Network Security (2) CPSC 441 Department of Computer Science University of Calgary

Transcription

1 Network Security (2) CPSC 441 Department of Computer Science University of Calgary 1

2 Friends and enemies: Alice, Bob, Trudy well-known in network security world Bob, Alice (lovers!) want to communicate securely Trudy (intruder) may intercept, delete, add messages Alice channel data, control messages Bob data secure sender secure receiver data Trudy

3 Goals of Cryptography Confidentiality: only sender, intended receiver should understand message contents sender encrypts message receiver decrypts message Authentication: sender, receiver want to confirm identity of each other Message integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection Access and availability: services must be accessible and available to users

4 There are bad guys (and girls) out there! Q: What can a bad guy do? A: A lot! eavesdrop: intercept messages actively insert messages into connection impersonation: can fake (spoof) source address in packet (or any field in packet) hijacking: take over ongoing connection by removing sender or receiver, inserting himself in place denial of service: prevent service from being used by others (e.g., by overloading resources)

5 The language of cryptography K A Alice s encryption key Bob s decryption K B key plaintext encryption algorithm ciphertext decryption algorithm plaintext m plaintext message K A (m) ciphertext, encrypted with key K A m = K B (K A (m)) 5

6 Simple encryption scheme substitution cipher: substituting one thing for another monoalphabetic cipher: substitute one letter for another plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasdfghjklpoiuytrewq E.g.: Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc Key: the mapping from the set of 26 letters to the set of 26 letters 6

7 Breaking an encryption scheme Cipher-text only attack: Trudy has ciphertext that she can analyze Two approaches: Search through all keys: must be able to differentiate resulting plaintext from gibberish Statistical analysis Known-plaintext attack: trudy has some plaintext corresponding to some ciphertext eg, in monoalphabetic cipher, trudy determines pairings for a,l,i,c,e,b,o, Chosen-plaintext attack: trudy can get the cyphertext for some chosen plaintext 7

8 Types of Cryptography Crypto often uses keys: Algorithm is known to everyone Only keys are secret Public key cryptography Involves the use of two keys Symmetric key cryptography Involves the use one key Hash functions Involves the use of no keys Nothing secret: How can this be useful? 8

9 Symmetric key cryptography K S K S plaintext message, m encryption algorithm ciphertext K S (m) decryption algorithm plaintext m = K S (K S (m)) symmetric key crypto: Bob and Alice share same (symmetric) key: K S e.g., key is knowing substitution pattern in mono alphabetic substitution cipher Q: how do Bob and Alice agree on key value? 9

10 Public Key Cryptography symmetric key crypto requires sender, receiver know shared secret key Q: how to agree on key in first place (particularly if never met )? public key cryptography radically different approach [Diffie- Hellman76, RSA78] sender, receiver do not share secret key public encryption key known to all private decryption key known only to receiver 10

11 Public key cryptography + K B - K B Bob s public key Bob s private key plaintext message, m encryption algorithm ciphertext + K (m) B decryption algorithm plaintext message - + m = K (K (m)) B B 11

12 Public key encryption algorithms Requirements: B - + B need K ( ) and K ( ) such that K (K (m)) = m B B given public key K B, it should be impossible to compute private - key K B + RSA: Rivest, Shamir, Adelson algorithm 12

13 Message Integrity Allows communicating parties to verify that received messages are authentic. Content of message has not been altered Source of message is who/what you think it is Message has not been replayed Sequence of messages is maintained Let s first talk about message digests 13

14 Message Digests Function H( ) that takes as input an arbitrary length message and outputs a fixed-length string: message signature Note that H( ) is a manyto-1 function H( ) is often called a hash function large message m Desirable properties: Easy to calculate H: Hash Function H(m) Irreversibility: Can t determine m from H(m) Collision resistance: Computationally difficult to produce m and m such that H(m) = H(m ) Seemingly random output 14

15 Internet checksum: poor message digest Internet checksum has some properties of hash function: produces fixed length digest (16-bit sum) of input is many-to-one But given message with given hash value, it is easy to find another message with same hash value. Example: Simplified checksum: add 4-byte chunks at a time: message ASCII format message ASCII format I O U 1! ! 9 B O B! 49 4F 55 31! E 39! D2 42! I O U 9! ! 9 B O B! 49 4F 55 39! E 31! D2 42! B2 C1 D2 AC! different messages but identical checksums! B2 C1 D2 AC! 15

16 Hash Function Algorithms MD5 hash function widely used (RFC 1321) computes 128-bit message digest in 4-step process. SHA-1 is also used. US standard [NIST, FIPS PUB 180-1] 160-bit message digest 16

17 Message Authentication Code (MAC) s s = shared secret message message s message H( ) H( ) compare Authenticates sender Verifies message integrity No encryption! Also called keyed hash Notation: MD m = H(s m) ; send m MD m 17

18 End-point authentication Want to be sure of the originator of the message end-point authentication. Assuming Alice and Bob have a shared secret, will MAC provide end-point authentication. We do know that Alice created the message. But did she send it? 18

19 Playback attack MAC = f(msg,s) Transfer $1M from Bill to Trudy MAC Transfer $1M from Bill to Trudy MAC

20 Defending against playback attack: nonce I am Alice R MAC = f(msg,s,r) Transfer $1M from Bill to Susan MAC

21 Digital Signatures Cryptographic technique analogous to handwritten signatures. sender (Bob) digitally signs document, establishing he is document owner/creator. Goal is similar to that of a MAC, except now use public-key cryptography verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document 21

22 Digital signature = encrypted message digest Bob sends digitally signed message: large message m + Bob s private key H: Hash function - K B H(m) digital signature (encrypt) encrypted msg digest - K B (H(m)) Alice verifies signature and integrity of digitally signed message: large message m H: Hash function H(m) Bob s public key + K B equal? encrypted msg digest - K B (H(m)) digital signature (decrypt) H(m) 22

23 Digital Signatures (more) Suppose Alice receives msg m, digital signature K B (m) Alice verifies m signed by Bob by applying Bob s public key K B to K B (m) then checks K B (K B (m) ) = m. If K B (K B (m) ) = m, whoever signed m must have used Bob s private key. Alice thus verifies that: Bob signed m. No one else signed m. Bob signed m and not m. Non-repudiation: Alice can take m, and signature K B (m) to court and prove that Bob signed m. 23

24 Certification Authorities Certification authority (CA): binds public key to particular entity, E. E (person, router) registers its public key with CA. E provides proof of identity to CA. CA creates certificate binding E to its public key. certificate containing E s public key digitally signed by CA CA says this is E s public key Bob s identifying information Bob s public + key K B digital signature (encrypt) CA private key K - CA + K B certificate for Bob s public key, signed by CA 24

25 Certification Authorities (CA) When Alice wants Bob s public key: gets Bob s certificate (Bob or elsewhere). apply CA s public key to Bob s certificate, get Bob s public key + K B digital signature (decrypt) + K B Bob s public key CA public key K + CA 25

26 DigiNotar CA Breach Story: A hacker (or a group of hackers) hacked the DigiNotar CA servers and issued more than 500 fraudulent certificates. The certificates has been later used to spy on some 300,000 Iranians. DigiNotar filed for bankruptcy in a Netherland court. 26

27 DigiNotar CA Breach Dutch government announced that because of the breach, "it could not guarantee the security of its own Web sites. The list of fraudulent certificates contains Google, Skype, Microsoft, Mozilla, yahoo, tor as well as the CIA, Israel s Mossad and the UK s MI6. All of the major browser makers -- Apple, Google, Microsoft, Mozilla and Opera -- issued updates and considered DigiNotar issued certificates invalid. 27

28 DigiNotar CA Breach The Fox-IT report states that: The most critical servers contain malicious software that can normally be detected by anti-virus software CA-servers, although physically very securely placed, were accessible over the network from the management LAN. The password was not very strong and could easily be brute-forced. All CA servers were members of one Windows domain, i.e. they were accessible using one obtained user/pass combination. 28

29 Most of the slides are taken from the slides of the following book, Computer Networking: A Top Down Approach, 5 th edition. Jim Kurose, Keith Ross Addison-Wesley, April 2009.