1. Chapter 9 Simple Authentication Protocols
Simple Security Protocol
Authentication Protocols
Authentication and TCP
Zero Knowledge Proofs
The best Authentication Protocol?
Chapter 9 Simple Authentication protocols

2. Chapter 9 Simple Authentication protocols
Human protocols  the rules followed in human interactions
Example: Asking a question in class
Networking protocols  rules followed in networked communication systems
Examples: HTTP, FTP, etc.
Security protocols  the (communication) rules followed in a security application
Examples: SSL, IPSec, Kerberos, etc.
Chapter 9 Simple Authentication protocols

3. Chapter 9 Simple Authentication protocols
Protocol flaws can be very subtle
Several well-known security protocols have serious flaws
Including IPSec, GSM and WEP
Common to find implementation errors
Such as IE implementation of SSL
Difficult to get protocols right…
Chapter 9 Simple Authentication protocols

4. Ideal Security Protocol
Satisfies security requirements
Requirements must be precise
Efficient
Minimize computational requirement  in particular, costly public key operations
Minimize delays/bandwidth
Not fragile
Must work when attacker tries to break it
Works even if environment changes
Easy to use and implement, flexible, etc.
Very difficult to satisfy all of these!
Chapter 9 Simple Authentication protocols

5. Simple Security Protocols
Chapter 9 Simple Authentication protocols

6. Chapter 9 Simple Authentication protocols
Secure Entry to NSA
Insert badge into reader
Enter PIN
Correct PIN?
Yes? Enter
No? Get shot by security guard
Chapter 9 Simple Authentication protocols

7. Chapter 9 Simple Authentication protocols
ATM Machine Protocol
Insert ATM card
Enter PIN
Correct PIN?
Yes? Conduct your transaction(s)
No? Machine eats card
Chapter 9 Simple Authentication protocols

8. Identify Friend or Foe (IFF)
Military needs many specialized protocols
Many cases, it could recognize friends as enemies, or ….
Russian
MIG
Angola
2. E(N,K)
Namibia
SAAF
Impala
1. N
Chapter 9 Simple Authentication protocols

9. Chapter 9 Simple Authentication protocols
MIG in the Middle
Angola
3. N
SAAF
Impala
4. E(N,K)
2. N
5. E(N,K)
Namibia
6. E(N,K)
Russian
MiG
1. N
Chapter 9 Simple Authentication protocols

10. Authentication Protocols
Chapter 9 Simple Authentication protocols

11. Chapter 9 Simple Authentication protocols
Alice must prove her identity to Bob
Alice and Bob can be humans or computers
May also require Bob to prove he’s Bob (mutual authentication)
May also need to establish a session key
May have other requirements, such as
Use only public keys
Use only symmetric keys
Use only a hash function
Anonymity, plausible deniability, etc., etc.
Chapter 9 Simple Authentication protocols

12. Chapter 9 Simple Authentication protocols
Authentication on a stand-alone computer is relatively simple
“Secure path” is the primary issue
Main concern is an attack on authentication software (we discuss software attacks later)
Authentication over a network is much more complex
Attacker can passively observe messages
Attacker can replay messages
Active attacks may be possible (insert, delete, change messages)
Chapter 9 Simple Authentication protocols

13. Simple Authentication
“I’m Alice”
Prove it
My password is “frank”
Alice
Bob
Simple and may be OK for standalone system
But insecure for networked system
Subject to a replay attack (next 2 slides)
Bob must know Alice’s password
Chapter 9 Simple Authentication protocols

14. Authentication Attack
“I’m Alice”
Prove it
My password is “frank”
Alice
Bob
Trudy
Chapter 9 Simple Authentication protocols

15. Authentication Attack
“I’m Alice”
Prove it
My password is “frank”
Trudy
Bob
This is a replay attack
How can we prevent a replay?
Chapter 9 Simple Authentication protocols

16. Simple Authentication
I’m Alice, My password is “frank”
Alice
Bob
More efficient…
But same problem as previous version
Replay attack
Chapter 9 Simple Authentication protocols

17. Better Authentication
“I’m Alice”
Prove it
h(Alice’s password)
Alice
Bob
Better since it hides Alice’s password
From both Bob and attackers
But still subject to replay
Chapter 9 Simple Authentication protocols

18. Chapter 9 Simple Authentication protocols
Challenge-Response
To prevent replay, challenge-response used
Suppose Bob wants to authenticate Alice
Challenge sent from Bob to Alice
Only Alice can provide the correct response
Challenge chosen so that replay is not possible
How to accomplish this?
Password is something only Alice should know…
For freshness, a “number used once” or nonce
Chapter 9 Simple Authentication protocols

19. Chapter 9 Simple Authentication protocols
Challenge-Response
“I’m Alice”
Nonce
h(Alice’s password, Nonce)
Alice
Bob
Nonce is the challenge
The hash is the response
Nonce prevents replay, insures freshness
Password is something Alice knows
Note that Bob must know Alice’s password
Chapter 9 Simple Authentication protocols

20. Chapter 9 Simple Authentication protocols
Challenge-Response
“I’m Alice”
Nonce
Something that could only be
Alice
from Alice (and Bob can verify)
Bob
What can we use to achieve this?
Hashed pwd works, crypto might be better
Will be discussed for Symmetric key, Public key, and so on
Chapter 9 Simple Authentication protocols

21. Symmetric Key Notation
Encrypt plaintext P with key K
C = E(P,K)
Decrypt ciphertext C with key K
P = D(C,K)
Here, we are concerned with attacks on protocols, not directly on the crypto
We assume that crypto algorithm is secure
Chapter 9 Simple Authentication protocols

22. Symmetric Key Authentication
Alice and Bob share symmetric key KAB
Key KAB known only to Alice and Bob
Authenticate by proving knowledge of shared symmetric key
How to accomplish this?
Must not reveal key
Must not allow replay attack
Chapter 9 Simple Authentication protocols

23. Authentication with Sym Key
“I’m Alice” R
E(R,KAB)
Bob, KAB
Alice, KAB
Secure method for Bob to authenticate Alice
Alice does not authenticate Bob
Can we achieve mutual authentication?
Chapter 9 Simple Authentication protocols

24. Mutual Authentication?
“I’m Alice”, R
E(R,KAB)
E(R,KAB)
Alice
Bob
What’s wrong with this picture?
“Alice” could be Trudy (or anybody else)!
Chapter 9 Simple Authentication protocols

25. Mutual Authentication
Since we have a secure one-way authentication protocol…
The obvious thing to do is to use the protocol twice
Once for Bob to authenticate Alice
Once for Alice to authenticate Bob
This has to work…
Chapter 9 Simple Authentication protocols

26. Mutual Authentication
“I’m Alice”, RA
RB, E(RA,KAB)
E(RB,KAB)
Alice
Bob
This provides mutual authentication
Is it secure? See the next slide…
Chapter 9 Simple Authentication protocols

27. Mutual Authentication Attack
1. “I’m Alice”, RA
2. RB, E(RA,KAB)
5. E(RB,KAB)
Bob
Trudy
3. “I’m Alice”, RB
4. RC, E(RB,KAB)
Trudy
Bob
Chapter 9 Simple Authentication protocols

28. Mutual Authentication
Our one-way authentication protocol not secure for mutual authentication
Protocols are subtle!
The “obvious” thing may not be secure
Also, if assumptions or environment changes, protocol may not work
This is a common source of security failure
For example, Internet protocols
Chapter 9 Simple Authentication protocols

29. Sym Key Mutual Authentication
“I’m Alice”, RA
RB, E(“Bob”,RA,KAB)
E(“Alice”,RB,KAB)
Alice
Bob
Do these “insignificant” changes help?
Yes!
Chapter 9 Simple Authentication protocols

30. Chapter 9 Simple Authentication protocols
Public Key Notation
Encrypt M with Alice’s public key: {M}Alice
Sign M with Alice’s private key: [M]Alice
Then
[{M}Alice ]Alice = M
{[M]Alice }Alice = M
Anybody can do public key operations
Only Alice can use her private key (sign)
Chapter 9 Simple Authentication protocols

31. Public Key Authentication
“I’m Alice”
{R}Alice R
Alice
Bob
Is this secure?
Trudy can get Alice to decrypt anything!
Should not use the key for encryption
Must have two key pairs
Chapter 9 Simple Authentication protocols

32. Public Key Authentication
“I’m Alice” R
[R]Alice
Alice
Bob
Is this secure?
Trudy can get Alice to sign anything!
Should not use the key for sign
Must have two key pairs
Chapter 9 Simple Authentication protocols

33. Chapter 9 Simple Authentication protocols
Public Keys
Never use the same key pair for encryption and signing
One key pair for encryption/decryption
A different key pair for signing/verifying signatures
Chapter 9 Simple Authentication protocols

34. Chapter 9 Simple Authentication protocols
Session Key
Session key: temporary key, used for a short time period
Usually, a session key is required in addition to authentication
Limit symmetric key for a particular session
Limit damage if one session key compromised
Can we authenticate and establish a shared symmetric key?
Key can be used for confidentiality
Key can be used for integrity
Chapter 9 Simple Authentication protocols

35. Chapter 9 Simple Authentication protocols
Session Key
In some cases, we may also require perfect forward secrecy (PFS)
Discussed later…
Chapter 9 Simple Authentication protocols

36. Pub Key Authen and Sess Key
Using Encryptions of Alice and Bob
“I’m Alice”, R
Bob
Alice
{R,K}Alice
{R +1,K}Bob
Is this secure?
OK for key, but no mutual authentication
Note that K is acting as Bob’s nonce
Alice can not authenticate Bob
Chapter 9 Simple Authentication protocols

37. Pub Key Authen and Sess Key
Using Signs of Alice and Bob
Alice
Bob
“I’m Alice”, R
[R,K]Bob
[R +1,K]Alice
Is this secure?
Mutual authentication but key is not secret!
Chapter 9 Simple Authentication protocols

38. Pub Key Authen and Sess Key
First Sign and encrypt
Alice
Bob
“I’m Alice”, R
{[R,K]Bob}Alice
{[R +1,K]Alice}Bob
Is this secure?
Seems to be OK
Mutual authentication and session key!
Chapter 9 Simple Authentication protocols

39. Pub Key Authen and Sess Key
First encrypt and Sign
Alice
Bob
“I’m Alice”, R
[{R,K}Alice]Bob
[{R +1,K}Bob]Alice
Is this secure?
Seems to be OK
Though anyone can see {R,K}Alice and {R +1,K}Bob
Chapter 9 Simple Authentication protocols

40. Perfect Forward Secrecy
The concern…
Alice encrypts message with shared key KAB and sends ciphertext to Bob
Trudy records ciphertext and later attacks Alice’s (or Bob’s) computer to find KAB
Then Trudy decrypts recorded messages
Perfect forward secrecy (PFS):
Trudy cannot later decrypt recorded ciphertext
Even if Trudy gets key KAB or other secret(s)
Is PFS possible?
Chapter 9 Simple Authentication protocols

41. Perfect Forward Secrecy
For perfect forward secrecy, Alice and Bob cannot use KAB to encrypt
Instead they must use a session key KS and forget it after it’s used
Problem: How can Alice and Bob agree on session key KS and insure PFS?
Chapter 9 Simple Authentication protocols

42. Naïve Session Key Protocol
E(KS, KAB)
E(messages, KS)
Alice, KAB
Bob, KAB
Trudy could also record E(KS,KAB)
If Trudy gets KAB, she gets KS
Chapter 9 Simple Authentication protocols

43. Perfect Forward Secrecy
Can use Diffie-Hellman for PFS
Recall Diffie-Hellman: public g and p
ga mod p
gb mod p
Alice, a
Bob, b
But Diffie-Hellman is subject to MiM
How to get PFS and prevent MiM?
Chapter 9 Simple Authentication protocols

44. Perfect Forward Secrecy
E(ga mod p, KAB)
E(gb mod p, KAB)
Alice, a
Bob, b
Session key KS = gab mod p
Alice forgets a, Bob forgets b
Ephemeral(일회성) Diffie-Hellman
Not even Alice and Bob can later recover KS
Other ways to do PFS?
Chapter 9 Simple Authentication protocols

45. Mutual Authen, Sess Key & PFS
“I’m Alice”, RA
RB, [{RA, gb mod p}Alice]Bob
[{RB, ga mod p}Bob]Alice
Alice
Bob
Session key is K = gab mod p
Alice forgets a and Bob forgets b
If Trudy later gets Bob’s and Alice’s secrets, she cannot recover session key K
Chapter 9 Simple Authentication protocols

46. Chapter 9 Simple Authentication protocols
Timestamps
A timestamp T is the current time
Timestamps used in many security protocols (Kerberos, for example)
Timestamps reduce number of messages
Like a nonce that both sides know in advance
But, use of timestamps implies that time is a security-critical parameter
Clocks never exactly the same, so must allow for clock skew(시간 오차)  risk of replay
How much clock skew is enough?
Chapter 9 Simple Authentication protocols

47. Pub Key Authen with Timestamp T
“I’m Alice”, {[T,K]Alice}Bob
{[T +1,K]Bob}Alice
Alice
Bob
Is this secure?
Seems to be OK
Chapter 9 Simple Authentication protocols

48. Pub Key Authen with Timestamp T
“I’m Alice”, [{T,K}Bob]Alice
[{T +1,K}Alice]Bob
Alice
Bob
Is this secure?
Trudy can use Alice’s public key to find
{T,K}Bob and then…
Chapter 9 Simple Authentication protocols

49. Pub Key Authen with Timestamp T
“I’m Trudy”, [{T,K}Bob]Trudy
[{T +1,K}Trudy]Bob
Trudy
Bob
Trudy obtains Alice-Bob session key K
Note: Trudy must act within clock skew
Chapter 9 Simple Authentication protocols

50. Pub Key Authen with Timestamp T
“I’m Alice”, [{T,K}Bob]Alice
[{T +1}Alice]Bob
Bob
Alice
Is this “encrypt and sign” secure?
Yes, seems to be
Does “sign and encrypt” also work here?
Chapter 9 Simple Authentication protocols

51. Public Key Authentication
Sign and encrypt with nonce…
Secure
Encrypt and sign with nonce…
Sign and encrypt with timestamp…
Encrypt and sign with timestamp…
Insecure
Protocols can be subtle!
Subtle: 민감한
Chapter 9 Simple Authentication protocols

52. Authentication and TCP
Chapter 9 Simple Authentication protocols

53. TCP-based Authentication
TCP not intended for use as an authentication protocol
But IP address in TCP connection often used for authentication
One mode of IPSec uses IP address for authentication
This can cause problems
Chapter 9 Simple Authentication protocols

54. Chapter 9 Simple Authentication protocols
TCP 3-way Handshake
SYN, SEQ a
SYN, ACK a+1, SEQ b
ACK b+1, data
Alice
Bob
Recall the TCP three way handshake
Initial SEQ number must be random
Why? See the next slide…
Chapter 9 Simple Authentication protocols

55. TCP Authentication Attack
1. SYN, SEQ = t (as Trudy)
2. SYN, ACK = t+1, SEQ = b1
3. SYN, SEQ = t (as Alice)
5. ACK = b2+1, data
Trudy
Bob 5. 5.
4. SYN, ACK = t+1, SEQ = b2 5.
Alice 5.
Chapter 9 Simple Authentication protocols

56. TCP Authentication Attack
Initial SEQ numbers
Mac OS X
Random SEQ numbers
If initial SEQ numbers not very random…
…possible to guess initial SEQ number…
…and previous attack will succeed
Chapter 9 Simple Authentication protocols

57. TCP Authentication Attack
Trudy cannot see what Bob sends, but she can send packets to server Bob, while posing as Alice
Trudy must prevent Alice from receiving Bob’s packets (or else connection will terminate)
If password (or other authentication) required, this attack fails
If TCP connection is relied on for authentication, then attack succeeds
Bad idea to rely on TCP for authentication
Chapter 9 Simple Authentication protocols

58. Chapter 9 Simple Authentication protocols
Zero Knowledge Proofs
Chapter 9 Simple Authentication protocols

59. Zero Knowledge Proof (ZKP)
Alice wants to prove that she knows a secret without revealing any info about it
Bob must verify that Alice knows secret
Even though he gains no info about the secret
Process is probabilistic
Bob can verify that Alice knows the secret to an arbitrarily high probability
An “interactive proof system”
Chapter 9 Simple Authentication protocols

60. Chapter 9 Simple Authentication protocols
Bob’s Cave
Alice claims to know secret phrase to open path between R and S (“open sasparilla”)
Can she convince Bob that she knows the secret without revealing phrase? P Q R S
Chapter 9 Simple Authentication protocols

61. Chapter 9 Simple Authentication protocols
Bob’s Cave
Bob: “Alice come out on S side” P
Alice (quietly): “Open sasparilla” Q
Apse Alice does not know secret R S
Without knowing secret, Alice could come out from the correct side with probability ½
If Bob repeats this n times, then Alice can only fool Bob with probability 1/2n
Chapter 9 Simple Authentication protocols

62. Chapter 9 Simple Authentication protocols
Fiat-Shamir Protocol
Cave-based protocols are inconvenient
Can we achieve same effect without a cave?
It is known that finding square roots modulo N is difficult (like factoring)
Suppose N = pq, where p and q prime
Alice has a secret S
N and v = S2 mod N are public, S is secret
Alice must convince Bob that she knows S without revealing any information about S
Chapter 9 Simple Authentication protocols

63. Chapter 9 Simple Authentication protocols
Fiat-Shamir
secret S
random r
x = r2 mod N
e  {0,1}
y = rSe mod N
Alice
Bob
Public: Modulus N and v = S2 mod N
Alice selects random r
Bob chooses e  {0,1}
Bob verifies that y2 = r2S2e = r2(S2)e = xve mod N
Chapter 9 Simple Authentication protocols

64. Chapter 9 Simple Authentication protocols
Fiat-Shamir: e = 1
Secret S
Random r
x = r2 mod N
e = 1
y = rS mod N
Alice
Bob
Public: Modulus N and v = S2 mod N
Alice selects random r
Suppose Bob chooses e =1
Bob must verify that y2 = xv mod N
Alice must know S in this case
Chapter 9 Simple Authentication protocols

65. Chapter 9 Simple Authentication protocols
Fiat-Shamir: e = 0
Secret S
Random r
x = r2 mod N
e = 0
y = r mod N
Alice
Bob
Public: Modulus N and v = S2 mod N
Alice selects random r
Suppose Bob chooses e = 0
Bob must verify that y2 = x mod N
Alice does not need to know S in this case!
Chapter 9 Simple Authentication protocols

66. Chapter 9 Simple Authentication protocols
Fiat-Shamir
Public: modulus N and v = S2 mod N
Secret: Alice knows S
Alice selects random r and commits to r by sending x = r2 mod N to Bob
Bob sends challenge e  {0,1} to Alice
Alice responds with y = rSe mod N
Bob checks that y2 = xve mod N
Does this prove response is from Alice?
Chapter 9 Simple Authentication protocols

67. Chapter 9 Simple Authentication protocols
Does Fiat-Shamir Work?
The math works since
Public: v = S2
Alice to Bob: x = r2 and y = rSe
Bob verifies y2 = xve mod N
Can Trudy convince Bob she is Alice?
If Trudy expects e = 0, she can send x = r2 in msg 1 and y = r in msg 3 (i.e., follow protocol)
If Trudy expects Bob to send e = 1, she can send x = r2v1 in msg 1 and y = r in msg 3
If Bob chooses e  {0,1} at random, Trudy can fool Bob with probability 1/2
Chapter 9 Simple Authentication protocols

68. Chapter 9 Simple Authentication protocols
Fiat-Shamir Facts
Trudy can fool Bob with prob 1/2, but…
After n iterations, the probability that Trudy can fool Bob is only 1/2n
Just like Bob’s cave!
Bob’s e  {0,1} must be unpredictable
Alice must use new r each iteration or else
If e = 0, Alice sends r in message 3
If e = 1, Alice sends rS in message 3
Anyone can find S given both r and rS
Chapter 9 Simple Authentication protocols

69. Fiat-Shamir Zero Knowledge?
Zero knowledge means that Bob learns nothing about the secret S
Public: v = S2 mod N
Bob sees r2 mod N in message 1
Bob sees rS mod N in message 3 (if e = 1)
If Bob can find r from r2 mod N, he gets S
But that requires modular square root
If Bob can find modular square roots, he can get S from public v
The protocol does not “help” Bob to find S
Chapter 9 Simple Authentication protocols

70. Chapter 9 Simple Authentication protocols
ZKP in the Real World
Public keys identify users
No anonymity if public keys transmitted
ZKP offers a way to authenticate without revealing identities
ZKP supported in Microsoft’s Next Generation Secure Computing Base (NGSCB)
ZKP used to authenticate software “without revealing machine identifying data”
ZKP not just fun and games for mathematicians!
Chapter 9 Simple Authentication protocols

71. Best Authentication Protocol?
What is best depends on many factors…
The sensitivity of the application
The delay that is tolerable
The cost that is tolerable
What crypto is supported
Public key, symmetric key, hash functions
Is mutual authentication required?
Is a session key required?
Is PFS a concern?
Is anonymity a concern?, etc.
Chapter 9 Simple Authentication protocols