Datasäkerhetsmetoder föreläsning 7
|
|
|
- Adelia Turner
- 5 years ago
- Views:
Transcription
1 Datasäkerhetsmetoder föreläsning 7 Nyckelhantering Jan-Åke Larsson
2 Cryptography A security tool, not a general solution Cryptography usually converts a communication security problem into a key management problem So now you must take care of the key security problem, which becomes a problem of computer security
3 Key management Cliff Serge Grant The problem is to generate distribute store use revoke the key in a secure way
4 Key generation The key size decides how many different keys you can have, the search space for exhaustive key search If keys are not chosen at random, the attacker can first try more likely keys If all bit combinations are not used, security is given by the number of possible keys, not the size in bits If keys are generated from a known random seed, the size of that seed decides the security
5 Key length
6 Key length Table 7.1: Minimum symmetric key-size in bits for various attackers Attacker Budget Hardware Min security (1996) Hacker 0 PC < $400 PC(s)/FPGA Malware 73 Small organization $10k PC(s)/FPGA Medium organization $300k FPGA/ASIC Large organization $10M FPGA/ASIC Intelligence agency $300M ASIC From ECRYPT II Yearly Report on Algorithms and Keysizes ( )
7 Key length Table 7.1: Minimum symmetric key-size in bits for various attackers Attacker Budget Hardware Min security (1996) Hacker 0 PC < $400 PC(s)/FPGA Malware 77 Small organization $10k PC(s)/FPGA Medium organization $300k FPGA/ASIC Large organization $10M FPGA/ASIC Intelligence agency $300M ASIC From ECRYPT II Yearly Report on Algorithms and Keysizes ( )
8 Key establishment and authentication Cliff Serge Grant Once upon a time, protocols establishing a session key was called authentication protocols This is no longer the case Kerberos (to the left) is known mainly as an authentication protocol The end result is an authorization ticket that contains a session key
9 Key Management The first key in a new connection or association is always delivered via a courier Once you have a key, you can use that to send new keys If Alice shares a key with and shares a key with Bob, then Alice and Bob can exchange a key via (provided they both trust )
10 Key distribution center If Alice shares a key with and shares a key with Bob, then Alice and Bob can exchange a key via (provided they both trust ) Key distribution center K AT, K BT Alice, K AT Bob, K BT
11 Key distribution center If Alice shares a key with and shares a key with Bob, then Alice and Bob can exchange a key via (provided they both trust ) 1: E KAT (ID B K AB ) Key distribution center K AT, K BT Alice, K AT Bob, K BT
12 Key distribution center If Alice shares a key with and shares a key with Bob, then Alice and Bob can exchange a key via (provided they both trust ) 1: E KAT (ID B K AB ) Key distribution center K AT, K BT 2: E KBT (ID A K AB ) Alice, K AT Bob, K BT
13 Key distribution center, key server If Alice shares a key with and shares a key with Bob, then Alice and Bob can receive a key from (provided they both trust ) 1: E KAT (ID B ) Key distribution center K AT, K BT Alice, K AT Bob, K BT
14 Key distribution center, key server If Alice shares a key with and shares a key with Bob, then Alice and Bob can receive a key from (provided they both trust ) Alice, K AT 1: E KAT (ID B ) Key distribution center K AT, K BT 2: E KAT (ID B K AB ) 2: E KBT (ID A K AB ) Bob, K BT
15 Key distribution center If Alice shares a key with and shares a key with Bob, then Alice and Bob can exchange a key via (provided they both trust ) 1: E KAT (ID B K AB ) Key distribution center K AT, K BT 2: E KBT (ID A K AB ) Alice, K AT Bob, K BT
16 Key distribution center, replay attacks But perhaps Eve has broken a previously used key, and intercepts Alice s request Key distribution center K AT, K BT 1: E KAT (ID B K AB ) Eve Alice, K AT Bob, K BT
17 Key distribution center, replay attacks But perhaps Eve has broken a previously used key, and intercepts Alice s request Then she can fool Bob into communicating with her Key distribution center K AT, K BT Alice, K AT 1: E KAT (ID B K AB ) Eve 2: old E KBT (ID A K AB ) Bob, K BT
18 Key distribution center, wide-mouthed frog Alice and add time stamps to prohibit the attack 1: E KAT (t A ID B K AB ) Key distribution center K AT, K BT Alice, K AT Bob, K BT
19 Key distribution center, wide-mouthed frog Alice and add time stamps to prohibit the attack 1: E KAT (t A ID B K AB ) Key distribution center K AT, K BT 2: E KBT (t T ID A K AB ) Alice, K AT Bob, K BT
20 Key distribution center, wide-mouthed frog Alice and add time stamps to prohibit the attack But now, Eve can pretend to be Bob and make a request to 1: E KAT (t A ID B K AB ) Key distribution center K AT, K BT 3: E KBT (t T ID A K AB ) 2: E KBT (t T ID A K AB ) Eve Alice, K AT Bob, K BT
21 Key distribution center, wide-mouthed frog Alice and add time stamps to prohibit the attack But now, Eve can pretend to be Bob and make a request to, who will forward the key to Alice Key distribution center K AT, K BT Eve Alice, K AT Bob, K BT 1: E KAT (t A ID B K AB ) 4: E KAT (t T ID B K AB ) 3: E KBT (t T ID A K AB ) 2: E KBT (t T ID A K AB )
22 Key distribution center, Needham-Schroeder key agreement Another variation is to use nonces to prohibit the replay attack Key distribution center K AT, K BT 1: ID A ID B r 1 Alice, K AT Bob, K BT
23 Key distribution center, Needham-Schroeder key agreement Another variation is to use nonces to prohibit the replay attack Key distribution center K AT, K BT 1: ID A ID B r 1 2: E KAT (K S ID B r 1 E KBT (K S ID A )) Alice, K AT Bob, K BT
24 Key distribution center, Needham-Schroeder key agreement Another variation is to use nonces to prohibit the replay attack Key distribution center K AT, K BT 1: ID A ID B r 1 2: E KAT (K S ID B r 1 E KBT (K S ID A )) 3: E KBT (K S ID A ) Alice, K AT Bob, K BT
25 Key distribution center, Needham-Schroeder key agreement Another variation is to use nonces to prohibit the replay attack Key distribution center K AT, K BT 1: ID A ID B r 1 2: E KAT (K S ID B r 1 E KBT (K S ID A )) 3: E KBT (K S ID A ) Alice, K AT 4: E KS (r 2 ) Bob, K BT
26 Key distribution center, Needham-Schroeder key agreement Another variation is to use nonces to prohibit the replay attack Key distribution center K AT, K BT 1: ID A ID B r 1 2: E KAT (K S ID B r 1 E KBT (K S ID A )) 3: E KBT (K S ID A ) Alice, K AT 4: E KS (r 2 ) 5: E KS (r 2 1) Bob, K BT
27 Key distribution center, Needham-Schroeder key agreement Another variation is to use nonces to prohibit the replay attack If Eve ever breaks one session key, she can get Bob to reuse it Key distribution center K AT, K BT 1: E KBT (K S ID A ) Alice, K AT Eve 2: E KS (r 2 ) 3: E KS (r 2 1) Bob, K BT
28 Kerberos K C, K G Grant K G, K S Cliff K C Serge K S
29 Kerberos K C, K G Grant K G, K S 1 1. Cliff sends ID C ID G Cliff K C Serge K S
30 Kerberos K C, K G Grant K G, K S 2 1 Cliff K C 1. Cliff sends ID C ID G 2. responds width E KC (K CG ) TGT where TGT = ID G E KG (ID C t 1 K GC ) Serge K S
31 Kerberos K C, K G Grant K G, K S Cliff K C 1. Cliff sends ID C ID G 2. responds width E KC (K CG ) TGT where TGT = ID G E KG (ID C t 1 K GC ) 3. Cliff sends Grant E KCG (ID C t 2 ) TGT Serge K S
32 Kerberos K C, K G Grant K G, K S Cliff K C Serge K S 4 1. Cliff sends ID C ID G 2. responds width E KC (K CG ) TGT where TGT = ID G E KG (ID C t 1 K GC ) 3. Cliff sends Grant E KCG (ID C t 2 ) TGT 4. Grant responds with E KCG (K CS ) ST where ST = E KS (ID C t 3 t expir. K CS )
33 Kerberos K C, K G Grant K G, K S Cliff K C 5 Serge K S 4 1. Cliff sends ID C ID G 2. responds width E KC (K CG ) TGT where TGT = ID G E KG (ID C t 1 K GC ) 3. Cliff sends Grant E KCG (ID C t 2 ) TGT 4. Grant responds with E KCG (K CS ) ST where ST = E KS (ID C t 3 t expir. K CS ) 5. Cliff sends Serge E KCS (ID C t 4 ) and can then use Serge s services
34 Kerberos realms K C, K G Grant K G, K S Cliff K C 4 Contains one authentication server (KAS), several authorization servers (TGS), and many services Distributed system, with centralized access control, a single security policy that is easy to check, and change 5 Serge K S A realm often corresponds to a single organization, and several realms can be connected This often is controlled by trust (shared keys), but also other considerations like contractual agreements
35 Controlled invocation in distributed systems K C, K G Grant K G, K S Cliff K C 5 Serge K S 4 The remote program (subject) needs to act on behalf of the user (principal) In Windows AD ( Kerberos), this can be done in two ways Proxy tickets that are limited in the access rights, e.g., to one file for printing it Forwarded TGTs that can be used to apply for new tickets on behalf of the user The latter is like lending out your password for the duration of the ticket
36 Revocation in Kerberos K C, K G Grant K G, K S Cliff K C 4 The access rights of the principal needs to be revoked at the TGS But issued tickets continue to be valid until they expire (TOCTTOU) 5 Typically, KAS tickets is vaild for a day Serge K S There is a tradeoff between convenience (long validity) and fast revocation (short validity)
37 Kerberos, more comments K C, K G Cliff K C 5 Serge K S 4 Grant K G, K S Lots of technical details: Clock sync Timestamp skew window Online servers (Availability) Trusting servers Password security Client machine security DOSing the KAS...
38 Public key distribution, Diffie-Hellmann Diffie-Hellman key exchange is a way to share key Alice and Bob create secrets a and b They send α a mod p and α b mod p to each other Key distribution center K AT, K BT α a mod p Alice, a, K AT Bob, b, K BT α b mod p
39 Public key distribution, Diffie-Hellmann Diffie-Hellman key exchange is a way to share key Alice and Bob create secrets a and b They send α a mod p and α b mod p to each other Both calculate K AB = (α a ) b = (α b ) a mod p Key distribution center K AT, K BT α a mod p K AB = (α b ) a Alice, a, K AT α b mod p Bob, b, K BT K AB = (α a ) b
40 Public key distribution, Diffie-Hellmann Diffie-Hellman key exchange is a way to share key However, Eve can do an intruder-in-the-middle Key distribution center K AT, K BT Alice, a, K AT α a mod p α e mod p Eve α e mod p α b mod p Bob, b, K BT
41 Public key distribution, Station-To-Station (STS) protocol If Alice shares a key with and shares a key with Bob, then Alice and Bob can use to verify that they exchange key with the right person Key distribution center K AT, K BT α a, E KAB (sig A (α a, α b )) Alice, a, K AT Bob, b, K BT α b, E KAB (sig B (α a, α b ))
42 Public key distribution, Station-To-Station (STS) protocol If Alice shares a key with and shares a key with Bob, then Alice and Bob can use to verify that they exchange key with the right person Key distribution center K AT, K BT ver B? α a, E KAB (sig A (α a, α b )) ver A? Alice, a, K AT Bob, b, K BT α b, E KAB (sig B (α a, α b ))
43 Public key distribution, Station-To-Station (STS) protocol If Alice shares a key with and shares a key with Bob, then Alice and Bob can use to verify that they exchange key with the right person Key distribution center K AT, K BT ver B? ver B ver A α a, E KAB (sig A (α a, α b )) ver A? Alice, a, K AT Bob, b, K BT α b, E KAB (sig B (α a, α b ))
44 Public key distribution Public key distribution uses a Public Key Infrastructure (PKI) Certification Authority s T, {e i } Alice, v T, d A Bob, v T, d B
45 Public key distribution, using Certification Authorities Public key distribution uses a Public Key Infrastructure (PKI) Alice sends a request to a Certification Authority (CA) who responds with a certificate, ensuring that Alice uses the correct key to communicate with Bob Certification Authority s T, {e i } 1: ID B Alice, v T, d A 2: e B, sign T (ID B, e B ) Bob, v T, d B
46 Public key distribution, using X.509 certificates The CAs often are commercial companies, that are assumed to be trustworthy Many arrange to have the root certificate packaged with IE, Mozilla, Opera,... They issue certificates for a fee They often use Registration Authorities (RA) as sub-ca for efficiency reasons This creates a certificate chain
47 The content of a X.509 certificate Version (v3) Serial Number Algorithm ID Issuer Validity Period Subject Name Subject Public Key Info (Algorithm, Public Key) Issuer Unique Identifier (optional) Subject Unique Identifier (optional) Extensions (optional) Certificate Signature Algorithm Certificate Signature
48 Revocation Certificate Revocation Lists distributed at regular intervals is the proposed solution in X.509 On-line checks are better, but can be expensive Short-lived certificates are an alternative, but needs frequent certificate changes And the CAs themselves are not the best examples of trustworthy organizations
49 Public key distribution, X.509 (PKIX) certificates in your browser
50 Public key distribution, using web of trust No central CA Fred Alice Bob Users sign each other s public key (hashes) This creates a web of trust Eric Charlie Diana
51 Public key distribution, using web of trust (PGP and GPG) No central CA Fred Alice Bob Users sign each other s public key (hashes) This creates a web of trust Eric Diana Charlie Each user keeps a keyring with the keys (s)he has signed The secret key is stored on a secret keyring, on h{er,is} computer The public key(s) and their signatures are uploaded to key servers
52 Public key distribution, a web-of-trust path
53 Secure Sockets Layer (SSL); Transport Layer Security (TLS) This is a client-server handshake procedure to establish key The server (but not the client) is authenticated (by its certificate) Client Server
54 Secure Sockets Layer (SSL); Transport Layer Security (TLS) ClientHello: highest TLS protocol version, random number, suggested public key systems + symmetric key systems + hash functions + compression algorithms ClientHello Client Server
55 Secure Sockets Layer (SSL); Transport Layer Security (TLS) ClientHello: highest TLS protocol version, random number, suggested public key systems + symmetric key systems + hash functions + compression algorithms ServerHello, Certificate, ServerHelloDone: chosen protocol version, a (different) random number, system choices, public key ClientHello ServerHello,... Client Server
56 Secure Sockets Layer (SSL); Transport Layer Security (TLS) ClientHello: highest TLS protocol version, random number, suggested public key systems + symmetric key systems + hash functions + compression algorithms ServerHello, Certificate, ServerHelloDone: chosen protocol version, a (different) random number, system choices, public key ClientKeyExchange: PreMasterSecret, encrypted with the server s public key ClientHello ServerHello,... Client ClientKeyExchange Server
57 Secure Sockets Layer (SSL); Transport Layer Security (TLS) ClientHello: highest TLS protocol version, random number, suggested public key systems + symmetric key systems + hash functions + compression algorithms ServerHello, Certificate, ServerHelloDone: chosen protocol version, a (different) random number, system choices, public key ClientKeyExchange: PreMasterSecret, encrypted with the server s public key (Master secret): creation of master secret using a pseudorandom function, with the PreMasterSecret as seed (Session keys): session keys are created using the master secret, different keys for the two directions of communication ClientHello ServerHello,... Client ClientKeyExchange Server
58 Secure Sockets Layer (SSL); Transport Layer Security (TLS) ClientHello: highest TLS protocol version, random number, suggested public key systems + symmetric key systems + hash functions + compression algorithms ServerHello, Certificate, ServerHelloDone: chosen protocol version, a (different) random number, system choices, public key ClientKeyExchange: PreMasterSecret, encrypted with the server s public key (Master secret): creation of master secret using a pseudorandom function, with the PreMasterSecret as seed (Session keys): session keys are created using the master secret, different keys for the two directions of communication ChangeCipherSpec, Finished authenticated and encrypted, containing a MAC for the previous handshake messages ClientHello ServerHello,... Client ClientKeyExchange...,Finished Server
59 Secure Sockets Layer (SSL) and Transport Layer Security (TLS) Client ClientHello ServerHello,... ClientKeyExchange...,Finished Server SSL 1.0 (no public release), 2.0 (1995), 3.0 (1996), originally by Netscape TLS 1.0 (1999), TLS 1.1 (2006), TLS 1.2 (2008), and some later changes Current problem: TLS 1.0 is fallback if either end does not support higher versions
60 Key management Cliff Serge Grant The problem is to generate distribute store use revoke the key in a secure way
Cryptography Lecture 9 Key distribution and trust, Elliptic curve cryptography
Cryptography Lecture 9 Key distribution and trust, Elliptic curve cryptography Key Management The first key in a new connection or association is always delivered via a courier Once you have a key, you
KEY AGREEMENT PROTOCOLS. CIS 400/628 Spring 2005 Introduction to Cryptography. This is based on Chapter 13 of Trappe and Washington
KEY AGREEMENT PROTOCOLS CIS 400/628 Spring 2005 Introduction to Cryptography This is based on Chapter 13 of Trappe and Washington DIFFIE-HELLMAN KEY EXCHANGE Alice & want to exchange a ton of data using
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Cryptographic Protocols 1
Cryptographic Protocols 1 Luke Anderson luke@lukeanderson.com.au 5 th May 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Problem with Diffie-Hellman 2.1 Session Hijacking 2.2 Encrypted Key Exchange
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
Fall 2010/Lecture 32 1
CS 426 (Fall 2010) Key Distribution & Agreement Fall 2010/Lecture 32 1 Outline Key agreement without t using public keys Distribution of public keys, with public key certificates Diffie-Hellman Protocol
Protocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh
Protocols II Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 17th February 2011 Outline Introduction Shared-key Authentication Asymmetric authentication protocols
Cristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.
CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How
Spring 2010: CS419 Computer Security
Spring 2010: CS419 Computer Security Vinod Ganapathy Lecture 7 Topic: Key exchange protocols Material: Class handout (lecture7_handout.pdf) Chapter 2 in Anderson's book. Today s agenda Key exchange basics
Chapter 9: Key Management
Chapter 9: Key Management Session and Interchange Keys Key Exchange Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #9-1 Overview Key exchange Session vs. interchange
Today s Lecture. Secure Communication. A Simple Protocol. Remote Authentication. A Simple Protocol. Rules. I m Alice. I m Alice
Today s Lecture Secure Communication Tom Chothia Computer Security, Lecture 8 Protocols in and ob notation Some Key Establishment Protocol Secure Sockets Layer (SSL) / Transport Later Security (TLS) Certificates
Cryptography CS 555. Topic 16: Key Management and The Need for Public Key Cryptography. CS555 Spring 2012/Topic 16 1
Cryptography CS 555 Topic 16: Key Management and The Need for Public Key Cryptography CS555 Spring 2012/Topic 16 1 Outline and Readings Outline Private key management between two parties Key management
Security and Privacy in Computer Systems. Lecture 7 The Kerberos authentication system. Security policy, security models, trust Access control models
CS 645 Security and Privacy in Computer Systems Lecture 7 The Kerberos authentication system Last Week Security policy, security models, trust Access control models The Bell-La Padula (BLP) model The Biba
Chapter 10 Security Protocols
Chapter 10 Security Protocols Up to this point, we have covered many basic cryptographic tools, ranging from encryption algorithms to hash algorithms to digital signatures. A natural question to ask at
From Coulouris, Dollimore and Kindberg Distributed Systems: Concepts and Design. Edition 4 Pearson Education 2005
Chapter 7: Security From Coulouris, Dollimore and Kindberg Distributed Systems: Concepts and Design Edition 4 Introduction Security policies Provide for the sharing of resources within specified limits
Computer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
Cryptography (Overview)
Cryptography (Overview) Some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) Modern secret key cryptography DES, AES Public key cryptography RSA, digital signatures Cryptography
Crypto meets Web Security: Certificates and SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Crypto meets Web Security: Certificates and SSL/TLS Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Authentication in Distributed Systems
Authentication in Distributed Systems Introduction Crypto transforms (communications) security problems into key management problems. To use encryption, digital signatures, or MACs, the parties involved
T Cryptography and Data Security
T-79.4501 Cryptography and Data Security Lecture 10: 10.1 Random number generation 10.2 Key management - Distribution of symmetric keys - Management of public keys Stallings: Ch 7.4; 7.3; 10.1 1 The Use
Applied Cryptography Basic Protocols
Applied Cryptography Basic Protocols Sape J. Mullender Huygens Systems Research Laboratory Universiteit Twente Enschede 1 Session keys It is prudent practice to use a different key for each session. This
Internet security and privacy
Internet security and privacy SSL/TLS 1 Application layer App. TCP/UDP IP L2 L1 2 Application layer App. SSL/TLS TCP/UDP IP L2 L1 3 History of SSL/TLS Originally, SSL Secure Socket Layer, was developed
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL ensures the secure transmission of data between a client and a server through
Topics. Dramatis Personae Cathy, the Computer, trusted 3 rd party. Cryptographic Protocols
Cryptographic Protocols Topics 1. Dramatis Personae and Notation 2. Session and Interchange Keys 3. Key Exchange 4. Key Generation 5. Cryptographic Key Infrastructure 6. Storing and Revoking Keys 7. Digital
Acknowledgments. CSE565: Computer Security Lectures 16 & 17 Authentication & Applications
CSE565: Computer Security Lectures 16 & 17 Authentication & Applications Shambhu Upadhyaya Computer Science & Eng. University at Buffalo Buffalo, New York 14260 Lec 16.1 Acknowledgments Material for some
Outline. Login w/ Shared Secret: Variant 1. Login With Shared Secret: Variant 2. Login Only Authentication (One Way) Mutual Authentication
Outline Security Handshake Pitfalls (Chapter 11 & 12.2) Login Only Authentication (One Way) Login i w/ Shared Secret One-way Public Key Lamport s Hash Mutual Authentication Shared Secret Public Keys Timestamps
Overview. Cryptographic key infrastructure Certificates. May 13, 2004 ECS 235 Slide #1. Notation
Overview Key exchange Session vs. interchange keys Classical, public key methods Key generation Cryptographic key infrastructure Certificates Key storage Key escrow Key revocation Digital signatures May
Cryptographic Checksums
Cryptographic Checksums Mathematical function to generate a set of k bits from a set of n bits (where k n). k is smaller then n except in unusual circumstances Example: ASCII parity bit ASCII has 7 bits;
Kerberos and Public-Key Infrastructure. Key Points. Trust model. Goal of Kerberos
Kerberos and Public-Key Infrastructure Key Points Kerberos is an authentication service designed for use in a distributed environment. Kerberos makes use of a thrusted third-part authentication service
Modelling and Analysing of Security Protocol: Lecture 1. Introductions to Modelling Protocols. Tom Chothia CWI
Modelling and Analysing of Security Protocol: Lecture 1 Introductions to Modelling Protocols Tom Chothia CWI This Course This course will primarily teaching you: How to design your own secure communication
Security Handshake Pitfalls
Security Handshake Pitfalls 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: Authenticate each other Establish sessions keys This process may
Digital Signatures. Public-Key Signatures. Arbitrated Signatures. Digital Signatures With Encryption. Terminology. Message Authentication Code (MAC)
Message Authentication Code (MAC) Key-dependent one-way hash function Only someone with a correct key can verify the hash value Easy way to turn one-way hash function into MAC is to encrypt hash value
Elements of Cryptography and Computer and Network Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy
Elements of Cryptography and Computer and Network Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy Homework 3 Due: Monday, 11/28/2016 at 11:55pm PT Solution: Will be posted
Transport Layer Security
CEN585 Computer and Network Security Transport Layer Security Dr. Mostafa Dahshan Department of Computer Engineering College of Computer and Information Sciences King Saud University mdahshan@ksu.edu.sa
ECE 646 Lecture 3. Key management
ECE 646 Lecture 3 Key management Required Reading Stallings, Cryptography and Network Security: Principles and Practice, 5/E or 6/E Chapter 14 Key Management and Distribution Using the same key for multiple
CS 161 Computer Security
Raluca Ada Popa Spring 2018 CS 161 Computer Security Discussion 6 Week of February 26, 2018 Question 1 TLS threats (10 min) An attacker is trying to attack the company Boogle and its users. Assume that
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 3.3: Security Handshake Pitfalls CSC 474/574 Dr. Peng Ning 1 Authentication Handshakes Secure communication almost always includes an initial authentication
CSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Web Security Web is now widely used by business, government, and individuals But Internet and Web are
KEY DISTRIBUTION AND USER AUTHENTICATION
KEY DISTRIBUTION AND USER AUTHENTICATION Key Management and Distribution No Singhalese, whether man or woman, would venture out of the house without a bunch of keys in his hand, for without such a talisman
CSCI 667: Concepts of Computer Security. Lecture 9. Prof. Adwait Nadkarni
CSCI 667: Concepts of Computer Security Lecture 9 Prof. Adwait Nadkarni 1 Derived from slides by William Enck, Micah Sherr, Patrick McDaniel, Peng Ning, and Vitaly Shmatikov Authentication Alice? Bob?
Network Security CHAPTER 31. Solutions to Review Questions and Exercises. Review Questions
CHAPTER 3 Network Security Solutions to Review Questions and Exercises Review Questions. A nonce is a large random number that is used only once to help distinguish a fresh authentication request from
Authentication Handshakes
AIT 682: Network and Systems Security Topic 6.2 Authentication Protocols Instructor: Dr. Kun Sun Authentication Handshakes Secure communication almost always includes an initial authentication handshake.
Elements of Cryptography and Computer and Network Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy
Elements of Cryptography and Computer and Network Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy Homework 3 Due: Monday, 11/28/2016 at 11:55pm PT Solution: Will be posted
Introduction. Trusted Intermediaries. CSC/ECE 574 Computer and Network Security. Outline. CSC/ECE 574 Computer and Network Security.
Trusted Intermediaries CSC/ECE 574 Computer and Network Security Topic 7. Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center () Representative solution:
Chapter 4: Securing TCP connections
Managing and Securing Computer Networks Guy Leduc Chapter 5: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
Network Security Essentials
Network Security Essentials Fifth Edition by William Stallings Chapter 4 Key Distribution and User Authentication No Singhalese, whether man or woman, would venture out of the house without a bunch of
L7: Key Distributions. Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806
L7: Key Distributions Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806 9/16/2015 CSCI 451 - Fall 2015 1 Acknowledgement Many slides are from or are
CSC 482/582: Computer Security. Security Protocols
Security Protocols Topics 1. Basic Concepts of Cryptography 2. Security Protocols 3. Authentication Protocols 4. Key Exchange Protocols 5. Kerberos 6. Public Key Infrastructure Encryption and Decryption
Issues. Separation of. Distributed system security. Security services. Security policies. Security mechanism
Module 9 - Security Issues Separation of Security policies Precise definition of which entities in the system can take what actions Security mechanism Means of enforcing that policy Distributed system
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Authentication Applications We cannot enter into alliance with neighbouring princes until
Digital Signatures. Secure Digest Functions
Digital Signatures Secure Digest Functions 8 requirements for one-way hash functions given M, H(M) is easy to compute given H(M), M is difficult to compute given M, it is difficult to find M such that
CIS 6930/4930 Computer and Network Security. Topic 7. Trusted Intermediaries
CIS 6930/4930 Computer and Network Security Topic 7. Trusted Intermediaries 1 Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center (KDC) Representative
Lecture 9a: Secure Sockets Layer (SSL) March, 2004
Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Security Achieved by
Unit-VI. User Authentication Mechanisms.
Unit-VI User Authentication Mechanisms Authentication is the first step in any cryptographic solution Authentication can be defined as determining an identity to the required level of assurance Passwords
1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class
1.264 Lecture 27 Security protocols Symmetric cryptography Next class: Anderson chapter 10. Exercise due after class 1 Exercise: hotel keys What is the protocol? What attacks are possible? Copy Cut and
Security Handshake Pitfalls
Hello Challenge R f(k, R f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone can send the challenge R. f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone
Diffie-Hellman. Part 1 Cryptography 136
Diffie-Hellman Part 1 Cryptography 136 Diffie-Hellman Invented by Williamson (GCHQ) and, independently, by D and H (Stanford) A key exchange algorithm o Used to establish a shared symmetric key Not for
Cryptography & Key Exchange Protocols. Faculty of Computer Science & Engineering HCMC University of Technology
Cryptography & Key Exchange Protocols Faculty of Computer Science & Engineering HCMC University of Technology Outline 1 Cryptography-related concepts 2 3 4 5 6 7 Key channel for symmetric cryptosystems
Lecture 1: Course Introduction
Lecture 1: Course Introduction Thomas Johansson T. Johansson (Lund University) 1 / 37 Chapter 9: Symmetric Key Distribution To understand the problems associated with managing and distributing secret keys.
Trusted Intermediaries
AIT 682: Network and Systems Security Topic 7. Trusted Intermediaries Instructor: Dr. Kun Sun Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center (KDC)
AIT 682: Network and Systems Security
AIT 682: Network and Systems Security Topic 7. Trusted Intermediaries Instructor: Dr. Kun Sun Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center (KDC)
Session key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
Computer security Lecture 11
Computer security Lecture 11 Communications and network security Jan-Åke Larsson Communication and network security: Threat model Passive attacks: Eavesdropping, Wiretapping, Sniffing, and Traffic analysis
Key Agreement Schemes
Key Agreement Schemes CSG 252 Lecture 9 November 25, 2008 Riccardo Pucella Key Establishment Problem PK cryptosystems have advantages over SK cryptosystems PKCs do not need a secure channel to establish
Network Security: TLS/SSL. Tuomas Aura T Network security Aalto University, Nov-Dec 2010
Network Security: TLS/SSL Tuomas Aura T-110.5240 Network security Aalto University, Nov-Dec 2010 Outline 1. Diffie-Hellman 2. Key exchange using public-key encryption 3. Goals of authenticated key exchange
Session key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
22-security.txt Tue Nov 27 09:13: Notes on Security Protocols , Fall 2012 Carnegie Mellon University Randal E.
22-security.txt Tue Nov 27 09:13:37 2012 1 Notes on Security Protocols 15-440, Fall 2012 Carnegie Mellon University Randal E. Bryant References: Tannenbaum: 9.1, 9.2 (skip 9.2.3), 9.4.1 BASICS Desired
L13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 8: Protocols for public-key management Ion Petre Department of IT, Åbo Akademi University 1 Key management two problems
CSC/ECE 774 Advanced Network Security
Computer Science CSC/ECE 774 Advanced Network Security Topic 2. Network Security Primitives CSC/ECE 774 Dr. Peng Ning 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange;
Cryptography SSL/TLS. Network Security Workshop. 3-5 October 2017 Port Moresby, Papua New Guinea
Cryptography SSL/TLS Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea 1 History Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent
Public-Key Infrastructure NETS E2008
Public-Key Infrastructure NETS E2008 Many slides from Vitaly Shmatikov, UT Austin slide 1 Authenticity of Public Keys? private key Alice Bob public key Problem: How does Alice know that the public key
TLS. RFC2246: The TLS Protocol. (c) A. Mariën -
TLS RFC2246: The TLS Protocol What does it achieve? Confidentiality and integrity of the communication Server authentication Eventually: client authentication What is does not do Protect the server Protect
Computer Security 3e. Dieter Gollmann. Chapter 15: 1
Computer Security 3e Dieter Gollmann www.wiley.com/college/gollmann Chapter 15: 1 Chapter 15: Key Establishment Chapter 15: 2 Introduction Crypto transforms (communications) security problems into key
Chapter 10: Key Management
Chapter 10: Key Management Session and Interchange Keys Key Exchange Key Generation Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #10-1 Overview Key exchange Session
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
Introduction to Network Security Missouri S&T University CPE 5420 Key Management and Distribution
Introduction to Network Security Missouri S&T University CPE 5420 Key Management and Distribution Egemen K. Çetinkaya Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University
Module: Authentication. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Authentication Professor Trent Jaeger 1 Kerberos History: from UNIX to Networks (late 80s) Solves: password eavesdropping Also mutual authentication
Module: Authentication. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Authentication Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Kerberos History: from UNIX to Networks (late
Security: Focus of Control. Authentication
Security: Focus of Control Three approaches for protection against security threats a) Protection against invalid operations b) Protection against unauthorized invocations c) Protection against unauthorized
Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Security Handshake Pitfalls Login only Mutual
CSCE 813 Internet Security Kerberos
CSCE 813 Internet Security Kerberos Professor Lisa Luo Fall 2017 What is Kerberos? An authentication server system from MIT; versions 4 and 5 Provide authentication for a user that works on a workstation
Security: Focus of Control
Security: Focus of Control Three approaches for protection against security threats a) Protection against invalid operations b) Protection against unauthorized invocations c) Protection against unauthorized
Authentication in real world: Kerberos, SSH and SSL. Zheng Ma Apr 19, 2005
Authentication in real world: Kerberos, SSH and SSL Zheng Ma Apr 19, 2005 Where are we? After learning all the foundation of modern cryptography, we are ready to see some real world applications based
Security Protocols. Professor Patrick McDaniel CSE545 - Advanced Network Security Spring CSE545 - Advanced Network Security - Professor McDaniel
Security Protocols Professor Patrick McDaniel CSE545 - Advanced Network Security Spring 2011 CSE545 - Advanced Network Security - Professor McDaniel 1 Case Study: Host Access The first systems used telnet
Key distribution and certification
Key distribution and certification In the case of public key encryption model the authenticity of the public key of each partner in the communication must be ensured. Problem solution: Certification Authority
13/10/2013. Kerberos. Key distribution and certification. The Kerberos protocol was developed at MIT in the 1980.
Key distribution and certification Kerberos In the case of public key encryption model the authenticity of the public key of each partner in the communication must be ensured. Problem solution: Certification
Key Management. Digital signatures: classical and public key Classic and Public Key exchange. Handwritten Signature
Key Management Digital signatures: classical and public key Classic and Public Key exchange 1 Handwritten Signature Used everyday in a letter, on a check, sign a contract A signature on a signed paper
What did we talk about last time? Public key cryptography A little number theory
Week 4 - Friday What did we talk about last time? Public key cryptography A little number theory If p is prime and a is a positive integer not divisible by p, then: a p 1 1 (mod p) Assume a is positive
SSL/TLS & 3D Secure. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk SSL/TLS & 3DSec 1
SSL/TLS & 3D Secure CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk SSL/TLS & 3DSec 1 SSLv2 Brief History of SSL/TLS Released in 1995 with Netscape 1.1 Key generation algorithm
Transport Layer Security
Cryptography and Security in Communication Networks Transport Layer Security ETTI - Master - Advanced Wireless Telecommunications Secure channels Secure data delivery on insecure networks Create a secure
Network Security. Chapter 7 Cryptographic Protocols
Network Security Chapter 7 Cryptographic Protocols 1 Introduction! Definition: A cryptographic protocol is defined as a series of steps and message exchanges between multiple entities in order to achieve
PROVING WHO YOU ARE TLS & THE PKI
PROVING WHO YOU ARE TLS & THE PKI CMSC 414 MAR 29 2018 RECALL OUR PROBLEM WITH DIFFIE-HELLMAN The two communicating parties thought, but did not confirm, that they were talking to one another. Therefore,
Modern cryptography 2. CSCI 470: Web Science Keith Vertanen
Modern cryptography 2 CSCI 470: Web Science Keith Vertanen Modern cryptography Overview Asymmetric cryptography Diffie-Hellman key exchange (last time) Pubic key: RSA Pretty Good Privacy (PGP) Digital
Key management. Required Reading. Stallings, Cryptography and Network Security: Principles and Practice, 5/E or 6/E
ECE 646 Lecture 3 Key management Required Reading Stallings, Cryptography and Network Security: Principles and Practice, 5/E or 6/E Chapter 14 Key Management and Distribution 1 Using the same key for multiple
Course Administration
Lecture 6: Hash Functions, Message Authentication and Key Distribution CS 392/6813: Computer Security Fall 2010 Nitesh Saxena *Adopted from Previous Lectures by Nasir Memon Course Administration HW3 was
CS 425 / ECE 428 Distributed Systems Fall 2017
CS 425 / ECE 428 Distributed Systems Fall 2017 Indranil Gupta (Indy) Dec 5, 2017 Lecture 27: Security All slides IG Security Threats Leakage Unauthorized access to service or data E.g., Someone knows your
Key Management CS461/ECE422
Key Management CS461/ECE422 1 Reading Chapter 10 in Computer Security: Art and Science Handbook of Applied Cryptography http://www.cacr.math.uwaterloo.ca/hac/ Section 11.3.2 attack on RSA signature Section
ICS 180 May 4th, Guest Lecturer: Einar Mykletun
ICS 180 May 4th, 2004 Guest Lecturer: Einar Mykletun 1 Symmetric Key Crypto 2 Symmetric Key Two users who wish to communicate share a secret key Properties High encryption speed Limited applications: encryption
Information Security & Privacy
IS 2150 / TEL 2810 Information Security & Privacy James Joshi Associate Professor, SIS Lecture 2 Sept 4, 2013 Key Management Network Security 1 Objectives Understand/explain the issues related to, and