1. Chapter 2 Protocols Controlling communications of principals in systems

2. Security Protocols This is the broader meaning of “protocols” Not just computer protocols The protocols control the communications of the various principles in a system. Security protocols fail.

3. Eavesdropping Risk Passwords remain the foundation of which computer security rests Key fob and garage doors use 16 bit serial number as key Random guess serial number Use a grabber to get another's code Using a simple password such as serial number is seldom adequate except for systems that require minimum security

4. Simple Authentication T  G: T,{T,N} kt T  G name (T) sent to garage Form is the Name (T) concatenated with {T, N) encrypted with kt {T, N where N is nonce) Nonce guarantees freshness Assures it is not a play-back Nonce can be very poorly done Challenge and response two-pass protocol

5. Manipulating Message Can also set your self up in the middle and manipulate the message These are just adjustments to replay attacks

6. Changing Environment Can make previously secure products fail. ATMs originally designed under these premise: Cards not secure PINS are Machines installed in secure locations (banks) Moving of ATMs to many locations violated one of the original design premise opening up a series of new attacks

7. Managing Encryption Keys A variant of Kerberos is widely used in W2K variants. Basic Key Management use a trusted third party Needham-Schroeder Protocol Kerberos is derivative of Needham- Schroeder, developed at MIT

8. Formal Proofs There has been work done to formally prove the security of various protocols. Ban Logic pg 29 These formal methods require designers to look more closely at the design. But do not assure security, based on external assumptions The “boundaries” between technologies are often where vulnerabilities arise.

9. Discussion topics Find current example of man in middle attack Find article on using source routing to establish man in middle attack Current uses of Kerberos

10. List of resources Security protocols http://www.hipaadvisory.com/tech/Security%20Protocols.htm http://security.ittoolbox.com/topics/t.asp?t=386&p=386&h1=386 Garage door openers http://www.neighborhoodlink.com/orlando/lehhna/genpage/890380776.html Nice article comparing garage opener and automotive security protections: http://www.findarticles.com/p/articles/mi_qa3828/is_200411/ai_n9469460

11. List of resources Challenge-response http://en.wikipedia.org/wiki/Challenge-response_authentication Kerberos http://en.wikipedia.org/wiki/Kerberos_%28pr otocol%29 http://en.wikipedia.org/wiki/Kerberos_%28pr otocol%29 Needham-Schroeder http://en.wikipedia.org/wiki/Needham- Schroeder http://en.wikipedia.org/wiki/Needham- Schroeder