Using a Packet Sniffer to Analyze the Efficiency and Power of Encryption Techniques Used to Protect Data Over a Computer Network

Transcription

1 sig a Packet Siffer to Aalyze the Efficiecy ad Power of Ecryptio Techiques sed to Protect Data Over a Coputer Network Seyo Litviov Statistics Departet/MCS Progra St. Cloud State iversity slitviov@stcloudstate.edu Deis Guster Statistics Departet/MCS Progra St. Cloud State iversity guster@cs.stcloudstate.edu David Robiso Statistics Departet St. Cloud State iversity rob@stcloudstate.edu Abdullah Alhaaah Statistics Departet/MCS Progra St. Cloud State iversity alhaaah@hotail.co Abstract The proble of defedig agaist security attacks o iteret traffic has becoe paraout i the last few years. Oe cooly used tool to cobat hackers is ecryptio. Therefore, educatig future etworkig studets about the power of ecryptio ad the overhead it places o etwork perforace is iportat to their uderstadig of its place i the etwork desig process. Therefore, this study exaies the power of three types of ecryptio techiques ad the additioal overhead geerated o a coputer etwork whe ecrypted files are trasitted.

2 Itroductio The explosio of traffic o the Iteret is the result of ay users atteptig to coplete useful ad private iforatio exchages. fortuately, just as the uber of users has icreased, so has the uber of hackers atteptig to coproise the total privacy ost users seek. The accepted ethod of helpig isure that privacy is soe type of ecryptio. However, ay people do ot realize that akig a decisio to ecrypt data ca have a ipact o etwork perforace, ad ecryptio techiques vary i power. To clarify these relatioships, this study will use a case study approach to ivestigate the effect ecryptio has o etwork throughput, radoess of payload, packet size, ad packet iter-arrival ties. A series of data blocks of various sizes will be idetified ad readied for trasissio across a switched etheret etwork. A oitor workstatio (packet siffer) will be placed o the etwork so that the characteristics of each packet set ca be recorded ad aalyzed at a later tie. Each of the data blocks idetified earlier will be trasitted twice. Oce i oral ualtered for ad oce i ecrypted for. po copletio of the experiet overhead relatig to both server ad etwork ifrastructure will be deteried. This process will be repeated for each ecryptio algorith studied. The files used durig the oitorig process will also be used to provide soe isight ito how powerful (hard to break) a give algorith is. Ecrypted payloads will be subjected to a test of radoess of characters. It is assued, based o the theory of etropy, that data streas cotaiig Eglish text would have certai letters such as e or a appear ore tha x or z ad, therefore, give potetial code breakers isight ito how to forulate their code-breakig strategies. Reducig or eliiatig these patters is critical to esurig data privacy ad, therefore, the test proposed will provide soe isight ito the power of algoriths utilized. derstadig these power differeces is especially iportat for studets just begiig their istructioal career i etworkig. Therefore, it is critical that these studets develop a uderstadig of the iterrelatioships betwee ecryptio ad coputer etwork perforace, specifically the additioal overhead associated with ecryptig files or data streas. There is little doubt that coputer security withi the iteret is oe of the preiere probles i coputer etworkig today [-8]. Too ofte studets view the proble rather siplistically, that is, they feel that a ecryptio progra o the sedig side atched with a decryptio progra o the other side is the prescriptio to cure the hackig probles. They give little thought to the developet of a coprehesive security pla ad are uaware of ay adverse effects ipleetatio of ecryptio ay cause. Furtherore, they have little cocept regardig the effectiveess of various ecryptio techiques.

3 Perforace I ost cases, eployig ecryptio has a adverse effect o etwork perforace. The level of this degradatio is a fuctio of the ecryptio algorith eployed. For siple techiques such as character substitutio there is little or o overhead. However, for today s ore secure techiques such as RSA (Rivest, Shair & Adlea) there is sigificat overhead. I fact, it ca be expected that a file ecrypted i RSA will be several ties larger tha the origial uecrypted versio. This icrease i file size icreases the volue of iforatio that ust be trasitted over the etwork. The degree to which etwork perforace will be iflueced is related to the volue of iforatio trasitted ad how the iterarrival ties of the packets carryig that iforatio are distributed. Geerally speakig, lightly loaded etworks are goig to be less affected tha heavily loaded etworks. Also at issue is how well the traffic atches the MT (axiu trasissio uit) of the etwork ifrastructure. For exaple, etheret has a liitatio of approxiately 500 bytes. If the ecrypted file does ot seget well i this eviroet, it results i a icrease of the uber of packets set beyod the expected ratio. I tur, this situatio plus the larger uber of expected packets based o the ecrypted file s larger size could easily geerate a uch saller packet iterarrival ea. Also, the distributio of this packet strea could provide further risk to the goal of processig iforatio i a tiely aer. Power of Ecryptio There are a wide variety of ecryptio algoriths of varyig degrees of sophisticatio. No atter their degree of sophisticatio, a coo goal is to ake it too difficult ad too tie cosuig for would-be hackers to break the. Historically, oe tool eployed was ituitio based o the expected frequecy of letters used i the laguage of questio. this ethod draws o the theory of etrophy [9]. For exaple, i Eglish, it would be expected that e would appear 2.7 percet ad a little-used character such as z would appear.07 percet of the tie. This kowledge ca be a powerful decryptio tool i siple substitutio ad cipher ethods, but is less powerful i ore sophisticated keybased ethods such as RSA. Explorig this cocept is a excellet startig poit of aalysis for studets just begiig the study of cryptography. It is iportat for the to uderstad the added sophisticatio algoriths such as RSA ad DES provide beyod substitutios ad ciphers. Oe way to approach this beyod explaiig the forulas is to calculate a coefficiet of radoess withi the origial ad ecrypted versios of that file. Operatig uder the assuptio that the origial text will follow expected frequecy of letters withi the Eglish laguage. To accoplish this goal, two approaches were used. First, a series of four files were copared to a uifor distributio. These files were as follows:

4 a ecrypted text file cotai 402 (o-blak) characters that sae file ecrypted by substitutio also 402 characters that sae file ecrypted by cipher also cotaiig 402 characters that sae file ecrypted by RSA cotaiig 225 characters The chi square statistic eployed to deterie copliace to a uifor distributio revealed that oe of the files followed a uifor distributio, that is, a distributio i which all characters appeared with equal frequecy. The logic beig that if the character distributio is truly uifor, the ituitio through etrophy caot be eployed to break the code. Table depicts the chi square values obtaied fro the aalysis. Although all were statistically sigificat, the agitudes of the values reveal that certai ecryptio ethods resulted i a file that was ore uifor tha others. Specifically, the RSA was closest to the uifor while the ecrypted ad substitutio file both deviated equally fro that distributio. While the cipher distributio fell soewhere betwee the substitutio ad the RSA. Therefore, oe could coclude that if etrophy were used as the decodig ethod, that the RSA would be the ost difficult to decode sice its characters are the ost uiforly distributed of the three ecryptio techiques. Table Copliace to a ifor Distributio # of characters chi square value sig uecrypted substitutio cipher RSA Although coparisos to uifor distributios yield soe useful evidece cocerig the radoess of characters, the process lacks sophisticatio ad it is difficult to ake iterval level copariso with the chi square statistic. Therefore, the followig algorith is offered to ascertai radoess withi data files. This exaple is preseted i biary for the sake of siplicity ad is based o a idea posed by Michael Guysisky curretly at Tufts iversity. Methodology for Coefficiet of Ecryptio Power Let W x x... =, { 0,} 2 x N x i be a biary word to be exaied for radoess. If we itroduce a otatio W = x x... x, +

5 N with N, the W is a subword of W, ad we have W = W. Our ispectio is based o the followig procedure. With every = 3,..., N we associate a uber easurig how expected is x with respect to the precedig word W : [ W / x W ] # [ W W ] #, = = 2 where # [ W W ] ad # [ ] W / x W are, respectively, the uber of subwords of the for those words aog the followed by x. Now we su the ubers Note that the coefficiet subwords of W. i up which yields the forula [ W / x W ] [ W W ] # =. W N = 3 = 2 # W ad the uber of is a weight ad is desiged to balace ipacts fro loger Hypothesis. The saller W is, the ore rado is the word W. Exaple. Let W 00000, ad W I both cases, N = 8. For W, we get = 3 = 4 = 0, = 5 2, = + =, 7 = + + =, = = = 3 6 which iplies that W =.69 For W 2,

6 2 3 = 4 = 6 = 0, 5 = 7 =, 8 = + =, therefore As it was expected, W < 2 W. = W 2 Table 2 presets the value of the coefficiets obtaied whe applyig the algorith to the sae files used i Table. For the ost part, the agitude is what would be expected with the exceptio of the substitutio file. That is, the value obtaied would be expected to be lower tha that of the uecrypted file. However, this is ot totally uexpected i that although a ethod of ecryptio substitutio lacks sophisticatio. I fact, whe copared to a uifor distributio, the substitutio ethod yielded the sae chi square as the uecrypted file..24 Table 2 Applicatio of the Ecryptio Power Coefficiet uecrypted 37.5 substitutio cipher RSA 5.99 However, the rest of the values appear to scale icely as expected. I fact, the value of 5.99 provides further idicatio of its power beyod the other ethods exaied i Table 2. Although the results of the applicatio of this algorith are ecouragig, it still eeds to be tested agai. These tests should iclude uerous files ecrypted by algoriths of kow sophisticatio before its true validity ca be established. The Effect of Ecryptio i the Packet Strea A reexaiatio of Table reveals that soe ecryptio techiques, i this case RSA, result i a uch larger file whe ecrypted. I the Table exaple, the uecrypted file was 402 while the ecrypted file was 225 bytes. I ost cases users are ore tha willig to accept the trade off of additioal bytes to trasit for better security. However, what effect does this additioal overhead pose upo etwork perforace? To help aswer this questio, the experiet usig a packet siffer was udertake. First ad stadard text file cotaiig 566 KBs was selected, ad a RSA ecrypted versio was copiled. The ecrypted versio cotaied. MBs. Files of this size were used istead of the oes fro Table so that ultiple data packets would be required to trasit the

7 data istead of the oe or two packets required for the Table files (assuig 500 MT for etheret). First, the uecrypted file was trasitted fro a saba cliet to a saba server. Durig this trasissio a packet siffer coected to the sae collisio doai trapped ad oitored all packet traffic betwee these odes ad associated processes. This traffic was logged for further aalysis. The sae procedure was also applied to the ecrypted file. Table 3 displays the results of this packet traffic. As would be expected, the sessio legth for the file trasfer was less for the uecrypted file, 8.8 secods versus 0.4 secods for the ecrypted file. these values ay be soewhat isleadig sice there was other packet traffic ruig at the tie of both sessios. It is doubtful that this backgroud oise affected both sessios equally. Table 3 Packet Traffic Treds Sessio Duratio sec sec # of overhead #of data # of overhead bytes # of data bytes The uber of overhead packets for the ecrypted files was ore tha three ties greater tha the uecrypted file while its origial file size was oly oe-half the ecrypted file. There is a siilar disparity i the uber of data packets as well. However, the uber of overhead bytes coes close to the expected two to oe ratio. The uber of data bytes poses a iterestig questio that is, why i both cases are they saller tha the origial file size? The aswer lies i the aer i which the files are packetized by SMB cliet. I this ethod a lie of text is loaded i the packet util a carriage retur ad a lie feed are ecoutered. po detectio of these characters the rest of the lie is igored, ad the packetizatio process cotiues with the ext lie. This process of igorig the rest of the lie thereby copresses out blaks ad reduces the uber of bytes that eed to be trasitted across the etwork. It is iterestig to ote that there were about four ties as ay bytes that had to be trasitted i the ecrypted file which ay be idicative i this case that the copressio was less efficiet. Suary ad Coclusios It is clear that a little experietatio ca verify what is expected theoretically ad at the sae tie be useful to help to explai coplex etworkig/ecryptio cocepts to studets. I this paper a quick aalysis of file ecryptio techiques deteried that

8 cipher was ore powerful tha substitutio ad the RSA techique the best of three techiques exaied. This basic process could be expaded to iclude a uber of other ad ore powerful algoriths if desired. More sophisticatio could also be added to the packet strea aalysis. It is very difficult to get studets to realize that there is a sigificat aout of overhead takig place i etwork trasissio. I fact, i the exaple provided there were ore overhead tha data packets. Although as a percetage of bytes trasitted the overhead packets oly ade up 4 to 6 percet of the traffic, their presece is still worth otig i etwork desig activities. Refereces Cited. Earls, Ala R. Betwee the Cracks. Coputer World, February 997: 2. Erst & Youg. Iforatio Security Survey: Aalysis of Treds, Issues & Practices: O Higgis, Bria. Itraet Security: Beyod Firewalls. Electroic Coerce World, March, 997: Strassa, Paul. What s the Best IS Defese? Beig Prepared. Coputer World. February, Vacca, Joh. Iteret Security Secrets. Foster City, CA: IDG Books Ic., Wood, Charles C. Policies fro the Groud p. Ifo Security News. Jauary, Bhiai, Aish. Securig the Coercial Iteret. Couicatios of the ACM, 39:6, Fik, D. Iforatio Techology Security Maagig Challeges ad Creatig Opportuities, CCH Publishers, Sydey, Hakerso, D.R., et.al. Codig Theory ad Cryptography: The Essetials. New York, Marcel Dekker, Ic., Mel, H.X. & Baker, Doris. Cryptography Decrypted. Bosto: Addiso-Wesley, 200.