security. Prof. D. Mukhopadhyay. Department of Computer Science and Engineering. Indian Institute of Technology, Kharagpur Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 38 A Tutorial on Network Protocols

More information

Key Management. Digital signatures: classical and public key Classic and Public Key exchange. Handwritten Signature

Key Management. Digital signatures: classical and public key Classic and Public Key exchange. Handwritten Signature Key Management Digital signatures: classical and public key Classic and Public Key exchange 1 Handwritten Signature Used everyday in a letter, on a check, sign a contract A signature on a signed paper

More information

What did we talk about last time? Public key cryptography A little number theory

What did we talk about last time? Public key cryptography A little number theory Week 4 - Friday What did we talk about last time? Public key cryptography A little number theory If p is prime and a is a positive integer not divisible by p, then: a p 1 1 (mod p) Assume a is positive

More information

Security Handshake Pitfalls

Security Handshake Pitfalls Security Handshake Pitfalls 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: Authenticate each other Establish sessions keys This process may

More information

L7: Key Distributions. Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806

L7: Key Distributions. Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806 L7: Key Distributions Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806 9/16/2015 CSCI 451 - Fall 2015 1 Acknowledgement Many slides are from or are

More information

CIS 6930/4930 Computer and Network Security. Topic 6.2 Authentication Protocols

CIS 6930/4930 Computer and Network Security. Topic 6.2 Authentication Protocols CIS 6930/4930 Computer and Network Security Topic 6.2 Authentication Protocols 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake. Authenticate

More information

User Authentication Protocols Week 7

User Authentication Protocols Week 7 User Authentication Protocols Week 7 CEN-5079: 2.October.2017 1 Announcement Homework 1 is posted on the class webpage Due in 2 weeks 10 points (out of 100) subtracted each late day CEN-5079: 2.October.2017

More information

Security protocols. Correctness of protocols. Correctness of protocols. II. Logical representation and analysis of protocols.i

Security protocols. Correctness of protocols. Correctness of protocols. II. Logical representation and analysis of protocols.i Security protocols Logical representation and analysis of protocols.i A security protocol is a set of rules, adhered to by the communication parties in order to ensure achieving various security or privacy

More information

Chapter 9: Key Management

Chapter 9: Key Management Chapter 9: Key Management Session and Interchange Keys Key Exchange Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #9-1 Overview Key exchange Session vs. interchange

More information

User Authentication Protocols

User Authentication Protocols User Authentication Protocols Class 5 Stallings: Ch 15 CIS-5370: 26.September.2016 1 Announcement Homework 1 is due today by end of class CIS-5370: 26.September.2016 2 User Authentication The process of

More information

Lecture 1: Course Introduction

Lecture 1: Course Introduction Lecture 1: Course Introduction Thomas Johansson T. Johansson (Lund University) 1 / 37 Chapter 9: Symmetric Key Distribution To understand the problems associated with managing and distributing secret keys.

More information

Security Handshake Pitfalls

Security Handshake Pitfalls Cryptographic Authentication Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response

More information

Logics of authentication

Logics of authentication Archive material from Edition 2 of Distributed Systems: Concepts and Design George Coulouris, Jean Dollimore & Tim indberg 1994 Permission to copy for all non-commercial purposes is hereby granted Originally

More information

Security Handshake Pitfalls

Security Handshake Pitfalls Hello Challenge R f(k, R f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone can send the challenge R. f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone

More information

1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class

1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class 1.264 Lecture 27 Security protocols Symmetric cryptography Next class: Anderson chapter 10. Exercise due after class 1 Exercise: hotel keys What is the protocol? What attacks are possible? Copy Cut and

More information

CS Protocol Design. Prof. Clarkson Spring 2017

CS Protocol Design. Prof. Clarkson Spring 2017 CS 5430 Protocol Design Prof. Clarkson Spring 2017 Review Cryptography: Encryption, block ciphers, block cipher modes, MACs, cryptographic hash functions, digital signatures, authenticated encryption,

More information

Cryptography CS 555. Topic 16: Key Management and The Need for Public Key Cryptography. CS555 Spring 2012/Topic 16 1

Cryptography CS 555. Topic 16: Key Management and The Need for Public Key Cryptography. CS555 Spring 2012/Topic 16 1 Cryptography CS 555 Topic 16: Key Management and The Need for Public Key Cryptography CS555 Spring 2012/Topic 16 1 Outline and Readings Outline Private key management between two parties Key management

More information

Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018

Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018 Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS

More information

Cryptographic Checksums

Cryptographic Checksums Cryptographic Checksums Mathematical function to generate a set of k bits from a set of n bits (where k n). k is smaller then n except in unusual circumstances Example: ASCII parity bit ASCII has 7 bits;

More information

1 Defining Message authentication

1 Defining Message authentication ISA 562: Information Security, Theory and Practice Lecture 3 1 Defining Message authentication 1.1 Defining MAC schemes In the last lecture we saw that, even if our data is encrypted, a clever adversary

More information

Robbing the Bank with a Theorem Prover

Robbing the Bank with a Theorem Prover Robbing the Bank with a Theorem Prover (Transcript of Discussion) Jolyon Clulow Cambridge University So it s a fairly provocative title, how did we get to that? Well automated tools have been successfully

More information

Contents Digital Signatures Digital Signature Properties Direct Digital Signatures

Contents Digital Signatures Digital Signature Properties Direct Digital Signatures Contents Digital Signatures... 197 Digital Signature Properties... 198 Direct Digital Signatures... 198 199...قابلداوری Arbitrated Digital Signatures Arbitrated Digital Signature Technaiques... 200 Authentication

More information

Cryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology

Cryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology Cryptography & Key Exchange Protocols Faculty of Computer Science & Engineering HCMC University of Technology Outline 1 Cryptography-related concepts 2 3 4 5 6 7 Key channel for symmetric cryptosystems

More information

Lecture 8 - Message Authentication Codes

Lecture 8 - Message Authentication Codes Lecture 8 - Message Authentication Codes Benny Applebaum, Boaz Barak October 12, 2007 Data integrity Until now we ve only been interested in protecting secrecy of data. However, in many cases what we care

More information

Cryptography and Network Security Chapter 13. Digital Signatures & Authentication Protocols

Cryptography and Network Security Chapter 13. Digital Signatures & Authentication Protocols Cryptography and Network Security Chapter 13 Digital Signatures & Authentication Protocols Digital Signatures have looked at message authentication but does not address issues of lack of trust digital

More information

CSE BAN Logic Presentation

CSE BAN Logic Presentation (Mike Burrows Marin Abadi Roger Needham Published 1989 SRC Research Report 9 Presentation by Heather Goldsby Michelle Pirtle "! #! $ % Problem Solution BAN Logic Goals of BAN Terms Symbols Notation and

More information

Overview. Cryptographic key infrastructure Certificates. May 13, 2004 ECS 235 Slide #1. Notation

Overview. Cryptographic key infrastructure Certificates. May 13, 2004 ECS 235 Slide #1. Notation Overview Key exchange Session vs. interchange keys Classical, public key methods Key generation Cryptographic key infrastructure Certificates Key storage Key escrow Key revocation Digital signatures May

More information

Computer Networks & Security 2016/2017

Computer Networks & Security 2016/2017 Computer Networks & Security 2016/2017 Network Security Protocols (10) Dr. Tanir Ozcelebi Courtesy: Jerry den Hartog Courtesy: Kurose and Ross TU/e Computer Science Security and Embedded Networked Systems

More information

1 Identification protocols

1 Identification protocols ISA 562: Information Security, Theory and Practice Lecture 4 1 Identification protocols Now that we know how to authenticate messages using MACs, a natural question is, how can we use MACs to prove that

More information

Security and Privacy in Computer Systems. Lecture 7 The Kerberos authentication system. Security policy, security models, trust Access control models

Security and Privacy in Computer Systems. Lecture 7 The Kerberos authentication system. Security policy, security models, trust Access control models CS 645 Security and Privacy in Computer Systems Lecture 7 The Kerberos authentication system Last Week Security policy, security models, trust Access control models The Bell-La Padula (BLP) model The Biba

More information

CS3235 Seventh set of lecture slides

CS3235 Seventh set of lecture slides CS3235 Seventh set of lecture slides Hugh Anderson National University of Singapore School of Computing October, 2007 Hugh Anderson CS3235 Seventh set of lecture slides 1 Warp 9... Outline 1 Public Key

More information

6. Security Handshake Pitfalls Contents

6. Security Handshake Pitfalls Contents Contents 1 / 45 6.1 Introduction 6.2 Log-in Only 6.3 Mutual Authentication 6.4 Integrity/Encryption of Data 6.5 Mediated Authentication (with KDC) 6.6 Bellovin-Merrit 6.7 Network Log-in and Password Guessing

More information

Mechanising BAN Kerberos by the Inductive Method

Mechanising BAN Kerberos by the Inductive Method Mechanising BAN Kerberos by the Inductive Method Giampaolo Bella Lawrence C Paulson Computer Laboratory University of Cambridge New Museums Site, Pembroke Street Cambridge CB2 3QG (UK) {gb221,lcp}@cl.cam.ac.uk

More information

Formal Methods for Assuring Security of Computer Networks

Formal Methods for Assuring Security of Computer Networks for Assuring of Computer Networks May 8, 2012 Outline Testing 1 Testing 2 Tools for formal methods Model based software development 3 Principals of security Key security properties Assessing security protocols

More information

Computer Security. 10. Exam 2 Review. Paul Krzyzanowski. Rutgers University. Spring 2017

Computer Security. 10. Exam 2 Review. Paul Krzyzanowski. Rutgers University. Spring 2017 Computer Security 10. Exam 2 Review Paul Krzyzanowski Rutgers University Spring 2017 March 23, 2018 CS 419 2017 Paul Krzyzanowski 1 Question 1(a) Suppose you come across some old text in the form GEPPQ

More information

Fall 2005 Joseph/Tygar/Vazirani/Wagner Final

Fall 2005 Joseph/Tygar/Vazirani/Wagner Final CS 161 Computer Security Fall 2005 Joseph/Tygar/Vazirani/Wagner Final PRINT your name:, (last) SIGN your name: (first) PRINT your Unix account name: PRINT your TA s name: You may consult any books, notes,

More information

KEY EXCHANGE AUTHENTICATION AUTHENTICATION AND KEY... ANALYSIS OF AUTHENTICATION... MULTIPLE-KEY PUBLIC-KEY... 68

KEY EXCHANGE AUTHENTICATION AUTHENTICATION AND KEY... ANALYSIS OF AUTHENTICATION... MULTIPLE-KEY PUBLIC-KEY... 68 CHAPTER... 47 KEY EXCHANGE... 47 Key Exchange with Symmetric Cryptograp.. 47 Key Exchange with Public-Key Cryptograp.. 48 Man-in-the-Middle Attack... 48 Interlock Protocol... 49 Key Exchange with Digital

More information

Agreement in Distributed Systems CS 188 Distributed Systems February 19, 2015

Agreement in Distributed Systems CS 188 Distributed Systems February 19, 2015 Agreement in Distributed Systems CS 188 Distributed Systems February 19, 2015 Page 1 Introduction We frequently want to get a set of nodes in a distributed system to agree Commitment protocols and mutual

More information

Uses of Cryptography

Uses of Cryptography Uses of Cryptography What can we use cryptography for? Lots of things Secrecy Authentication Prevention of alteration Page 1 Cryptography and Secrecy Pretty obvious Only those knowing the proper keys can

More information

Introduction to Cryptography CS 136 Computer Security Peter Reiher October 9, 2014

Introduction to Cryptography CS 136 Computer Security Peter Reiher October 9, 2014 Introduction to Cryptography CS 136 Computer Security Peter Reiher October 9, 2014 Page 1 Outline What is data encryption? Cryptanalysis Basic encryption methods Substitution ciphers Permutation ciphers

More information

Simple Security Protocols

Simple Security Protocols What is a Protocol? Monday, December 4, 2012 eading: S&M Ch. 9; Schneier Chs. 2-4; Kaufman, Perlman, & Speciner, Ch. 11; Anderson, Ch 3 CS342 Computer Security Department of Computer Science Wellesley

More information

CSCI 667: Concepts of Computer Security. Lecture 9. Prof. Adwait Nadkarni

CSCI 667: Concepts of Computer Security. Lecture 9. Prof. Adwait Nadkarni CSCI 667: Concepts of Computer Security Lecture 9 Prof. Adwait Nadkarni 1 Derived from slides by William Enck, Micah Sherr, Patrick McDaniel, Peng Ning, and Vitaly Shmatikov Authentication Alice? Bob?

More information

EEC-682/782 Computer Networks I

EEC-682/782 Computer Networks I EEC-682/782 Computer Networks I Lecture 25 Wenbing Zhao wenbingz@gmail.com http://academic.csuohio.edu/zhao_w/teaching/eec682.htm (Lecture nodes are based on materials supplied by Dr. Louise Moser at UCSB

More information

CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security Outline ZKIP Other IP CPSC 467b: Cryptography and Computer Security Lecture 19 Michael J. Fischer Department of Computer Science Yale University March 31, 2010 Michael J. Fischer CPSC 467b, Lecture 19

More information

Spring 2010: CS419 Computer Security

Spring 2010: CS419 Computer Security Spring 2010: CS419 Computer Security Vinod Ganapathy Lecture 7 Topic: Key exchange protocols Material: Class handout (lecture7_handout.pdf) Chapter 2 in Anderson's book. Today s agenda Key exchange basics

More information

Lecture 1: Perfect Security

Lecture 1: Perfect Security CS 290G (Fall 2014) Introduction to Cryptography Oct 2nd, 2014 Instructor: Rachel Lin 1 Recap Lecture 1: Perfect Security Scribe: John Retterer-Moore Last class, we introduced modern cryptography and gave

More information

CS Protocols. Prof. Clarkson Spring 2016

CS Protocols. Prof. Clarkson Spring 2016 CS 5430 Protocols Prof. Clarkson Spring 2016 Review: Secure channel When we last left off, we were building a secure channel The channel does not reveal anything about messages except for their timing

More information

Formal Methods for Security Protocols

Formal Methods for Security Protocols Role of Temur.Kutsia@risc.uni-linz.ac.at Formal Methods Seminar January 26, 2005 Role of Outline 1 Role of 2 Security Properties Attacker Models Keys Symmetric and Asymmetric Systems 3 Notation and Examples

More information

Grenzen der Kryptographie

Grenzen der Kryptographie Microsoft Research Grenzen der Kryptographie Dieter Gollmann Microsoft Research 1 Summary Crypto does not solve security problems Crypto transforms security problems Typically, the new problems relate

More information

Cristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.

Cristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment. CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How

More information

Network Security. Chapter 7 Cryptographic Protocols

Network Security. Chapter 7 Cryptographic Protocols Network Security Chapter 7 Cryptographic Protocols 1 Introduction! Definition: A cryptographic protocol is defined as a series of steps and message exchanges between multiple entities in order to achieve

More information

Cryptographic Protocols 1

Cryptographic Protocols 1 Cryptographic Protocols 1 Luke Anderson luke@lukeanderson.com.au 5 th May 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Problem with Diffie-Hellman 2.1 Session Hijacking 2.2 Encrypted Key Exchange

More information

Module: Cryptographic Protocols. Professor Patrick McDaniel Spring CMPSC443 - Introduction to Computer and Network Security

Module: Cryptographic Protocols. Professor Patrick McDaniel Spring CMPSC443 - Introduction to Computer and Network Security CMPSC443 - Introduction to Computer and Network Security Module: Cryptographic Protocols Professor Patrick McDaniel Spring 2009 1 Key Distribution/Agreement Key Distribution is the process where we assign

More information

Ideal Security Protocol. Identify Friend or Foe (IFF) MIG in the Middle 4/2/2012

Ideal Security Protocol. Identify Friend or Foe (IFF) MIG in the Middle 4/2/2012 Ideal Security Protocol Satisfies security requirements Requirements must be precise Efficient Small computational requirement Small bandwidth usage, network delays Not fragile Works when attacker tries

More information

Data Security and Privacy. Topic 14: Authentication and Key Establishment

Data Security and Privacy. Topic 14: Authentication and Key Establishment Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt

More information

1 Achieving IND-CPA security

1 Achieving IND-CPA security ISA 562: Information Security, Theory and Practice Lecture 2 1 Achieving IND-CPA security 1.1 Pseudorandom numbers, and stateful encryption As we saw last time, the OTP is perfectly secure, but it forces

More information

CS5232 Formal Specification and Design Techniques. Using PAT to verify the Needham-Schroeder Public Key Protocol

CS5232 Formal Specification and Design Techniques. Using PAT to verify the Needham-Schroeder Public Key Protocol CS5232 Formal Specification and Design Techniques Using PAT to verify the Needham-Schroeder Public Key Protocol Semester 2, AY 2008/2009 1/37 Table of Contents 1. Project Introduction 3 2. Building the

More information

CS530 Authentication

CS530 Authentication CS530 Authentication Bill Cheng http://merlot.usc.edu/cs530-s10 1 Identification vs. Authentication Identification associating an identity (or a claimed identity) with an individual, process, or request

More information

CS61A Lecture #39: Cryptography

CS61A Lecture #39: Cryptography Announcements: CS61A Lecture #39: Cryptography Homework 13 is up: due Monday. Homework 14 will be judging the contest. HKN surveys on Friday: 7.5 bonus points for filling out their survey on Friday (yes,

More information

Fair exchange and non-repudiation protocols

Fair exchange and non-repudiation protocols Fair exchange and non-repudiation protocols Levente Buttyán Laboratory of Cryptography and System Security (CrySyS) Budapest University of Technology and Economics buttyan@crysys.hu 2010 Levente Buttyán

More information

Real-time protocol. Chapter 16: Real-Time Communication Security

Real-time protocol. Chapter 16: Real-Time Communication Security Chapter 16: Real-Time Communication Security Mohammad Almalag Dept. of Computer Science Old Dominion University Spring 2013 1 Real-time protocol Parties negotiate interactively (Mutual) Authentication

More information

CS 111. Operating Systems Peter Reiher

CS 111. Operating Systems Peter Reiher Security for Operating Systems: Cryptography, Authentication, and Protecting OS Resources Operating Systems Peter Reiher Page 1 Outline Basic concepts in computer security Design principles for security

More information

ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification

ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification Hossen Asiful Mustafa Introduction Entity Authentication is a technique designed to let one party prove the identity of another

More information

Lecture 4: Authentication Protocols

Lecture 4: Authentication Protocols Graduate Course on Computer Security Lecture 4: Authentication Protocols Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ DIMI, Universita

More information

Security Handshake Pitfalls

Security Handshake Pitfalls Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr 1 Cryptographic Authentication Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response

More information

Acknowledgments. CSE565: Computer Security Lectures 16 & 17 Authentication & Applications

Acknowledgments. CSE565: Computer Security Lectures 16 & 17 Authentication & Applications CSE565: Computer Security Lectures 16 & 17 Authentication & Applications Shambhu Upadhyaya Computer Science & Eng. University at Buffalo Buffalo, New York 14260 Lec 16.1 Acknowledgments Material for some

More information

Security Analysis of Bluetooth v2.1 + EDR Pairing Authentication Protocol. John Jersin Jonathan Wheeler. CS259 Stanford University.

Security Analysis of Bluetooth v2.1 + EDR Pairing Authentication Protocol. John Jersin Jonathan Wheeler. CS259 Stanford University. Security Analysis of Bluetooth v2.1 + EDR Pairing Authentication Protocol John Jersin Jonathan Wheeler CS259 Stanford University March 20, 2008 Version 1 Security Analysis of Bluetooth v2.1 + EDR Pairing

More information

Outline Basics of Data Encryption CS 239 Computer Security January 24, 2005

Outline Basics of Data Encryption CS 239 Computer Security January 24, 2005 Outline Basics of Data Encryption CS 239 Computer Security January 24, 2005 What is data encryption? Basic encryption mechanisms Stream and block ciphers Characteristics of good ciphers Page 1 Page 2 Data

More information

Digital Signatures. Secure Digest Functions

Digital Signatures. Secure Digest Functions Digital Signatures Secure Digest Functions 8 requirements for one-way hash functions given M, H(M) is easy to compute given H(M), M is difficult to compute given M, it is difficult to find M such that

More information

Network Security CHAPTER 31. Solutions to Review Questions and Exercises. Review Questions

Network Security CHAPTER 31. Solutions to Review Questions and Exercises. Review Questions CHAPTER 3 Network Security Solutions to Review Questions and Exercises Review Questions. A nonce is a large random number that is used only once to help distinguish a fresh authentication request from

More information

Session Key Distribution

Session Key Distribution Session Key Distribution The TA shares secret keys with network users. The TA chooses session keys and distributes them in encrypted form upon request of network users. We will need to define appropriate

More information

A Limitation of BAN Logic Analysis on a Man-in-the-middle Attack

A Limitation of BAN Logic Analysis on a Man-in-the-middle Attack ISS 1746-7659, England, U Journal of Information and Computing Science Vol. 1, o. 3, 2006, pp. 131-138 Limitation of Logic nalysis on a Man-in-the-middle ttack + Shiping Yang, Xiang Li Computer Software

More information

1 A Tale of Two Lovers

1 A Tale of Two Lovers CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Dec. 12, 2006 Lecture Notes 19 (expanded): Secure Two-Party Computation Recommended Reading. Goldreich Volume II 7.2.2, 7.3.2, 7.3.3.

More information

CS 161 Computer Security

CS 161 Computer Security Paxson Spring 2011 CS 161 Computer Security Discussion 9 March 30, 2011 Question 1 Another Use for Hash Functions (8 min) The traditional Unix system for password authentication works more or less like

More information

Key Agreement. Guilin Wang. School of Computer Science, University of Birmingham

Key Agreement. Guilin Wang. School of Computer Science, University of Birmingham Key Agreement Guilin Wang School of Computer Science, University of Birmingham G.Wang@cs.bham.ac.uk 1 Motivations As we know, symmetric key encryptions are usually much more efficient than public key encryptions,

More information

Introduction. Trusted Intermediaries. CSC/ECE 574 Computer and Network Security. Outline. CSC/ECE 574 Computer and Network Security.

Introduction. Trusted Intermediaries. CSC/ECE 574 Computer and Network Security. Outline. CSC/ECE 574 Computer and Network Security. Trusted Intermediaries CSC/ECE 574 Computer and Network Security Topic 7. Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center () Representative solution:

More information

Outline. Login w/ Shared Secret: Variant 1. Login With Shared Secret: Variant 2. Login Only Authentication (One Way) Mutual Authentication

Outline. Login w/ Shared Secret: Variant 1. Login With Shared Secret: Variant 2. Login Only Authentication (One Way) Mutual Authentication Outline Security Handshake Pitfalls (Chapter 11 & 12.2) Login Only Authentication (One Way) Login i w/ Shared Secret One-way Public Key Lamport s Hash Mutual Authentication Shared Secret Public Keys Timestamps

More information

Chapter 13. Digital Cash. Information Security/System Security p. 570/626

Chapter 13. Digital Cash. Information Security/System Security p. 570/626 Chapter 13 Digital Cash Information Security/System Security p. 570/626 Introduction While cash is used in illegal activities such as bribing money laundering tax evasion it also protects privacy: not

More information

Crypto Background & Concepts SGX Software Attestation

Crypto Background & Concepts SGX Software Attestation CSE 5095 & ECE 4451 & ECE 5451 Spring 2017 Lecture 4b Slide deck extracted from Kamran s tutorial on SGX, presented during ECE 6095 Spring 2017 on Secure Computation and Storage, a precursor to this course

More information

CS 361S - Network Security and Privacy Spring Homework #1

CS 361S - Network Security and Privacy Spring Homework #1 CS 361S - Network Security and Privacy Spring 2017 Homework #1 Due: 11am CST (in class), February 13, 2017 YOUR NAME: Collaboration policy No collaboration is permitted on this assignment. Any cheating

More information

Lecture 10, Zero Knowledge Proofs, Secure Computation

Lecture 10, Zero Knowledge Proofs, Secure Computation CS 4501-6501 Topics in Cryptography 30 Mar 2018 Lecture 10, Zero Knowledge Proofs, Secure Computation Lecturer: Mahmoody Scribe: Bella Vice-Van Heyde, Derrick Blakely, Bobby Andris 1 Introduction Last

More information

Modelling and Analysing of Security Protocol: Lecture 1. Introductions to Modelling Protocols. Tom Chothia CWI

Modelling and Analysing of Security Protocol: Lecture 1. Introductions to Modelling Protocols. Tom Chothia CWI Modelling and Analysing of Security Protocol: Lecture 1 Introductions to Modelling Protocols Tom Chothia CWI This Course This course will primarily teaching you: How to design your own secure communication

More information

CS 494/594 Computer and Network Security

CS 494/594 Computer and Network Security CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Real-Time Communication Security Network layers

More information