hapter 7: Network security Founations: what is security? cryptography authentication message integrity key istribution an certification Friens an enemies: lice, ob, Truy Figure 7.1 goes here well-known in network security worl ob, lice want to communicate securely Truy, the intruer may intercept, elete, a messages 7: Network Security 1 7: Network Security 2 What is network security? Secrecy: only sener, intene receiver shoul unerstan msg contents sener encrypts msg receiver ecrypts msg uthentication: sener, receiver want to confirm ientity of each other Message Integrity: sener, receiver want to ensure message not altere (in transit, or afterwars) without etection Internet security threats Packet sniffing: broacast meia promiscuous NI reas all packets passing by can rea all unencrypte ata (e.g. passwors) e.g.: sniffs s packets src: est: payloa 7: Network Security 3 7: Network Security 4
Internet security threats IP Spoofing: can generate raw IP packets irectly from application, putting any value into IP source aress fiel receiver can t tell if source is spoofe e.g.: pretens to be Internet security threats Denial of service (DOS): floo of maliciously generate packets swamp receiver Distribute DOS (DDOS): multiple coorinate sources swamp receiver e.g., an remote host -attack src: est: payloa 7: Network Security 5 7: Network Security 6 The language of cryptography Symmetric key cryptography plaintext K ciphertext K plaintext substitution cipher: substituting one thing for another monoalphabetic cipher: substitute one letter for another Figure 7.3 goes here plaintext: abcefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasfghjklpoiuytrewq E.g.: Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc symmetric key crypto: sener, receiver keys ientical public-key crypto: encrypt key public, ecrypt key secret 7: Network Security 7 Q: How har to break this simple cipher?: brute force (how har?) other? 7: Network Security 8
Symmetric key crypto: DES DES: Data Encryption Stanar US encryption stanar [NIST 1993] 56-bit symmetric key, 64 bit plaintext input How secure is DES? DES hallenge: 56-bit-key-encrypte phrase ( Strong cryptography makes the worl a safer place ) ecrypte (brute force) in 4 months no known backoor ecryption approach making DES more secure use three keys sequentially (3-DES) on each atum use cipher-block chaining Symmetric key crypto: DES DES operation initial permutation 16 ientical rouns of function application, each using ifferent 48 bits of key final permutation 7: Network Security 9 7: Network Security 10 Public Key ryptography Public key cryptography symmetric key crypto requires sener, receiver know share secret key Q: how to agree on key in first place (particularly if never met )? public key cryptography raically ifferent approach [Diffie- Hellman76, RS78] sener, receiver o not share secret key encryption key public (known to all) ecryption key private (known only to receiver) Figure 7.7 goes here 7: Network Security 11 7: Network Security 12
Public key encryption algorithms Two inter-relate requirements: 1 2.. nee ( ) an e ( ) such that (e (m)) = m nee public an private keys for (.) an e (.) RS: Rivest, Shamir, elson algorithm RS: hoosing keys 1. hoose two large prime numbers p, q. (e.g., 1024 bits each) 2. ompute n = pq, z = (p-1)(q-1) 3. hoose e (with e<n) that has no common factors with z. (e, z are relatively prime ). 4. hoose such that e-1 is exactly ivisible by z. (in other wors: e mo z = 1 ). 5. Public key is (n,e). Private key is (n,). 7: Network Security 13 7: Network Security 14 RS: Encryption, ecryption 0. Given (n,e) an (n,) as compute above 1. To encrypt bit pattern, m, compute c = me e mo n (i.e., remainer when m is ivie by n) 2. To ecrypt receive bit pattern, c, compute m = c mo n (i.e., remainer when c is ivie by n) RS example: ob chooses p=5, q=7. Then n=35, z=24. e=5 (so e, z relatively prime). =29 (so e-1 exactly ivisible by z. encrypt: letter m m e c = m e mo n l 12 1524832 17 Magic happens! m = (me mo n) mo n ecrypt: c c m = c mo n 17 481968572106750915091411825223072000 12 letter l 7: Network Security 15 7: Network Security 16
RS: Why: m = (me mo n) e (m mo n) mo n = m e mo n mo n Number theory result: If p,q prime, n = pq, then y ymo (p-1)(q-1) x mo n = x mo n e mo (p-1)(q-1) = m mo n (using number theory result above) 1 = m mo n = m (since we chose e to be ivisible by (p-1)(q-1) with remainer 1 ) 7: Network Security 17