Professional Documents
Culture Documents
3 Protocols
3 Protocols
Part 3 Protocols 1
Protocol
Human protocols the rules followed in
human interactions
o Example: Asking a question in class
Networking protocols rules followed in
networked communication systems
o Examples: HTTP, FTP, etc.
Security protocol the (communication)
rules followed in a security application
o Examples: SSL, IPSec, Kerberos, etc.
Part 3 Protocols 2
Protocols
Protocol flaws can be very subtle
Several well-known security protocols
have significant flaws
o Including WEP, GSM, and IPSec
Implementation errors can occur
o Recently:
IE implementation of SSL
OpenSSL Heartbleed bug
Not easy to get protocols right…
Part 3 Protocols 3
Ideal Security Protocol
Must satisfy security requirements
o Requirements need to be precise
Efficient
o Small computational requirement
o Small bandwidth usage, minimal delays…
Robust
o Works when attacker tries to break it
o Works even if environment changes
Easy to use & implement, flexible…
Difficult to satisfy all of these!
Part 3 Protocols 4
Chapter 9:
Simple Security Protocols
“I quite agree with you,” said the Duchess; “and the moral of that is
‘Be what you would seem to be’ or
if you'd like it put more simply‘Never imagine yourself not to be
otherwise than what it might appear to others that what you were
or might have been was not otherwise than what you
had been would have appeared to them to be otherwise.’ ”
Lewis Carroll, Alice in Wonderland
Country 2
Friend E(Friend,K)
K
Country 1
K
6
(IFF – Case 1) Attack
Country 2
E(Friend,K)
Foe
MiG
Country 1
K
7
Identify Friend or Foe (IFF) – Case 2
Foe
MiG
Country 2
Friend 2. E(N,K)
K
1. N
Country 1
K
8
(IFF – Case 2) “MiG” in the Middle Attack
3. N
Friend
K 4. E(N,K)
2. N
Country 2
5. E(N,K)
6. E(N,K)
Foe
MiG
1. N
Country 1
K
9
Authentication Protocol
Requirements
IFF-Case 1 Must prove freshness of answer
(prevents replay attacks)
10
Authentication Protocols
Part 3 Protocols 11
Authentication
Alice must prove her identity to Bob
o Alice and Bob can be humans or computers
May also require Bob to prove he’s Bob
(mutual authentication)
Probably need to establish a session key
May have other requirements, such as
o Use public keys
o Use symmetric keys
o Use hash functions
o Anonymity, plausible deniability, etc., etc.
Part 3 Protocols 12
Authentication
Authentication on a stand-alone computer is
relatively simple
o Hash password with salt
o “Secure path,” attacks on authentication
software, keystroke logging, etc., can be issues
Authentication over a network is challenging
o Attacker can passively observe messages
o Attacker can replay messages
o Active attacks possible (insert, delete, change)
Part 3 Protocols 13
Simple Authentication
“I’m Alice”
Prove it
My password is “frank”
Alice Bob
Simple and may be OK for standalone system
But insecure for networked system
o Subject to a replay attack (next 2 slides)
o Also, Bob must know Alice’s password
Part 3 Protocols 14
Authentication Attack
“I’m Alice”
Prove it
My password is “frank”
Alice Bob
Trudy
Part 3 Protocols 15
Authentication Attack
“I’m Alice”
Prove it
My password is “frank”
Trudy Bob
Part 3 Protocols 16
Simple Authentication
Alice Bob
Part 3 Protocols 17
Better Authentication
“I’m Alice”
Prove it
h(Alice’s password)
Alice Bob
Part 3 Protocols 19
Nonce
To ensure freshness, can employ a nonce
o Nonce == number used once
What to use for nonces?
o That is, what is the challenge?
What should Alice do with the nonce?
o That is, how to compute the response?
How can Bob verify the response?
Should we rely on passwords or keys?
Part 3 Protocols 20
Challenge-Response
“I’m Alice”
Nonce
Nonce
Part 3 Protocols 22
Symmetric Key Notation
Encrypt plaintext P with key K
C = E(P,K)
Decrypt ciphertext C with key K
P = D(C,K)
Here, we are concerned with attacks on
protocols, not attacks on crypto
o So, we assume crypto algorithms are secure
Part 3 Protocols 23
Authentication: Symmetric Key
Aliceand Bob share symmetric key K
Key K known only to Alice and Bob
Authenticate by proving knowledge of
shared symmetric key
How to accomplish this?
o Cannot reveal key, must not allow replay
(or other) attack, must be verifiable, …
Part 3 Protocols 24
Authentication with
Symmetric Key
“I’m Alice”
R
E(R,K)
Alice, K Bob, K
Part 3 Protocols 25
Mutual Authentication?
“I’m Alice”, R
E(R,K)
E(R,K)
Alice, K Bob, K
Part 3 Protocols 26
Mutual Authentication
Since we have a secure one-way
authentication protocol…
The obvious thing to do is to use the
protocol twice
o Once for Bob to authenticate Alice
o Once for Alice to authenticate Bob
This has got to work…
Part 3 Protocols 27
Mutual Authentication
“I’m Alice”, RA
RB, E(RA, K)
E(RB, K)
Alice, K Bob, K
Part 3 Protocols 28
Mutual Authentication Attack
1. “I’m Alice”, RA
2. RB, E(RA, K)
5. E(RB, K)
Trudy Bob, K
3. “I’m Alice”, RB
4. RC, E(RB, K)
Trudy Bob, K
Part 3 Protocols 29
Mutual Authentication
Our one-way authentication protocol is
not secure for mutual authentication
o Protocols are subtle!
o The “obvious” thing may not be secure
Also, if assumptions or environment
change, protocol may not be secure
o This is a common source of security failure
o For example, Internet protocols
Part 3 Protocols 30
Symmetric Key Mutual
Authentication
“I’m Alice”, RA
RB, E(“Bob”,RA,K)
E(“Alice”,RB,K)
Alice, K Bob, K
Part 3 Protocols 31
Public Key Notation
Encrypt M with Alice’s public key: {M}Alice
Sign M with Alice’s private key: [M]Alice
Then
o [{M}Alice ]Alice = M
o {[M]Alice }Alice = M
Anybody can use Alice’s public key
Only Alice can use her private key
Part 3 Protocols 32
Public Key Authentication
“I’m Alice”
{R}Alice
R
Alice Bob
Is this secure?
Trudy can get Alice to decrypt anything!
o So, should have two key pairs
Part 3 Protocols 33
Public Key Authentication
“I’m Alice”
[R]Alice
Alice Bob
Is this secure?
Trudy can get Alice to sign anything!
o Same as previous should have two key pairs
Part 3 Protocols 34
Public Keys
Generally, a bad idea to use the same
key pair for encryption and signing
Instead, should have…
o …one key pair for encryption/decryption…
o …and a different key pair for
signing/verifying signatures
Part 3 Protocols 35
Session Key
Usually, a session key is required
o i.e., a symmetric key for a particular session
o Used for confidentiality and/or integrity
How to authenticate and establish a
session key (i.e., shared symmetric key)?
o When authentication completed, want Alice and
Bob to share a session key
o Trudy cannot break the authentication…
o …and Trudy cannot determine the session key
Part 3 Protocols 36
Authentication & Session Key
“I’m Alice”, R
{R,K}Alice
{R +1,K}Bob
Alice Bob
Is this secure?
o Alice is authenticated and session key is secure
o Alice’s “nonce”, R, useless to authenticate Bob
o The key K is acting as Bob’s nonce to Alice
No mutual authentication
Part 3 Protocols 37
Public Key Authentication
and Session Key
“I’m Alice”, R
[R,K]Bob
[R +1,K]Alice
Alice Bob
Is this secure?
o Mutual authentication (good), but…
o … session key is not secret (very bad)
Part 3 Protocols 38
Public Key Authentication
and Session Key
“I’m Alice”, R
{[R,K]Bob}Alice
{[R +1,K]Alice}Bob
Alice Bob
Is this secure?
Seems to be OK
Mutual authentication and session key!
Part 3 Protocols 39
Public Key Authentication
and Session Key
“I’m Alice”, R
[{R,K}Alice]Bob
[{R +1,K}Bob]Alice
Alice Bob
Is this secure?
Seems to be OK
o Anyone can see {R,K}Alice and {R +1,K}Bob
Part 3 Protocols 40
Timestamps
A timestamp T is derived from current time
Timestamps used in some security protocols
o Kerberos, for example
Timestamps reduce number of msgs (good)
o Like a nonce that both sides know in advance
“Time” is a security-critical parameter (bad)
Clocks never exactly the same, so must allow
for clock skew creates risk of replay
o How much clock skew is enough?
Part 3 Protocols 41
Public Key Authentication
with Timestamp T
“I’m Alice”, {[T, K]Alice}Bob
Alice Bob
Part 3 Protocols 42
Public Key Authentication
with Timestamp T
“I’m Alice”, [{T, K}Bob]Alice
Alice Bob
Trudy Bob
Part 3 Protocols 44
Public Key Authentication
Sign and encrypt with nonce…
o Secure
Encrypt and sign with nonce…
o Secure
Sign and encrypt with timestamp…
o Secure
Encrypt and sign with timestamp…
o Insecure
Protocols can be subtle!
Part 3 Protocols 45
Public Key Authentication
with Timestamp T
[{T +1}Alice]Bob
Alice Bob
Is this “encrypt and sign” secure?
o Yes, seems to be OK
Does “sign and encrypt” also work here?
Part 3 Protocols 46
Perfect Forward Secrecy
Consider this “issue”…
o Alice encrypts message with shared key K and
sends ciphertext to Bob
o Trudy records ciphertext and later attacks
Alice’s (or Bob’s) computer to recover K
o Then Trudy decrypts recorded messages
Perfect forward secrecy (PFS): Trudy
cannot later decrypt recorded ciphertext
o Even if Trudy gets key K or other secret(s)
Is PFS possible?
Part 3 Protocols 47
Perfect Forward Secrecy
Suppose Alice and Bob share key K
For perfect forward secrecy, Alice and Bob
cannot use K to encrypt
Instead they must use a session key KS and
forget it after it’s used
Can Alice and Bob agree on session key KS in
a way that ensures PFS?
o Real protocols – used in SSH
Part 3 Protocols 48
Naïve Session Key Protocol
E(KS, K)
E(messages, KS)
Alice, K Bob, K
ga mod p
gb mod p
Alice, a Bob, b
But Diffie-Hellman is subject to MiM
How to get PFS and prevent MiM?
Part 3 Protocols 50
Perfect Forward Secrecy
E(ga mod p, K)
E(gb mod p, K)
Alice: K, a Bob: K, b
Session key KS = gab mod p
Alice forgets a, Bob forgets b
So-called Ephemeral Diffie-Hellman
Neither Alice nor Bob can later recover K
S
Are there other ways to achieve PFS?
Part 3 Protocols 51
Mutual Authentication,
Session Key and PFS
“I’m Alice”, RA
RB, [{RA, gb mod p}Alice]Bob
Part 3 Protocols 53
TCP-based Authentication
TCP not intended for use as an
authentication protocol
But IP address in TCP connection
often used for authentication
One mode of IPSec relies on IP
address for authentication
Part 3 Protocols 54
TCP 3-way Handshake
SYN, SEQ a
SYN, ACK a+1, SEQ b
ACK b+1, data
Alice Bob
Recall the TCP three way handshake
Initial sequence numbers: SEQ a and SEQ b
o Supposed to be selected at random
If not…
Part 3 Protocols 55
TCP Authentication Attack
1. SYN, SEQ = t (as Trudy)
2. SYN, ACK = t+1, SEQ = b1
…
3. SYN, SEQ = t (as Alice)
Trudy Bob
5. ACK = b2+1, data
5. = b2
E Q
5. , S
t+1
5. K =
C
,A
SYN
5. Alice 4.
Part 3 Protocols 56
TCP Authentication Attack
Part 3 Protocols 58
Zero Knowledge Proofs
Part 3 Protocols 59
Zero Knowledge Proof (ZKP)
Alice wants to prove that she knows a
secret without revealing any info about it
Bob must verify that Alice knows secret
o But, Bob gains no info about the secret
Process is probabilistic
o Bob can verify that Alice knows the secret to
an arbitrarily high probability
An “interactive proof system”
Part 3 Protocols 60
Bob’s Cave
Alice knows secret
phrase to open path P
between R and S
(“open sesame”)
Can she convince Q
Bob that she knows R S
the secret without
revealing phrase?
Part 3 Protocols 61
Bob’s Cave
Bob: “Alice come out on S side” P
Alice (quietly):
“Open sesame”
Q
If Alice does not
R S
know the secret…
…then Alice could come out from the correct side
with probability 1/2
If Bob repeats this n times, then Alice (who does not
know secret) can only fool Bob with probability 1/2n
Part 3 Protocols 62
Fiat-Shamir Protocol
Cave-based protocols are inconvenient
o Can we achieve same effect without the cave?
Finding square roots modulo N is difficult
o Equivalent to factoring
Suppose N = pq, where p and q prime
Alice has a secret S
N and v = S2 mod N are public, S is secret
Alice must convince Bob that she knows S
without revealing any information about S
Part 3 Protocols 63
Fiat-Shamir
x = r2 mod N
e {0,1}
y = r Se mod N
Alice Bob
secret S random e
random r
Public: Modulus N and v = S2 mod N
Alice selects random r, Bob chooses e {0,1}
Bob verifies: y2 = x ve mod N
o Why? Because… y2 = r2 S2e = r2 (S2)e = x ve mod N
Part 3 Protocols 64
Fiat-Shamir: e = 1
x = r2 mod N
e=1
y = r S mod N
Alice Bob
secret S random e
random r
Public: Modulus N and v = S2 mod N
Alice selects random r, Bob chooses e =1
If y2 = x v mod N then Bob accepts it
o i.e., “Alice” passes this iteration of the protocol
Note that Alice must know S in this case
Part 3 Protocols 65
Fiat-Shamir: e = 0
x = r2 mod N
e=0
y = r mod N
Alice Bob
secret S
random e
random r
Public: Modulus N and v = S2 mod N
Alice selects random r, Bob chooses e = 0
Bob checks if y2 = x mod N
Alice does not need to know S in this case!
Part 3 Protocols 66
Fiat-Shamir
Public: modulus N and v = S2 mod N
Secret: Alice knows S
Alice selects random r and commits to r by
sending x = r2 mod N to Bob
Bob sends challenge e {0,1} to Alice
Alice responds with y = r Se mod N
Bob checks whether y2 = x ve mod N
o Does this prove response is from Alice?
Part 3 Protocols 67
Does Fiat-Shamir Work?
If everyone follows protocol, math works:
o Public: v = S2 mod N
o Alice to Bob: x = r2 mod N and y = r Se mod N
o Bob verifies: y2 = x ve mod N
Can Trudy convince Bob she is Alice?
o If Trudy expects e = 0, she sends x = r2 in msg 1
and y = r in msg 3 (i.e., follow the protocol)
o If Trudy expects e = 1, sends x = r2 v1 in msg 1
and y = r in msg 3
If Bob chooses e {0,1} at random, Trudy
can only trick Bob with probability 1/2
Part 3 Protocols 68
Fiat-Shamir Facts
Trudy can trick Bob with probability 1/2, but…
o …after n iterations, the probability that Trudy can
convince Bob that she is Alice is only 1/2n
o Just like Bob’s cave!
Bob’s e {0,1} must be unpredictable
Alice must use new r each iteration, or else…
o If e = 0, Alice sends r mod N in message 3
o If e = 1, Alice sends r S mod N in message 3
o Anyone can find S given r mod N and r S mod N
Part 3 Protocols 69
Fiat-Shamir Zero Knowledge?
Zero knowledge means that nobody learns
anything about the secret S
o Public: v = S2 mod N
o Trudy sees r2 mod N in message 1
o Trudy sees r S mod N in message 3 (if e = 1)
If Trudy can find r from r2 mod N, gets S
o But that requires modular square root
o If Trudy could find modular square roots, she
could get S from public v
Protocol does not seem to “help” to find S
Part 3 Protocols 70
ZKP in the Real World
Public key certificates identify users
o No anonymity if certificates sent in plaintext
ZKP offers a way to authenticate without revealing
identities
ZKP supported in MS’s Next Generation Secure
Computing Base (NGSCB)*, where…
o … ZKP used to authenticate software “without revealing
machine identifying data”
Blockchains!
ZKP is not just pointless mathematics!
* “cancelled software architecture designed by Microsoft which aimed to provide users of the Windows OS with
better privacy, security, and system integrity.” – [ref.]
Part 3 Protocols 71
Best Authentication Protocol?
It depends on…
o The sensitivity of the application/data
o The delay that is tolerable
o The cost (computation) that is tolerable
o What crypto is supported (public key,
symmetric key, …)
o Whether mutual authentication is required
o Whether PFS, anonymity, etc., are concern
…and possibly other factors
Part 3 Protocols 72
Chapter 10:
Real-World Protocols
The wire protocol guys don't worry about security because that's really
a network protocol problem. The network protocol guys don't
worry about it because, really, it's an application problem.
The application guys don't worry about it because, after all,
they can just use the IP address and trust the network.
Marcus J. Ranum
In the real world, nothing happens at the right place at the right time.
It is the job of journalists and historians to correct that.
Mark Twain
Part 3 Protocols 74
Secure Shell (SSH)
Part 3 Protocols 75
SSH
Creates a “secure tunnel”
Insecure command sent thru SSH
tunnel are then secure
SSH used with things like rlogin
o Why is rlogin insecure without SSH?
o Why is rlogin secure with SSH?
SSH is a relatively simple protocol
Part 3 Protocols 76
SSH
SSH authentication can be based on:
o Public keys, or
o Digital certificates, or
o Passwords
Here, we consider certificate mode
o Other modes, see homework problems
We consider slightly simplified SSH…
Part 3 Protocols 77
Simplified SSH
Alice, CP, RA
CS, RB
ga mod p
gb mod p, certificateB, SB
Alice E(Alice, certificateA, SA, K) Bob
Part 3 Protocols 79
Secure Socket Layer
Part 3 Protocols 80
Socket layer
“Socket layer”
lives between Socket application User
application “layer”
and transport transport
OS
layers
network
SSL usually
between HTTP link
NIC
and TCP
physical
Part 3 Protocols 81
What is SSL?
SSL is the protocol used for majority of
secure transactions on the Internet
For example, if you want to buy a book at
amazon.com…
o You want to be sure you are dealing with
Amazon (authentication)
o Your credit card information must be protected
in transit (confidentiality and/or integrity)
o As long as you have money, Amazon does not
care who you are
o So, no need for mutual authentication
Part 3 Protocols 82
Simple SSL-like Protocol
I’d like to talk to you securely
Here’s my certificate
{K}Bob
Part 3 Protocols 83
Simplified SSL Protocol
Can we talk?, cipher list, RA
certificate, cipher, RB
{S}Bob, E(h(msgs,CLNT,K),K)
h(msgs,SRVR,K)
Alice Data protected with key K Bob
Part 3 Protocols 84
SSL Keys
6 “keys” derived from K = h(S,RA,RB)
o 2 encryption keys: send and receive
o 2 integrity keys: send and receive
o 2 IVs: send and receive
o Why different keys in each direction?
Q: Why is h(msgs,CLNT,K) encrypted?
A: Apparently, it adds no security…
Part 3 Protocols 85
SSL Authentication
Alice authenticates Bob, not vice-versa
o How does client authenticate server?
o Why would server not authenticate client?
Mutual authentication is possible: Bob
sends certificate request in message 2
o Then client must have a valid certificate
o But, if server wants to authenticate client,
server could instead require password
Part 3 Protocols 86
SSL MiM Attack?
RA RA
certificateT, RB certificateB, RB
{S1}Trudy,E(X1,K1) {S2}Bob,E(X2,K2)
h(Y1,K1) h(Y2,K2)
Alice E(data,K1) Trudy E(data,K2) Bob
Q: What prevents this MiM “attack”?
A: Bob’s certificate must be signed by a
certificate authority (CA)
What does browser do if signature not valid?
What does user do when browser complains?
Part 3 Protocols 87
SSL Sessions vs Connections
SSL session is established as shown on
previous slides
SSL designed for use with HTTP 1.0
HTTP 1.0 often opens multiple simultaneous
(parallel) connections
o Multiple connections per session
SSL session is costly, public key operations
SSL has an efficient protocol for opening
new connections given an existing session
Part 3 Protocols 88
SSL Connection
session-ID, cipher list, RA
session-ID, cipher, RB,
h(msgs,SRVR,K)
h(msgs,CLNT,K)
Part 3 Protocols 90
SSL vs IPSec
IPSec: OS must be aware, but not apps
SSL: Apps must be aware, but not OS
SSL built into Web early-on (Netscape)
IPSec often used in VPNs (secure tunnel)
Reluctance to retrofit applications for SSL
IPSec not widely deployed (complexity, etc.)
The bottom line…
Internet less secure than it should be!
Part 3 Protocols 91
IPSec
Part 3 Protocols 92
IPSec and SSL
IPSec lives at
the network application User
layer SSL
IPSec is transport
OS
transparent to IPSec network
applications
link
NIC
physical
Part 3 Protocols 93
IPSec and Complexity
IPSec is a complex protocol
Over-engineered
o Lots of (generally useless) features
Flawed
o Some significant security issues
Interoperability is serious challenge
o Defeats the purpose of having a standard!
Complex
And, did I mention, it’s complex?
Part 3 Protocols 94
IKE and ESP/AH
Two parts to IPSec
IKE: Internet Key Exchange
o Mutual authentication
o Establish session key
o Two “phases” like SSL session/connection
ESP/AH
o ESP: Encapsulating Security Payload for
encryption and/or integrity of IP packets
o AH: Authentication Header integrity only
Part 3 Protocols 95
IKE
Part 3 Protocols 96
IKE
IKE has 2 phases
o Phase 1 IKE security association (SA)
o Phase 2 AH/ESP security association
Phase 1 is comparable to SSL session
Phase 2 is comparable to SSL connection
Not an obvious need for two phases in IKE
If multiple Phase 2’s do not occur, then it
is more costly to have two phases!
Part 3 Protocols 97
IKE Phase 1
Four different “key” options
o Public key encryption (original version)
o Public key encryption (improved version)
o Public key signature
o Symmetric key
For each of these, two different “modes”
o Main mode and aggressive mode
There are 8 versions of IKE Phase 1!
Need more evidence it’s over-engineered?
Part 3 Protocols 98
IKE Phase 1
We discuss 6 of 8 Phase 1 variants
o Public key signatures (main & aggressive modes)
o Symmetric key (main and aggressive modes)
o Public key encryption (main and aggressive)
Why public key encryption and public key
signatures?
o Always know your own private key
o May not (initially) know other side’s public key
Part 3 Protocols 99
IKE Phase 1
Uses ephemeral Diffie-Hellman to
establish session key
o Provides perfect forward secrecy (PFS)
Let a be Alice’s Diffie-Hellman exponent
Let b be Bob’s Diffie-Hellman exponent
Let g be generator and p prime
Recall that p and g are public
IC,RC, proofA
Alice Bob
K, proofA, proofB computed as in main mode
Note that identities are hidden
o The only aggressive mode to hide identities
o So, why have a main mode?
IC,RC,CS,E(hash2,SA,RB,K)
IC,RC,E(hash3,K)
Alice Bob
Key K, IC, RC and SA known from Phase 1
Proposal CP includes ESP and/or AH
Hashes 1,2,3 depend on SKEYID, SA, RA and RB
Keys derived from KEYMAT = h(SKEYID,RA,RB,junk)
Recall SKEYID depends on phase 1 key method
Optional PFS (ephemeral Diffie-Hellman exchange)
Part 3 Protocols 115
IPSec
After IKE Phase 1, we have an IKE SA
After IKE Phase 2, we have an IPSec SA
Both sides have a shared symmetric key
Now what?
o We want to protect IP datagrams
But what is an IP datagram?
o Considered from the perspective of IPSec…
IP header data
Where IP header is
IP header data
REPLY
Alice’s Bob
Computer
E(R, K)
Alice, K Bob, K
IV, E(packet,KIV)
Alice, K Bob, K
KIV = (IV,K)
o That is, RC4 key is K with 3-byte IV pre-pended
Note that the IV is known to Trudy
air
interface
Mobile
Base AuC
VLR
Station
“land line”
HLR
PSTN
Base Internet
etc. Home
Visited Station Network
Network Controller
RAND
SRES Call to
destination
No
Mobile Fake
encryption Base Station Base Station