Web Security (SSL) Tecniche di Sicurezza dei Sistemi 1

Web Security (SSL) Tecniche di Sicurezza dei Sistemi 1

How the Web Works - HTTP Hypertext transfer protocol (http). Clients request documents (or scripts) through URL. Server response with documents. Documents are not interpreted by http. Stateless protocol, request are independent. Tecniche di Sicurezza dei Sistemi 2

How the Web Works: Other Elements Hyper-text markup language (html). Other application specific document. E.G., MIME, graphics, video/audio, postscript, Java applets, etc. Browsers. Display html documents and embedded graphics. Run Java program. Start helper applications.... Tecniche di Sicurezza dei Sistemi 3

Web Vulnerabilities http://www.w3.org/security/faq Revealing private information on server Intercept of client information Execute unauthorized programs Denial of service... Tecniche di Sicurezza dei Sistemi 4

Web Vulnerabilities: cgi-bin cgi-bin: server-side side includes If random arguments are allowed Web server program should run under a particular UID (e.g., www, nobody) Tecniche di Sicurezza dei Sistemi 5

Web Security Authentication: Basic (username, password) Can be used along with cookie Digest Access control via addresses Multi-layered: layered: S-http (secure http), just for http Proposed by CommerceNet,, pretty much dead SSL (TLS), generic for TCP https: http over SSL IPSec Tecniche di Sicurezza dei Sistemi 6

HTTP Authentication - Basic Client doesn t know which method Client attempts access (GET, PUT, ) normally Server returns 401 unauthorized Realm: protection space Client tries again with (user:password) Passwords in the clear Repeated for each access Tecniche di Sicurezza dei Sistemi 7

From Basic Authentication to Forms and Cookies Not all sites use basic authentication Many instead ask the user to type username/password into a HTML form Server looks up the user and sends back a cookie The browser (client) resends the cookie on subsequent requests Tecniche di Sicurezza dei Sistemi 8

HTTP Access Control - Digest Server sends www-authenticate parameters: Realm Domain Nonce, new for each 401 response E.G. H(client-IP:timestamp:server IP:timestamp:server-secret) secret) Algorithm E.G., MD5 Tecniche di Sicurezza dei Sistemi 9

HTTP Access Control - Digest Client sends authorization response: Same nonce H(A1), where a1=user:realm:password, and other information Steal H(A1) Only good for realm Tecniche di Sicurezza dei Sistemi 10

SSL Overview For any TCP protocol: HTTP (https:// port 443), NNTP, telnet, etc. Secure byte stream. Optional (but common) public key server authentication. Optional client authentication. Hash: combined MD5 and SHA. Encryption optional. Now: TLS (IETF WG). Tecniche di Sicurezza dei Sistemi 11

SSL Architecture Two layers: SSL record protocol provides basic security services 3 3 higher-layer protocols: Handshake, change cipher spec, alert Connection A A transport with some service, associated with a session Session Created by handshake, defines cryptographic security parameters for multiple connections Tecniche di Sicurezza dei Sistemi 12

Session and Connection Session parameters: ID, peer certificate, compression method, cipher spec, master secret, Is resumable. Connection parameters: Server and client random, server write MAC secret, client write MAC secret, server write key, client write key, IV, sequence number. Tecniche di Sicurezza dei Sistemi 13

SSL Record Protocol 2 services: Confidentiality, message integrity Layered protocol: Fragment application data into blocks Compress data Apply message authentication code (MAC) = h(m s) for message m and secret s Encrypt with client (cw( cw) ) or server (sw( sw) ) write key Transmit over TCP Specify content type for higher protocols Tecniche di Sicurezza dei Sistemi 14

Handshake Protocol Establish security capabilities Protocol version, session ID, cipher suite, compression method, IV Server authentication and key exchange Send certificate, key exchange, request client certificate Client authentication and key exchange Send certificate, key exchange, certificate verification Finish Tecniche di Sicurezza dei Sistemi 15

Cryptographic Computations Master secret creation. A A pre-master master-secret secret is exchanged first. RSA, or Diffie-Hellman Hellman. Both sides compute master secret based on pre-master master-secret. secret. Generation of cryptographic parameters. Client/server write MAC secrets, client/server write keys, client/server write IV are generated from master secret. Tecniche di Sicurezza dei Sistemi 16

Cryptographic Computations: Details (1) Client generates a 48-byte pre-master master- secret s p Master secret: s m =MD5(s p SHA( A s p r c r s )) MD5(s p SHA( BB s p r c r s )) MD5(s p SHA( CCC s p r c r s )) Where r c,s,s:client, server random Tecniche di Sicurezza dei Sistemi 17

Cryptographic Computations: Details (2) Session key: same as above, but use the master secret in place of s p to generate byte stream to cut out: Client, server MAC secret Client, server write key Client, server IV Tecniche di Sicurezza dei Sistemi 18