CIT 380: Securing Computer Systems. Key Exchange and Public Key Cryptography

Transcription

1 CIT 380: Securing Computer Systems Key Exchange and Public Key Cryptography

2 Topics 1. Key Exchange Problem 2. Public Key Cryptography 3. Diffie-Hellman Key Exchange 4. RSA Cipher 5. Digital Signatures 6. Public Key Infrastructure 7. Key Storage and Revocation

3 Key Exchange Algorithms Goal: Alice, Bob obtain shared secret key. Requirements: Key cannot be sent in clear: Attacker can intercept key. Key can be sent enciphered, or derived from exchanged data plus data not known to an eavesdropper. Alice, Bob may trust third party (Cathy.) All cryptosystems, protocols publicly known Only secret data is keys or data used to derive keys. Anything transmitted is assumed known to attacker.

4 Classical Key Exchange Bootstrap problem: how do Alice, Bob begin? Alice can t send key to Bob in the clear! Assume trusted third party, Cathy Alice and Cathy share secret key k A. Bob and Cathy share secret key k B. Let Cathy generate shared key k s. Cathy can send key securely to either A or B.

5 Simple Key Exchange Protocol { request for session key to Bob } k A Cathy { k s } k A { k s } k B Cathy { k s } k B Alice Bob

6 Protocol Notation X sends Y a message Z encrypted with key k. X Y : {Z} k Concatenation of bit sequences A and B A B Key subscripts indicate ownership k A is the key belonging to user A(lice) k A,B is a key shared by A(lice) and B(ob) Nonces (nonrepeating random numbers) r 1, r 2

7 Key Exchange Protocol Threats { request for session key to Bob } k A { k s } k A { k s } k B Alice { k s } k B Bob Eve Sniffing Replay attacks Modifications

8 Simple Key Exchange Vulnerabilities How does Bob know he is talking to Alice? Replay attack: Eve records message from Alice to Bob, later replays it; Bob may think he s talking to Alice, but he isn t. While Eve can t read message, replay may be enough to become authentication or cause another action. Session key reuse: Eve replays key exchange message from Alice to Bob, so Bob re-uses session key. If Eve knows old key, then she can decrypt communication. If Eve does not, she can collect more data for cryptanalysis.

9 Needham-Schroeder + Denning-Sacco Mod Bob will reject message if timestamp T is too old. Alice Alice Bob r 1 Cathy Alice { Alice Bob r 1 k s { Alice T k s } k B } k A Cathy Alice { Alice T k s } k B Bob Alice { r 2 } k s Bob Alice { r 2 1 } k s Bob

10 Public Key Cryptography Two keys Private key known only to owner. Public key available to anyone. Applications Confidentiality: Sender enciphers using recipient s public key, Receiver deciphers using their private key. Integrity/authentication: Sender enciphers using own private key, Recipient deciphers using sender s public key.

11 Requirements 1. It must be computationally easy to encipher or decipher a message given the appropriate key. 2. It must be computationally infeasible to derive the private key from the public key. 3. It must be computationally infeasible to determine the private key from a chosen plaintext attack.

12 One-Way Trapdoor Functions Trapdoor one-way Function: One-way function whose inverse is easy to calculate only if given a special piece of information. Example: Prime factoring Easy to calculate product. Difficult to calculate prime factors from product. Easy to calculate one prime factor, given others.

13 Diffie-Hellman Key Exchange Compute shared key w/o trusted 3 rd party. Based on discrete logarithm problem Given integers n and g and prime number p, compute k such that n = g k mod p. Solutions known for small p. Computationally infeasible for large p. Shared Constants prime modulus p, integer base g {0, 1, p 1}

14 Algorithm 1. Alice chooses a random private key k 2. Computes public key A = g k mod p and sends to Bob. 3. Bob chooses a random private key k 4. Computes public key B = g k mod p and sends to Alice. 5. Alice computes secret key 1. K 1 = B k mod p 6. Bob computes secret key 1. K 2 = A k mod p 7. Encrypt messages w/ symmetric cipher using K 1 =K 2 as the shared secret key.

15 Example Assume p = 53 and g = 17 Alice chooses k Alice = 5 Then K Alice = 17 5 mod 53 = 40 Bob chooses k Bob = 7 Then K Bob = 17 7 mod 53 = 6 Shared key: Alice computation: K Bob kalice mod p = 6 5 mod 53 = 38 Bob computation: K Alice kbob mod p = 40 7 mod 53 = 38

16 Diffie-Hellman Activity Assume p = 51 and g = 19. Find a student to pair with. Each student picks a random private key. Compute public key with irb. irb(main):001:0> (19**7).modulo(51) => 43 Share your public key with your partner. Compute shared, secret key using irb. Compare shared key with partner. If they match, congratulations! If they don t, find out what went wrong.

17 RSA 1. Modular exponentiation cipher. 2. Treat message blocks as large numbers. 3. Based on the difficulty of factoring large numbers into primes.

18 RSA Algorithm Choose two large prime numbers p, q Let the modular base n = pq. Choose e < n such that e relatively prime to φ(n). Compute inverse of e, d to use as private key. Public key: (e, n) Private key: d Encipher: c = m e mod n Decipher: m = c d mod n

19 Digital Signatures Construct that authenticates origin & contents of message in a manner provable to a disinterested third party ( judge. ) Nonrepudiatable Sender cannot deny having sent message. Proves that sender s key was used to sign message. What if you claim key was stolen/compromised? Court would have to decide.

20 Signing and Verification

21 Cryptographic Key Infrastructure Problem: how to bind identity to key Classical: not possible as all keys are shared Use protocols to agree on a shared key (see earlier.) Public key: bind identity to public key Crucial as people will use key to communicate with principal whose identity is bound to key. Digital signatures require association of key with identity. Assume principal identified by an acceptable name.

22 Certificates Create a token (message) containing: Identity of principal (here, Alice) Corresponding public key Timestamp (when issued) Other information (perhaps identity of signer) signed by trusted authority (Cathy.) C A = { e A Alice T } d C

23 Use Bob downloads Alice s certificate If he knows Cathy s public key, he can decipher the certificate When was certificate issued? Is the principal Alice? Now Bob has Alice s public key. Problem: Bob needs Cathy s PK to validate cert. Problem pushed up a level. Solution: signature chains.

24 Issuers Certification Authority (CA): entity that issues certificates; Cathy, the trusted 3 rd party Multiple issuers pose validation problem. Alice s CA is Cathy; Bob s CA is Don; how can Alice validate Bob s certificate? Have Cathy and Don cross-certify Each CA issues certificate for the other CA. Notation: Certificate X issued for Y X<<Y>>

25 Certificate Signature Chains Create certificate: Generate hash of identification information of requester. Encipher hash with issuer s private key. Validate Obtain issuer s public key. Decipher enciphered hash. Recompute hash from certificate and compare.

26 X.509 (SSL) Certificate Validation Obtain issuer s public key The one for the particular signature algorithm Decipher signature Gives hash of certificate Recompute hash from certificate and compare If they differ, there s a problem Check interval of validity This confirms that certificate is current

27 Pretty Good Privacy (PGP) PGP is the most commonly used encryption system. Follows OpenPGP standard, so other software like GPG can be used compatibly. Problem: how to distribute public keys to mail recipients while binding the keys to the corresponding identities.

28 PGP Key Distribution Two main techniques: 1. Face-to-face key exchange. 2. Key exchange via a trusted 3 rd party. Trusted 3 rd party could be 1. Subject of face-to-face key exchange. 2. Verified by another trusted 3 rd party. Indirect validation results in Signature chains, where there is a path of digital signatures that one can follow to reach a 3 rd party trusted because of face-to-face key exchange.

29 OpenPGP Signature Chains OpenPGP certificates verified via web of trust No hierarchy of CAs to follow like SSL certificates. Certificates can be signed by multiple parties. OpenPGP certificates structured into packets: One public key packet. Zero or more signature packets. Recipient rates trust level of each signature.

30 Validating Certificates Alice needs to validate Bob s OpenPGP cert!: Fred,Giselle,Ellen. Alice gets Giselle s cert Knows Henry slightly, but signature at casual trust. Alice gets Ellen s cert Knows Jack, so uses his cert to validate Ellen s, then hers to validate Bob s. Jack<<Ellen>>Ellen<<Bob>> Arrows show signatures Self signatures not shown Henry Irene Bob Jack Ellen Giselle Fred

31 Storing Keys Multi-user or networked systems: attackers may defeat access control mechanisms. 1. Store encrypted key in local system. Can store in file, database, registry, etc. Decrypted key resident in memory while in use. 2. Use physical devices like smart card. Smart card performs encryption. Computer transfers plaintext to card. Card transfers ciphertext to computer. Card can be stolen, analyzed to find key.

32 Key Revocation Certificates invalidated before expiration Usually due to compromised key. May be due to change in circumstance (e.g., someone leaving company.) Problems Is entity revoking certificate authorized to do so? Can revocation information circulates to everyone quickly enough to avoid a compromise?

33 CRLs A Certificate revocation list lists certificates that are revoked, with their IDs and revocation dates. X.509: only issuer (CA) can revoke certificate. PGP: signers can revoke signatures; owners can revoke certificates, or allow others to do so. Revocation message placed in PGP packet and signed. Flag marks it as revocation message.

34 Key Points 1. Key Exchange Protocol 1. Can exchange keys using a trusted 3 rd party. 2. Must counter replay attacks. 2. Public Key Cryptography 1. Based on one-way trapdoor functions. 2. Diffie-Hellman Key Exchange w/o trusted 3 rd party. 3. Confidentiality: encipher with public, decipher with private 4. Integrity: encipher with private, decipher with public 3. Public Key Infrastructure 1. Manage keys, trust relationships (signature chains). 2. X.509 (SSL) certs use hierarchical system based on CAs. 3. PGP uses web of trust.

35 References 1. Matt Bishop, Introduction to Computer Security, Addison-Wesley, Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone, Handbook of Applied Cryptography, CRC Press, Bruce Schneier, Applied Cryptography, 2 nd edition, Wiley, John Viega and Gary McGraw, Building Secure Software, Addison- Wesley, 2002.