Outline More Security Protocols CS 239 Computer Security February 4, 2004
|
|
- Gwendolyn Wright
- 6 years ago
- Views:
Transcription
1 Outline More Security Protocols CS 239 Computer Security February 4, 2004 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and Authentication Usually the first requires the second Not much good to be sure the key is a secret if you don t know who you re sharing it with How can we achieve both goals? In a single protocol With relatively few messages Needham-Schroeder Key Exchange Uses symmetric cryptography equires a trusted authority Who takes care of generating the new key More complicated than some protocols we ve seen Page 3 Page 4 Needham-Schroeder, Step 1 What s the Point of A? A,, A A is nonce chosen by for this invocation of the protocol A random number Not used as a key, so quality of s random number generator not too important Helps defend against replay attacks Page 5 Page 6 1
2 A Needham-Schroeder, Step 2 E KA ( A,,, E KB (,)) What s all this stuff for? Including A prevents replay Including prevents attacker from replacing s identity Including the encrypted message for ensures that message can t be replaced Page 7 Needham-Schroeder, Step 3 E KB (,) So we re done, right? Wrong! KS Page 8 B Needham-Schroeder, Step 4 E KS ( B ) B B Needham-Schroeder, Step 5 E KS ( B -1) Now we re done! B B -1 Page 9 Page 10 What s All This Extra Stuff For? knows she s K K E KB (,) B A talking to K S said she was Can Can said he was E KA ( A,,, jump in later? jump in later? knows he s talking No, only No, all later E KB (,)) to could read the messages will use key package, which created doesn t know Page 11 What s All This Extra Stuff For? What about those random numbers? Page 12 2
3 Causes Problems and do something likes watches the messages they send to do so wants to make them do it again Can replay the conversation? Let s try it without the random numbers Waits For His Chance E KA (,, K A E KB (,)), Page 13 Page 14 What Will Do Now? The message could only have been created by It properly indicates she wants to talk to It contains a perfectly plausible key will probably go ahead with the protocol Page 15 The Protocol Continues steps aside for a bit E KB (,) With no random keys, we re done Page 16 So What s the Problem and agree is their key They both know the key definitely created the key for them Nobody else has the key But... Page 17 Steps Back Into the Picture E KS (Old message 2) can replay and s old conversation E KS (Old message 1) It s using the current key, so and will accept it Page 18 3
4 How Do the andom Numbers Help? s random number assures her that the reply from is fresh But why does need another random number? Page 19 Why Also Needs a andom Number Let s say doesn t want to talk to E KB (,) But wants to think wants to talk Page 20 So What? So, Everything s Fine, ight? E KS (Old message 1) can now play back an old message from to And will have no reason to be suspicious s random number exchange assured Not if any key ever gets divulged Once is divulged, can forge s response to s challenge And convince that he s talking to when he s really talking to him that really wanted to talk Page 21 Page 22 Cracks an Old Key E KS ( B ) E KB KS (K ( S B,) - 1) B B - 1 enlists 10,000 computers belonging to 10,000 grandmothers to crack Unfortunately, knows So can answer s challenge Page 23 Timestamps in Security Protocols One method of handling this kind of problem is timestamps Proper use of timestamps can limit the time during which an exposed key is dangerous But timestamps have their own problems Page 24 4
5 Using Timestamps in the Needham-Schroeder Protocol The trusted authority includes timestamps in his encrypted messages to and Based on a global clock When or decrypts, if the timestamp is too old, abort the protocol Page 25 Using Timestamps to Defeat E KB (,,T X ) E KB (,,T X ) T X << T now T now Now checks T X against his clock So, fearing replay, discards And s attack is foiled T X Page 26 Problems With Using Timestamps They require a globally synchronized set of clocks Hard to obtain, often Attacks on clocks become important They leave a window of vulnerability The Suppress-eplay Attack Assume two participants in a security protocol Using timestamps to avoid replay problems If the sender s clock is ahead of the receiver s, attacker can intercept message And replay later, when receiver s clock still allows it Page 27 Page 28 Handling Clock Problems 1). ely on clocks that are fairly synchronized and hard to tamper Perhaps GPS signals 2). Make all comparisons against the same clock So no two clocks need to be synchronized Page 29 Neuman-Stubblebine Protocol, Step 1, A A What does know? Someone claiming to be wants to talk securely A Page 30 5
6 A Neuman-Stubblebine Protocol, Step 2 knows thinks wants to talk to him But does she, B, E KB (, A,T B ), A,T B A B T B Neuman-Stubblebine Protocol, Step 3 really? Page 31 Page 32 A, A,,T B E KA (, A,,T B ), knows: E KB (,,T B ), B 1. heard her message 2. created a new key, A,T B B T B Neuman-Stubblebine Protocol, Step 4 E KB (,,T B ), B E KB (,,T B ), E KS ( B ) B guarantees knows T B guarantees it s a fresh session checks B and T B B B T B T B Page 33 What Has the Protocol Achieved? and share a key They know the key was generated by knows this key matches her recent request for a key knows this key matches s recent request and s agreement Page 34 What Has the Timestamp Done For and? knows that the whole agreement is timely Since the only timestamp originated with his clock, no danger of suppressreplay attacks What Else Can You Do With Security Protocols? Secret splitting and secret sharing Fair coin flips and other games Simultaneous contract signing Secure elections Zero knowledge proofs off-line Lots of other neat stuff Page 35 Page 36 6
7 Secret Splitting and Secret Sharing What if we have a secret that we need to recover later? We need to have it in other people s hands But we don t want anyone to be able to tell the secret Secret Splitting Divide the secret among two or more people They can combine to retrieve the secret But neither can guess the secret themselves Page 37 Page 38 Secret Splitting Example ecovering the Secret S S S? S S=? M wants to share secret M M` Page 39 Page 40 What If We Want To Do This Securely? What cryptographic steps would we perform to ensure security? That only and have secret components That they have components of the real secret What about ensuring that and both learn the secret if either does? Secret Sharing Say we have three participants,, Carol Can we arrange that: None of them know the secret alone Any pair of them can produce the secret Yes, using various secret sharing protocols Page 41 Page 42 7
8 Bit Commitment wants to make a choice now And prove to what that choice was Without telling him the choice now How can be sure that isn t cheating? E KS Basic Bit Commitment b E KS (,b) E KS (,b) can t tell yet what bit chose E KS (,b) Since doesn t have E KS Page 43 Page 44 E KS Now Claims the Bit Was 1 b E KS (,b) b == 1 E KS E KS (,b) How does prove it? If b == 1, told the truth,b E KS Why Does This Work? can t learn what b was until tells him gives a cryptographic package that she can t change Since the package includes, can t generate two keys, one for 0 and the other for 1 Page 45 Page 46 Making This Work Over the Network What would we have to do if was hanging around trying to screw things up? What if we wanted to keep the value of b secret from? What if we wanted to ensure that couldn t replace s choice? Page 47 Fair Coin Flips Two participants cryptographically flip a coin Based on clever use of bit commitment Cut and choose Basic version assumes no interfering third party And no need for secrecy Similar approaches can work for other games of chance Page 48 8
9 Simultaneous Contract Signing and want to sign a contract But only if each is sure the other also signs Basic method uses an arbitrator Non-arbitrated cryptographic method uses probabilistic outcome Verifying Security Protocols Security protocols are obviously very complicated And any flaw in the protocol can be very expensive Thus, verifying their correctness is of great value How to do it? Page 49 Page 50 Basic Approaches to Verifying Protocols Use standard specification and verification languages and tools Use expert systems Use logics for the analysis of knowledge and beliefs Use formal methods based on algebraic term-rewriting properties of cryptography Using Standard Specification and Verification Tools Treat protocol as a computer program and prove its correctness The oldest approach Using Finite state machines First-order predicate calculus Specification languages Page 51 Page 52 Problems With the Approach Using Expert Systems Very laborious Worse, correctness isn t the same as security The correctness you prove may not have even considered the possibility of certain attacks Too many protocols that have been proven have had security problems Develop an expert system that knows a lot about security protocols un it against proposed protocols In particular, use the expert system to determine if the protocol can reach an undesirable state Such as exposing a secret key Page 53 Page 54 9
10 Problems With the Expert System Approach Good at identifying flaws Provided they are based on already known problems Not so good at proving correctness or security Or at uncovering flaws based on new attacks Using Belief and Knowledge Logics An increasingly popular approach Describe certain properties that a security protocol should have Use logic to demonstrate the presence (or absence) of those properties Page 55 Page 56 BAN Logic Sample BAN Logic Statements Named for its creators (Burrows, Abadi, and Needham) The most popular method of this kind Used to reason about authentication Not other aspects of security Allows reasoning about beliefs in protocols believes X. sees X. said X. X is fresh. Page 57 Page 58 Steps in Applying BAN Logic What Can BAN Logic Do? Convert protocol to an idealized form Add all assumptions about initial state Attach logical formulae to the statements Apply logical postulates to the assertions and assumptions to discover the beliefs of protocol parties Discover flaws in protocols Found flaws in Needham-Schroeder Discover redundancies In Needham-Schroeder, Kerberos, etc. Page 59 Page 60 10
11 Critiques of BAN Logic Using Algebraic Term-ewriting Modeling Methods Translations into idealized protocols may not reflect the real protocol Doesn t address all important security issues for protocols Some feel that BAN logic can deduce characteristics that are obviously false Model the protocol as an algebraic system Express the state of the participants knowledge about the protocol Analyze the attainability of certain states Page 61 Page 62 Use of These Methods Specialized Approaches NL Protocol Analyzer Has discovered flaws in several protocols A relatively new method Weakest link seems to be formalizing protocol into an algebraic system Page 63 Stubblebine & Gligor s method of modeling weak crypto checksums Found problems in Kerberos and Privacy- Enhanced Mail Not useful for other types of analysis Woo-Lam s approach for key distribution protocols Pfitzmann s method for digital signatures There are others Page 64 An Entirely Different Approach Instead of using formal methods to verify security protocols, Use them to develop such protocols Some early work done using this approach Not clear if it will be fruitful Page 65 Bottom Line on Security Protocol Analysis Has been successful in finding some problems No one believes existing methods can find all problems Some knowledgeable observers think no method will ever be able to find all problems So, a useful tool, but not a panacea esearch in this area continues Page 66 11
Outline. More Security Protocols CS 239 Security for System Software April 22, Needham-Schroeder Key Exchange
Outline More Security Protocols CS 239 Security for System Software April 22, 2002 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and
More informationOutline More Security Protocols CS 239 Computer Security February 6, 2006
Outline More Security Protocols CS 239 Computer Security February 6, 2006 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and Authentication
More informationOutline Key Management CS 239 Computer Security February 9, 2004
Outline Key Management CS 239 Computer Security February 9, 2004 Properties of keys Key management Key servers Certificates Page 1 Page 2 Introduction Properties of Keys It doesn t matter how strong your
More informationProtocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh
Protocols II Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 17th February 2011 Outline Introduction Shared-key Authentication Asymmetric authentication protocols
More informationSession key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
More informationSession key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
More informationSEMINAR REPORT ON BAN LOGIC
SEMINAR REPORT ON BAN LOGIC Submitted by Name : Abhijeet Chatarjee Roll No.: 14IT60R11 SCHOOL OF INFORMATION TECHNOLOGY INDIAN INSTITUTE OF TECHNOLOGY, KHARAGPUR-721302 (INDIA) Abstract: Authentication
More informationAuthentication Handshakes
AIT 682: Network and Systems Security Topic 6.2 Authentication Protocols Instructor: Dr. Kun Sun Authentication Handshakes Secure communication almost always includes an initial authentication handshake.
More informationCSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 3.3: Security Handshake Pitfalls CSC 474/574 Dr. Peng Ning 1 Authentication Handshakes Secure communication almost always includes an initial authentication
More informationApplied Cryptography Basic Protocols
Applied Cryptography Basic Protocols Sape J. Mullender Huygens Systems Research Laboratory Universiteit Twente Enschede 1 Session keys It is prudent practice to use a different key for each session. This
More informationElements of Security
Elements of Security Dr. Bill Young Department of Computer Sciences University of Texas at Austin Last updated: April 8, 2015 at 12:47 Slideset 7: 1 Car Talk Puzzler You have a friend in a police state
More information0/41. Alice Who? Authentication Protocols. Andreas Zeller/Stephan Neuhaus. Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken
0/41 Alice Who? Authentication Protocols Andreas Zeller/Stephan Neuhaus Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken The Menu 1/41 Simple Authentication Protocols The Menu 1/41 Simple
More informationApplied Cryptography and Computer Security CSE 664 Spring 2017
Applied Cryptography and Computer Security Lecture 18: Key Distribution and Agreement Department of Computer Science and Engineering University at Buffalo 1 Key Distribution Mechanisms Secret-key encryption
More informationCrypto-systems all around us ATM machines Remote logins using SSH Web browsers (https invokes Secure Socket Layer (SSL))
Introduction (Mihir Bellare Text/Notes: http://cseweb.ucsd.edu/users/mihir/cse207/) Cryptography provides: Data Privacy Data Integrity and Authenticity Crypto-systems all around us ATM machines Remote
More informationBAN Logic. Logic of Authentication 1. BAN Logic. Source. The language of BAN. The language of BAN. Protocol 1 (Needham-Schroeder Shared-Key) [NS78]
Logic of Authentication 1. BAN Logic Ravi Sandhu BAN Logic BAN is a logic of belief. In an analysis, the protocol is first idealized into messages containing assertions, then assumptions are stated, and
More informationSecurity protocols and their verification. Mark Ryan University of Birmingham
Security protocols and their verification Mark Ryan University of Birmingham Contents 1. Authentication protocols (this lecture) 2. Electronic voting protocols 3. Fair exchange protocols 4. Digital cash
More informationLogic of Authentication
Logic of Authentication Dennis Kafura Derived from materials authored by: Burrows, Abadi, Needham 1 Goals and Scope Goals develop a formalism to reason about authentication protocols uses determine guarantees
More informationCryptography and Network Security. Prof. D. Mukhopadhyay. Department of Computer Science and Engineering. Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 38 A Tutorial on Network Protocols
More informationKey Management. Digital signatures: classical and public key Classic and Public Key exchange. Handwritten Signature
Key Management Digital signatures: classical and public key Classic and Public Key exchange 1 Handwritten Signature Used everyday in a letter, on a check, sign a contract A signature on a signed paper
More informationWhat did we talk about last time? Public key cryptography A little number theory
Week 4 - Friday What did we talk about last time? Public key cryptography A little number theory If p is prime and a is a positive integer not divisible by p, then: a p 1 1 (mod p) Assume a is positive
More informationSecurity Handshake Pitfalls
Security Handshake Pitfalls 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: Authenticate each other Establish sessions keys This process may
More informationL7: Key Distributions. Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806
L7: Key Distributions Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806 9/16/2015 CSCI 451 - Fall 2015 1 Acknowledgement Many slides are from or are
More informationCIS 6930/4930 Computer and Network Security. Topic 6.2 Authentication Protocols
CIS 6930/4930 Computer and Network Security Topic 6.2 Authentication Protocols 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake. Authenticate
More informationUser Authentication Protocols Week 7
User Authentication Protocols Week 7 CEN-5079: 2.October.2017 1 Announcement Homework 1 is posted on the class webpage Due in 2 weeks 10 points (out of 100) subtracted each late day CEN-5079: 2.October.2017
More informationSecurity protocols. Correctness of protocols. Correctness of protocols. II. Logical representation and analysis of protocols.i
Security protocols Logical representation and analysis of protocols.i A security protocol is a set of rules, adhered to by the communication parties in order to ensure achieving various security or privacy
More informationChapter 9: Key Management
Chapter 9: Key Management Session and Interchange Keys Key Exchange Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #9-1 Overview Key exchange Session vs. interchange
More informationUser Authentication Protocols
User Authentication Protocols Class 5 Stallings: Ch 15 CIS-5370: 26.September.2016 1 Announcement Homework 1 is due today by end of class CIS-5370: 26.September.2016 2 User Authentication The process of
More informationLecture 1: Course Introduction
Lecture 1: Course Introduction Thomas Johansson T. Johansson (Lund University) 1 / 37 Chapter 9: Symmetric Key Distribution To understand the problems associated with managing and distributing secret keys.
More informationSecurity Handshake Pitfalls
Cryptographic Authentication Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response
More informationLogics of authentication
Archive material from Edition 2 of Distributed Systems: Concepts and Design George Coulouris, Jean Dollimore & Tim indberg 1994 Permission to copy for all non-commercial purposes is hereby granted Originally
More informationSecurity Handshake Pitfalls
Hello Challenge R f(k, R f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone can send the challenge R. f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone
More information1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class
1.264 Lecture 27 Security protocols Symmetric cryptography Next class: Anderson chapter 10. Exercise due after class 1 Exercise: hotel keys What is the protocol? What attacks are possible? Copy Cut and
More informationCS Protocol Design. Prof. Clarkson Spring 2017
CS 5430 Protocol Design Prof. Clarkson Spring 2017 Review Cryptography: Encryption, block ciphers, block cipher modes, MACs, cryptographic hash functions, digital signatures, authenticated encryption,
More informationCryptography CS 555. Topic 16: Key Management and The Need for Public Key Cryptography. CS555 Spring 2012/Topic 16 1
Cryptography CS 555 Topic 16: Key Management and The Need for Public Key Cryptography CS555 Spring 2012/Topic 16 1 Outline and Readings Outline Private key management between two parties Key management
More informationComputer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
More informationCryptographic Checksums
Cryptographic Checksums Mathematical function to generate a set of k bits from a set of n bits (where k n). k is smaller then n except in unusual circumstances Example: ASCII parity bit ASCII has 7 bits;
More information1 Defining Message authentication
ISA 562: Information Security, Theory and Practice Lecture 3 1 Defining Message authentication 1.1 Defining MAC schemes In the last lecture we saw that, even if our data is encrypted, a clever adversary
More informationRobbing the Bank with a Theorem Prover
Robbing the Bank with a Theorem Prover (Transcript of Discussion) Jolyon Clulow Cambridge University So it s a fairly provocative title, how did we get to that? Well automated tools have been successfully
More informationContents Digital Signatures Digital Signature Properties Direct Digital Signatures
Contents Digital Signatures... 197 Digital Signature Properties... 198 Direct Digital Signatures... 198 199...قابلداوری Arbitrated Digital Signatures Arbitrated Digital Signature Technaiques... 200 Authentication
More informationCryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology
Cryptography & Key Exchange Protocols Faculty of Computer Science & Engineering HCMC University of Technology Outline 1 Cryptography-related concepts 2 3 4 5 6 7 Key channel for symmetric cryptosystems
More informationLecture 8 - Message Authentication Codes
Lecture 8 - Message Authentication Codes Benny Applebaum, Boaz Barak October 12, 2007 Data integrity Until now we ve only been interested in protecting secrecy of data. However, in many cases what we care
More informationCryptography and Network Security Chapter 13. Digital Signatures & Authentication Protocols
Cryptography and Network Security Chapter 13 Digital Signatures & Authentication Protocols Digital Signatures have looked at message authentication but does not address issues of lack of trust digital
More informationCSE BAN Logic Presentation
(Mike Burrows Marin Abadi Roger Needham Published 1989 SRC Research Report 9 Presentation by Heather Goldsby Michelle Pirtle "! #! $ % Problem Solution BAN Logic Goals of BAN Terms Symbols Notation and
More informationOverview. Cryptographic key infrastructure Certificates. May 13, 2004 ECS 235 Slide #1. Notation
Overview Key exchange Session vs. interchange keys Classical, public key methods Key generation Cryptographic key infrastructure Certificates Key storage Key escrow Key revocation Digital signatures May
More informationComputer Networks & Security 2016/2017
Computer Networks & Security 2016/2017 Network Security Protocols (10) Dr. Tanir Ozcelebi Courtesy: Jerry den Hartog Courtesy: Kurose and Ross TU/e Computer Science Security and Embedded Networked Systems
More information1 Identification protocols
ISA 562: Information Security, Theory and Practice Lecture 4 1 Identification protocols Now that we know how to authenticate messages using MACs, a natural question is, how can we use MACs to prove that
More informationSecurity and Privacy in Computer Systems. Lecture 7 The Kerberos authentication system. Security policy, security models, trust Access control models
CS 645 Security and Privacy in Computer Systems Lecture 7 The Kerberos authentication system Last Week Security policy, security models, trust Access control models The Bell-La Padula (BLP) model The Biba
More informationCS3235 Seventh set of lecture slides
CS3235 Seventh set of lecture slides Hugh Anderson National University of Singapore School of Computing October, 2007 Hugh Anderson CS3235 Seventh set of lecture slides 1 Warp 9... Outline 1 Public Key
More information6. Security Handshake Pitfalls Contents
Contents 1 / 45 6.1 Introduction 6.2 Log-in Only 6.3 Mutual Authentication 6.4 Integrity/Encryption of Data 6.5 Mediated Authentication (with KDC) 6.6 Bellovin-Merrit 6.7 Network Log-in and Password Guessing
More informationMechanising BAN Kerberos by the Inductive Method
Mechanising BAN Kerberos by the Inductive Method Giampaolo Bella Lawrence C Paulson Computer Laboratory University of Cambridge New Museums Site, Pembroke Street Cambridge CB2 3QG (UK) {gb221,lcp}@cl.cam.ac.uk
More informationFormal Methods for Assuring Security of Computer Networks
for Assuring of Computer Networks May 8, 2012 Outline Testing 1 Testing 2 Tools for formal methods Model based software development 3 Principals of security Key security properties Assessing security protocols
More informationComputer Security. 10. Exam 2 Review. Paul Krzyzanowski. Rutgers University. Spring 2017
Computer Security 10. Exam 2 Review Paul Krzyzanowski Rutgers University Spring 2017 March 23, 2018 CS 419 2017 Paul Krzyzanowski 1 Question 1(a) Suppose you come across some old text in the form GEPPQ
More informationFall 2005 Joseph/Tygar/Vazirani/Wagner Final
CS 161 Computer Security Fall 2005 Joseph/Tygar/Vazirani/Wagner Final PRINT your name:, (last) SIGN your name: (first) PRINT your Unix account name: PRINT your TA s name: You may consult any books, notes,
More informationKEY EXCHANGE AUTHENTICATION AUTHENTICATION AND KEY... ANALYSIS OF AUTHENTICATION... MULTIPLE-KEY PUBLIC-KEY... 68
CHAPTER... 47 KEY EXCHANGE... 47 Key Exchange with Symmetric Cryptograp.. 47 Key Exchange with Public-Key Cryptograp.. 48 Man-in-the-Middle Attack... 48 Interlock Protocol... 49 Key Exchange with Digital
More informationAgreement in Distributed Systems CS 188 Distributed Systems February 19, 2015
Agreement in Distributed Systems CS 188 Distributed Systems February 19, 2015 Page 1 Introduction We frequently want to get a set of nodes in a distributed system to agree Commitment protocols and mutual
More informationUses of Cryptography
Uses of Cryptography What can we use cryptography for? Lots of things Secrecy Authentication Prevention of alteration Page 1 Cryptography and Secrecy Pretty obvious Only those knowing the proper keys can
More informationIntroduction to Cryptography CS 136 Computer Security Peter Reiher October 9, 2014
Introduction to Cryptography CS 136 Computer Security Peter Reiher October 9, 2014 Page 1 Outline What is data encryption? Cryptanalysis Basic encryption methods Substitution ciphers Permutation ciphers
More informationSimple Security Protocols
What is a Protocol? Monday, December 4, 2012 eading: S&M Ch. 9; Schneier Chs. 2-4; Kaufman, Perlman, & Speciner, Ch. 11; Anderson, Ch 3 CS342 Computer Security Department of Computer Science Wellesley
More informationCSCI 667: Concepts of Computer Security. Lecture 9. Prof. Adwait Nadkarni
CSCI 667: Concepts of Computer Security Lecture 9 Prof. Adwait Nadkarni 1 Derived from slides by William Enck, Micah Sherr, Patrick McDaniel, Peng Ning, and Vitaly Shmatikov Authentication Alice? Bob?
More informationEEC-682/782 Computer Networks I
EEC-682/782 Computer Networks I Lecture 25 Wenbing Zhao wenbingz@gmail.com http://academic.csuohio.edu/zhao_w/teaching/eec682.htm (Lecture nodes are based on materials supplied by Dr. Louise Moser at UCSB
More informationCPSC 467b: Cryptography and Computer Security
Outline ZKIP Other IP CPSC 467b: Cryptography and Computer Security Lecture 19 Michael J. Fischer Department of Computer Science Yale University March 31, 2010 Michael J. Fischer CPSC 467b, Lecture 19
More informationSpring 2010: CS419 Computer Security
Spring 2010: CS419 Computer Security Vinod Ganapathy Lecture 7 Topic: Key exchange protocols Material: Class handout (lecture7_handout.pdf) Chapter 2 in Anderson's book. Today s agenda Key exchange basics
More informationLecture 1: Perfect Security
CS 290G (Fall 2014) Introduction to Cryptography Oct 2nd, 2014 Instructor: Rachel Lin 1 Recap Lecture 1: Perfect Security Scribe: John Retterer-Moore Last class, we introduced modern cryptography and gave
More informationCS Protocols. Prof. Clarkson Spring 2016
CS 5430 Protocols Prof. Clarkson Spring 2016 Review: Secure channel When we last left off, we were building a secure channel The channel does not reveal anything about messages except for their timing
More informationFormal Methods for Security Protocols
Role of Temur.Kutsia@risc.uni-linz.ac.at Formal Methods Seminar January 26, 2005 Role of Outline 1 Role of 2 Security Properties Attacker Models Keys Symmetric and Asymmetric Systems 3 Notation and Examples
More informationGrenzen der Kryptographie
Microsoft Research Grenzen der Kryptographie Dieter Gollmann Microsoft Research 1 Summary Crypto does not solve security problems Crypto transforms security problems Typically, the new problems relate
More informationCristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.
CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How
More informationNetwork Security. Chapter 7 Cryptographic Protocols
Network Security Chapter 7 Cryptographic Protocols 1 Introduction! Definition: A cryptographic protocol is defined as a series of steps and message exchanges between multiple entities in order to achieve
More informationCryptographic Protocols 1
Cryptographic Protocols 1 Luke Anderson luke@lukeanderson.com.au 5 th May 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Problem with Diffie-Hellman 2.1 Session Hijacking 2.2 Encrypted Key Exchange
More informationModule: Cryptographic Protocols. Professor Patrick McDaniel Spring CMPSC443 - Introduction to Computer and Network Security
CMPSC443 - Introduction to Computer and Network Security Module: Cryptographic Protocols Professor Patrick McDaniel Spring 2009 1 Key Distribution/Agreement Key Distribution is the process where we assign
More informationIdeal Security Protocol. Identify Friend or Foe (IFF) MIG in the Middle 4/2/2012
Ideal Security Protocol Satisfies security requirements Requirements must be precise Efficient Small computational requirement Small bandwidth usage, network delays Not fragile Works when attacker tries
More informationData Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
More information1 Achieving IND-CPA security
ISA 562: Information Security, Theory and Practice Lecture 2 1 Achieving IND-CPA security 1.1 Pseudorandom numbers, and stateful encryption As we saw last time, the OTP is perfectly secure, but it forces
More informationCS5232 Formal Specification and Design Techniques. Using PAT to verify the Needham-Schroeder Public Key Protocol
CS5232 Formal Specification and Design Techniques Using PAT to verify the Needham-Schroeder Public Key Protocol Semester 2, AY 2008/2009 1/37 Table of Contents 1. Project Introduction 3 2. Building the
More informationCS530 Authentication
CS530 Authentication Bill Cheng http://merlot.usc.edu/cs530-s10 1 Identification vs. Authentication Identification associating an identity (or a claimed identity) with an individual, process, or request
More informationCS61A Lecture #39: Cryptography
Announcements: CS61A Lecture #39: Cryptography Homework 13 is up: due Monday. Homework 14 will be judging the contest. HKN surveys on Friday: 7.5 bonus points for filling out their survey on Friday (yes,
More informationFair exchange and non-repudiation protocols
Fair exchange and non-repudiation protocols Levente Buttyán Laboratory of Cryptography and System Security (CrySyS) Budapest University of Technology and Economics buttyan@crysys.hu 2010 Levente Buttyán
More informationReal-time protocol. Chapter 16: Real-Time Communication Security
Chapter 16: Real-Time Communication Security Mohammad Almalag Dept. of Computer Science Old Dominion University Spring 2013 1 Real-time protocol Parties negotiate interactively (Mutual) Authentication
More informationCS 111. Operating Systems Peter Reiher
Security for Operating Systems: Cryptography, Authentication, and Protecting OS Resources Operating Systems Peter Reiher Page 1 Outline Basic concepts in computer security Design principles for security
More informationICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification Hossen Asiful Mustafa Introduction Entity Authentication is a technique designed to let one party prove the identity of another
More informationLecture 4: Authentication Protocols
Graduate Course on Computer Security Lecture 4: Authentication Protocols Iliano Cervesato iliano@itd.nrl.navy.mil ITT Industries, Inc @ NRL Washington DC http://www.cs.stanford.edu/~iliano/ DIMI, Universita
More informationSecurity Handshake Pitfalls
Security Handshake Pitfalls Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr 1 Cryptographic Authentication Password authentication is subject to eavesdropping Alternative: Cryptographic challenge-response
More informationAcknowledgments. CSE565: Computer Security Lectures 16 & 17 Authentication & Applications
CSE565: Computer Security Lectures 16 & 17 Authentication & Applications Shambhu Upadhyaya Computer Science & Eng. University at Buffalo Buffalo, New York 14260 Lec 16.1 Acknowledgments Material for some
More informationSecurity Analysis of Bluetooth v2.1 + EDR Pairing Authentication Protocol. John Jersin Jonathan Wheeler. CS259 Stanford University.
Security Analysis of Bluetooth v2.1 + EDR Pairing Authentication Protocol John Jersin Jonathan Wheeler CS259 Stanford University March 20, 2008 Version 1 Security Analysis of Bluetooth v2.1 + EDR Pairing
More informationOutline Basics of Data Encryption CS 239 Computer Security January 24, 2005
Outline Basics of Data Encryption CS 239 Computer Security January 24, 2005 What is data encryption? Basic encryption mechanisms Stream and block ciphers Characteristics of good ciphers Page 1 Page 2 Data
More informationDigital Signatures. Secure Digest Functions
Digital Signatures Secure Digest Functions 8 requirements for one-way hash functions given M, H(M) is easy to compute given H(M), M is difficult to compute given M, it is difficult to find M such that
More informationNetwork Security CHAPTER 31. Solutions to Review Questions and Exercises. Review Questions
CHAPTER 3 Network Security Solutions to Review Questions and Exercises Review Questions. A nonce is a large random number that is used only once to help distinguish a fresh authentication request from
More informationSession Key Distribution
Session Key Distribution The TA shares secret keys with network users. The TA chooses session keys and distributes them in encrypted form upon request of network users. We will need to define appropriate
More informationA Limitation of BAN Logic Analysis on a Man-in-the-middle Attack
ISS 1746-7659, England, U Journal of Information and Computing Science Vol. 1, o. 3, 2006, pp. 131-138 Limitation of Logic nalysis on a Man-in-the-middle ttack + Shiping Yang, Xiang Li Computer Software
More information1 A Tale of Two Lovers
CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Dec. 12, 2006 Lecture Notes 19 (expanded): Secure Two-Party Computation Recommended Reading. Goldreich Volume II 7.2.2, 7.3.2, 7.3.3.
More informationCS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 9 March 30, 2011 Question 1 Another Use for Hash Functions (8 min) The traditional Unix system for password authentication works more or less like
More informationKey Agreement. Guilin Wang. School of Computer Science, University of Birmingham
Key Agreement Guilin Wang School of Computer Science, University of Birmingham G.Wang@cs.bham.ac.uk 1 Motivations As we know, symmetric key encryptions are usually much more efficient than public key encryptions,
More informationIntroduction. Trusted Intermediaries. CSC/ECE 574 Computer and Network Security. Outline. CSC/ECE 574 Computer and Network Security.
Trusted Intermediaries CSC/ECE 574 Computer and Network Security Topic 7. Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center () Representative solution:
More informationOutline. Login w/ Shared Secret: Variant 1. Login With Shared Secret: Variant 2. Login Only Authentication (One Way) Mutual Authentication
Outline Security Handshake Pitfalls (Chapter 11 & 12.2) Login Only Authentication (One Way) Login i w/ Shared Secret One-way Public Key Lamport s Hash Mutual Authentication Shared Secret Public Keys Timestamps
More informationChapter 13. Digital Cash. Information Security/System Security p. 570/626
Chapter 13 Digital Cash Information Security/System Security p. 570/626 Introduction While cash is used in illegal activities such as bribing money laundering tax evasion it also protects privacy: not
More informationCrypto Background & Concepts SGX Software Attestation
CSE 5095 & ECE 4451 & ECE 5451 Spring 2017 Lecture 4b Slide deck extracted from Kamran s tutorial on SGX, presented during ECE 6095 Spring 2017 on Secure Computation and Storage, a precursor to this course
More informationCS 361S - Network Security and Privacy Spring Homework #1
CS 361S - Network Security and Privacy Spring 2017 Homework #1 Due: 11am CST (in class), February 13, 2017 YOUR NAME: Collaboration policy No collaboration is permitted on this assignment. Any cheating
More informationLecture 10, Zero Knowledge Proofs, Secure Computation
CS 4501-6501 Topics in Cryptography 30 Mar 2018 Lecture 10, Zero Knowledge Proofs, Secure Computation Lecturer: Mahmoody Scribe: Bella Vice-Van Heyde, Derrick Blakely, Bobby Andris 1 Introduction Last
More informationModelling and Analysing of Security Protocol: Lecture 1. Introductions to Modelling Protocols. Tom Chothia CWI
Modelling and Analysing of Security Protocol: Lecture 1 Introductions to Modelling Protocols Tom Chothia CWI This Course This course will primarily teaching you: How to design your own secure communication
More informationCS 494/594 Computer and Network Security
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Real-Time Communication Security Network layers
More information