Transcript Message Integrity

Chapter 8
Network Security
Thanks and enjoy! JFK/KWR
All material copyright 1996-2011
J.F Kurose and K.W. Ross, All Rights Reserved
Computer Networking:
A Top Down Approach ,
5th edition.
Jim Kurose, Keith Ross
Addison-Wesley, April
2009.
Chapter 8 roadmap
8.1 What is network security?
8.2 Principles of cryptography
8.3 Message integrity
8.4 Securing e-mail
8.5 Securing TCP connections: SSL
8.6 Network layer security: IPsec
8.7 Securing wireless LANs
8.8 Operational security: firewalls and IDS
Message Integrity
 Allows communicating parties to verify
that received messages are authentic.
Content of message has not been altered
 Source of message is who/what you think it is
 Message has not been replayed
 Sequence of messages is maintained

 Let’s first talk about message digests
3
Message Digests
 Function H( ) that takes as
input an arbitrary length
message and outputs a
fixed-length string:
“message signature”
 Note that H( ) is a manyto-1 function
 H( ) is often called a “hash
function”
large
message
m
H: Hash
Function
H(m)
 Desirable properties:




Easy to calculate
Irreversibility: Can’t
determine m from H(m)
Collision resistance:
Computationally difficult
to produce m and m’ such
that H(m) = H(m’)
Seemingly random output
4
Internet checksum: poor message
digest
Internet checksum has some properties of hash function:
 produces fixed length digest (16-bit sum) of input
 is many-to-one
 But given message with given hash value, it is easy to find another
message with same hash value.
 Example: Simplified checksum: add 4-byte chunks at a time:
message
I O U 1
0 0 . 9
9 B O B
ASCII format
49 4F 55 31
30 30 2E 39
39 42 D2 42
B2 C1 D2 AC
message
I O U 9
0 0 . 1
9 B O B
ASCII format
49 4F 55 39
30 30 2E 31
39 42 D2 42
B2 C1 D2 AC
different messages
but identical checksums!
5
Hash Function Algorithms
 MD5 hash function widely used (RFC 1321)
computes 128-bit message digest in 4-step
process.
 SHA-1 (Secure Hash Algorithm) is also used.
 US standard [NIST, FIPS PUB 180-1]
 produces 160-bit message digest

6
Message Authentication Code (MAC)
s = shared secret
message
s
message
message
s
H( )
H( )
compare
 Authenticates sender
 Verifies message integrity
 H(m+s) is called to MAC
 No encryption !
 Also called “keyed hash”
 Notation: MDm = H(s||m) ; send m||MDm
7
MAC
 How to distribute the shared
authentication key to the communicating
entities?
by physically visiting each of the entities
 by using entities’ public key

8
HMAC
 Popular MAC standard
 Addresses some subtle security flaws
Concatenates secret to front of message.
2. Hashes concatenated message
3. Concatenates the secret to front of
digest
4. Hashes the combination again.
1.
9
Example: OSPF
 Recall that OSPF is an
intra-AS routing
protocol
 Each router creates
map of entire AS (or
area) and runs
shortest path
algorithm over map.
 Router receives linkstate advertisements
(LSAs) from all other
routers in AS.
Attacks:
 Message insertion
 Message deletion
 Message modification
 How do we know if an
OSPF message is
authentic?
10
OSPF Authentication
 Within an Autonomous
System, routers send
OSPF messages to
each other.
 OSPF provides
authentication choices



No authentication
Shared password:
inserted in clear in 64bit authentication field
in OSPF packet
Cryptographic hash
 Cryptographic hash
with MD5



64-bit authentication
field includes 32-bit
sequence number
MD5 is run over a
concatenation of the
OSPF packet and
shared secret key
MD5 hash then
appended to OSPF
packet; encapsulated in
IP datagram
11
Digital Signatures
Cryptographic technique analogous to handwritten signatures.
 sender (Bob) digitally signs document,
establishing he is document owner/creator.
 Goal is similar to that of a MAC, except now use
public-key cryptography
 if MAC is used, Alice must also copy of the key
 verifiable, nonforgeable: recipient (Alice) can
prove to someone that Bob, and no one else
(including Alice), must have signed document
12
Digital Signatures
Simple digital signature for message m:
 Bob signs m by encrypting with his private key
-
KB, creating “signed” message, KB(m)
Bob’s message, m
Dear Alice
Oh, how I have missed
you. I think of you all the
time! …(blah blah blah)
Bob
K B Bob’s private
key
Public key
encryption
algorithm
-
K B(m)
Bob’s message,
m, signed
(encrypted) with
his private key
13
Digital signature = signed message digest
Alice verifies signature and
integrity of digitally signed
message:
Bob sends digitally signed
message:
large
message
m
H: Hash
function
Bob’s
private
key
+
-
KB
encrypted
msg digest
H(m)
digital
signature
(encrypt)
encrypted
msg digest
KB(H(m))
large
message
m
H: Hash
function
KB(H(m))
Bob’s
public
key
+
KB
digital
signature
(decrypt)
H(m)
H(m)
equal
?
14
Digital Signatures (more)
-
 Suppose Alice receives msg m, digital signature KB(m)
 Alice verifies m signed by Bob by applying Bob’s
+
-
+
-
public key KB to KB(m) then checks KB(KB(m) ) = m.
+
-
 If KB(KB(m) ) = m, whoever signed m must have used
Bob’s private key.
Alice thus verifies that:
 Bob signed m.
 No one else signed m.
 Bob signed m and not m’.
Non-repudiation:
 Alice can take m, and signature KB(m) to
court and prove that Bob signed m.
15
Public-key certification
 Motivation: Trudy plays pizza prank on Bob
Trudy creates e-mail order:
Dear Pizza Store, Please deliver to me four
pepperoni pizzas. Thank you, Bob
 Trudy signs order with her private key
 Trudy sends order to Pizza Store
 Trudy sends to Pizza Store her public key, but
says it’s Bob’s public key.
 Pizza Store verifies signature; then delivers
four pizzas to Bob.
 Bob doesn’t even like Pepperoni

16
Certification Authorities
 Certification authority (CA): validates identities
and issues certificates
 binds public key to particular entity, E.
 E (person, router) registers its public key with CA.



E provides “proof of identity” to CA.
CA creates certificate binding E to its public key.
certificate containing E’s public key digitally signed by CA
– CA says “this is E’s public key”
Bob’s
public
key
Bob’s
identifying
information
+
KB
digital
signature
(encrypt)
CA
private
key
K-
CA
+
KB
certificate for
Bob’s public key,
signed by CA
17
Certification Authorities
 When Alice wants Bob’s public key:
gets Bob’s certificate (Bob or elsewhere).
 apply CA’s public key to Bob’s certificate, get
Bob’s public key

+
KB
digital
signature
(decrypt)
CA
public
key
Bob’s
public
+
key
KB
+
K CA
18
Certificates: summary
 Primary standard X.509 (RFC 2459)
 Certificate contains:
 Issuer name
 Entity name, address, domain name, etc.
 Entity’s public key
 Digital signature (signed with issuer’s private
key)
 Validity period
 Public-Key Infrastructure (PKI)
 Certificates and certification authorities
 Often considered “heavy”
19
End-point authentication
 Want to be sure of the originator of the
message – end-point authentication.
 Assuming Alice and Bob have a shared
secret, will MAC provide end-point
authentication.
We do know that Alice created the message.
 But did she send it?

20
Playback attack
MAC =
f(msg,s)
Transfer $1M
from Bill to Trudy MAC
Transfer $1M from
MAC
Bill to Trudy
Defending against playback
attack: nonce
“I am Alice”
R
MAC =
f(msg,s,R)
Transfer $1M
from Bill to Susan
MAC
Nonce
 What if Alice wants to send a series of
messages?
a new nonce for each of the messages?
 in practice, only one nonce is needed
 a single nonce combined with sequence numbers

23
Authentication with Public Key
Cryptography
 using a nonce and public key cryptography
to solve the authentication problem
“I am Alice”
R
KA-(R)
KA+
Bob computes
KA+(KA-(R)) = R,
authenticating
Alice
24
Security hole in the public-key
authentication protocol
“I am Alice”
R
KT-(R)
KT+
Bob computes
KT+(KT-(R)) = R,
authenticating
Trudy as Alice
25
Man in the middle attack
“I am Alice”
“I am Alice”
R
KT-(R)
R
KT+
KA-(R)
Send me your public key KA+
KA+
Alice
decrypts
KA+(m)
Trudy decrypts
KT+(m), forwards
KA+(m) to Alice
Bob sends
KT+(m)
26
Chapter 8 roadmap
8.1 What is network security?
8.2 Principles of cryptography
8.3 Message integrity
8.4 Securing e-mail
8.5 Securing TCP connections: SSL
8.6 Network layer security: IPsec
8.7 Securing wireless LANs
8.8 Operational security: firewalls and IDS
Secure e-mail
 Alice wants to send confidential e-mail, m,
to Bob.
 Using symmetric key cryptography

fundamental difficulty: distributing symmetric
key
 Using public key cryptography:
 one problem: public key encryption is inefficient
for long messages
28
Secure e-mail
 Alice wants to send confidential e-mail, m, to Bob.
KS
m
KS
K ( .)
S
+
.
K B( )
K+
B
KS(m )
KS(m )
+
+
KB(KS )
Internet
.
K S( )
-
KS
+
K B( )
KB(KS )
Alice:
 generates random symmetric private key, KS.
 encrypts message with KS (for efficiency)
 also encrypts KS with Bob’s public key.
 sends both KS(m) and KB(KS) to Bob.
-
KB-
.
m
Secure e-mail
 Alice wants to send confidential e-mail, m, to Bob.
KS
m
KS
K ( .)
S
+
.
K B( )
K+
B
KS(m )
KS(m )
+
+
KB(KS )
Internet
.
K S( )
-
KS
+
K B( )
KB(KS )
Bob:
 uses his private key to decrypt and recover KS
 uses KS to decrypt KS(m) to recover m
-
KB-
.
m
Secure e-mail (continued)
• Alice wants to provide sender authentication message
integrity.
m
H(.)
KA-
-
.
+
m
-
-
KA(H(m))
KA(H(m))
KA( )
+
KA
Internet
-
+
.
KA( )
H(m )
compare
m
.
H( )
• Alice digitally signs message.
• sends both message (in the clear) and digital signature.
H(m )
Secure e-mail (continued)
• Alice wants to provide secrecy, sender authentication,
message integrity.
KAK
A(H(m))
KS
m
KA( )
H( )
.
.
+
.
K S( )
m
KS
+
.
K B( )
K+
B
+
Internet
+
KB(KS )
Alice uses three keys: her private key, Bob’s public key, newly
created symmetric key
PGP (Pretty Good Privacy)
 e-mail encryption scheme
 provides secrecy, sender authentication
and message integrity (previous figure)
 depending on the version, uses
MD5 or SHA for message digest
 CAST, triple-DES or IDEA for symmetric key
encryption
 RSA for public key encryption

33
Chapter 8 roadmap
8.1 What is network security?
8.2 Principles of cryptography
8.3 Message integrity
8.4 Securing e-mail
8.5 Securing TCP connections: SSL
8.6 Network layer security: IPsec
8.7 Securing wireless LANs
8.8 Operational security: firewalls and IDS
SSL: Secure Sockets Layer
 Widely deployed security
protocol



Supported by almost all
browsers and web servers
https
Tens of billions $ spent
per year over SSL
 Originally designed by
Netscape in 1993
 Number of variations:

TLS: transport layer
security, RFC 2246
 Provides



Confidentiality
Integrity
Authentication
 Original goals:





Had Web e-commerce
transactions in mind
Encryption (especially
credit-card numbers)
Web-server
authentication
Optional client
authentication
Minimum hassle in doing
business with new
merchant
 Available to all TCP
applications

Secure socket interface
35
SSL and TCP/IP
Application
TCP
Application
SSL
TCP
IP
IP
Normal Application
Application
with SSL
• SSL provides application programming interface (API)
to applications
• C and Java SSL libraries/classes readily available
36
Could do something like PGP:
-
KA
m
.
H( )
-
.
KA( )
-
KA(H(m))
+
KS
.
KS( )
+
m
KS
+
.
K B( )
+
Internet
+
KB(KS )
KB
• But want to send byte streams & interactive data
•Want a set of secret keys for the entire connection
• Want certificate exchange part of protocol:
handshake phase
37
Toy SSL: a simple secure channel
 Handshake: Alice and Bob use their
certificates and private keys to
authenticate each other and exchange
shared secret
 Key Derivation: Alice and Bob use shared
secret to derive set of keys
 Data Transfer: Data to be transferred is
broken up into a series of records
 Connection Closure: Special messages to
securely close connection
38
Toy: A simple handshake
 MS = master secret
 EMS = encrypted master secret
39
Toy: Key derivation
 Considered bad to use same key for more than one
cryptographic operation

Use different keys for message authentication code
(MAC) and encryption
 Four keys:
 Kc = encryption key for data sent from client to server
 Mc = MAC key for data sent from client to server
 Ks = encryption key for data sent from server to client
 Ms = MAC key for data sent from server to client
 Keys derived from key derivation function (KDF)
 Takes master secret and (possibly) some additional
random data and creates the keys
40
Toy: Data Records
 Why not encrypt data in constant stream as we
write it to TCP?


Where would we put the MAC? If at end, no message
integrity until all data processed.
For example, with instant messaging, how can we do
integrity check over all bytes sent before displaying?
 Instead, break stream in series of records
 Each record carries a MAC
 Receiver can act on each record as it arrives
 Issue: in record, receiver needs to distinguish
MAC from data

Want to use variable-length records
length
data
MAC
41
Toy: Sequence Numbers
 Attacker can capture and replay record or re-
order records




TCP (running in Alice) passes records to the SSL
SSL in Alice decrypts the records
SSL in Alice uses MAC, verifies data integrity
SSL passes the decrypted data to the app layer
 Solution: put sequence number into MAC:
 MAC = MAC(Mx, sequence||data)
 Note: no sequence number field
 Attacker could still replay all of the records
 Use random nonce
42
Toy: Control information
 Truncation attack:
attacker forges TCP connection close segment
 One or both sides thinks there is less data than
there actually is.

 Solution: record types, with one type for
closure

type 0 for data; type 1 for closure
 MAC = MAC(Mx, sequence||type||data)
length type
data
MAC
43
Toy SSL: summary
encrypted
bob.com
44
Toy SSL isn’t complete
 How long are the fields?
 What encryption protocols?
 No negotiation
 Allow client and server to support different
encryption algorithms
 Allow client and server to choose together
specific algorithm before data transfer
45
Most common symmetric ciphers in
SSL
 DES – Data Encryption Standard: block
 3DES – Triple strength: block
 RC2 – Rivest Cipher 2: block
 RC4 – Rivest Cipher 4: stream
Public key encryption
 RSA
46
SSL Cipher Suite
 Cipher Suite
Public-key algorithm
 Symmetric encryption algorithm
 MAC algorithm

 SSL supports a variety of cipher suites
 Negotiation: client and server must agree
on cipher suite
 Client offers choice; server picks one
47
Real SSL: Handshake (1)
Purpose
1. Server authentication
2. Negotiation: agree on crypto algorithms
3. Establish keys
4. Client authentication (optional)
48
Real SSL: Handshake (2)
1.
2.
3.
4.
5.
6.
Client sends list of algorithms it supports, along
with client nonce
Server chooses algorithms from list; sends back:
choice + certificate + server nonce
Client verifies certificate, extracts server’s
public key, generates pre_master_secret,
encrypts with server’s public key, sends to server
Client and server independently compute
encryption and MAC keys from
pre_master_secret and nonces
Client sends a MAC of all the handshake messages
Server sends a MAC of all the handshake
messages
49
Real SSL: Handshaking (3)
Last 2 steps protect handshake from tampering
 Client typically offers range of algorithms,
some strong, some weak
 Man-in-the middle could delete the stronger
algorithms from list
 Last 2 steps prevent this

Last two messages are encrypted
50
Real SSL: Handshaking (4)
 Why the two random nonces?
 Suppose Trudy sniffs all messages between
Alice & Bob.
 Next day, Trudy sets up TCP connection
with Bob, sends the exact same sequence
of records,.
Bob (Amazon) thinks Alice made two separate
orders for the same thing.
 Solution: Bob sends different random nonce for
each connection. This causes encryption keys to
be different on the two days.
 Trudy’s messages will fail Bob’s integrity check.

51
Key derivation
 Using the key derivation function the client and
the compute followings from PMS and nonces:






client MAC key
server MAC key
client encryption key
server encryption key
client initialization vector (IV)
server initialization vector (IV)
52
SSL Record Protocol
data
data
fragment
record
header
data
fragment
MAC
encrypted
data and MAC
record
header
MAC
encrypted
data and MAC
record header: content type; version; length
MAC: includes sequence number, MAC key Mx
Fragment: each SSL fragment 214 bytes (~16 Kbytes)
53
SSL Record Format
1 byte
content
type
2 bytes
3 bytes
SSL version
length
data
MAC
Data and MAC encrypted (symmetric algo)
54
Real
Connection
Everything
henceforth
is encrypted
TCP Fin follow
55
Chapter 8 roadmap
8.1 What is network security?
8.2 Principles of cryptography
8.3 Message integrity
8.4 Securing e-mail
8.5 Securing TCP connections: SSL
8.6 Network layer security: IPsec
8.7 Securing wireless LANs
8.8 Operational security: firewalls and IDS