1. 8-1 Chapter 8 Security Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 part 1: Principles of cryptography

2. 8-2Network Security Chapter 8: Network Security Chapter goals:  understand principles of network security:  cryptography and its many uses beyond “confidentiality”  authentication  message integrity  security in practice:  firewalls and intrusion detection systems  security in application, transport, network, link layers

3. 8-3Network Security Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity, authentication 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS

4. 8-4Network Security What is network security? confidentiality: only sender, intended receiver should “understand” message contents  sender encrypts message  receiver decrypts message authentication: sender, receiver want to confirm identity of each other message integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection access and availability : services must be accessible and available to users

5. 8-5Network Security Friends and enemies: Alice, Bob, Trudy  well-known in network security world  Bob, Alice (lovers!) want to communicate “securely”  Trudy (intruder) may intercept, delete, add messages secure sender s secure receiver channel data, control messages data Alice Bob Trudy

6. 8-6Network Security Who might Bob, Alice be?  … well, real-life Bobs and Alices!  Web browser/server for electronic transactions (e.g., on-line purchases)  on-line banking client/server  DNS servers  routers exchanging routing table updates  other examples?

7. 8-7Network Security There are bad guys (and girls) out there! Q: What can a “bad guy” do? A: A lot! See section 1.6  eavesdrop: intercept messages  actively insert messages into connection  impersonation: can fake (spoof) source address in packet (or any field in packet)  hijacking: “take over” ongoing connection by removing sender or receiver, inserting himself in place  denial of service: prevent service from being used by others (e.g., by overloading resources)

8. 8-8Network Security Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity, authentication 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS

9. 8-9Network Security The language of cryptography m plaintext message K A (m) ciphertext, encrypted with key K A m = K B (K A (m)) plaintext ciphertext K A encryption algorithm decryption algorithm Alice’s encryption key Bob’s decryption key K B

10. 8-10Network Security Breaking an encryption scheme  cipher-text only attack: Trudy has ciphertext she can analyze  two approaches:  brute force: search through all keys  statistical analysis e and t are the most common letters: occur 13% and 9% of the time common parings: in, to, th, ing, etc.  known-plaintext attack: Trudy has plaintext corresponding to ciphertext  e.g., in monoalphabetic cipher, Trudy determines pairings for a,l,i,c,e,b,o,  chosen-plaintext attack: Trudy chooses the plaintext and then can get the corresponding ciphertext

11. 8-11Network Security Symmetric key cryptography symmetric key crypto: Bob and Alice share same (symmetric) key: K  e.g., key is knowing substitution pattern in mono alphabetic substitution cipher Q: how do Bob and Alice agree on key value? plaintext ciphertext K S encryption algorithm decryption algorithm S K S plaintext message, m K (m) S m = K S (K S (m))

12. 8-12Network Security Simple encryption scheme 1 Caesar cipher: substituting one letter by another a set distance apart (with wrap around) plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: defghijklmnopqrstuvwxyzabc Plaintext: bob. i love you. alice ciphertext: ere. l oryh brx. dolfh e.g.: Encryption key: mapping from set of 26 letters to set of 26 letters K = 3

13. 8-13Network Security Simple encryption scheme 2 substitution cipher: substituting one thing for another  monoalphabetic cipher: substitute one letter for another plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasdfghjklpoiuytrewq Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc e.g.: Encryption key: mapping from set of 26 letters to set of 26 letters

14. 8-14Network Security A more sophisticated encryption approach  n substitution ciphers, M 1,M 2,…,M n  cycling pattern:  e.g., n=4: M 1,M 3,M 4,M 3,M 2 ; M 1,M 3,M 4,M 3,M 2 ;..  for each new plaintext symbol, use subsequent subsitution pattern in cyclic pattern  dog: d from M 1, o from M 3, g from M 4 Encryption key: n substitution ciphers, and cyclic pattern  key need not be just n-bit pattern  polyalphabetic encryption

15. 8-15Network Security Example  Use two Caesar’s ciphers:, C 1,C 2  cycling pattern:  C 1,C 2,C 2,C 1 ; C 1,C 2,C 2,C 1 ; … plaintext: abcdefghijklmnopqrstuvwxyz C 1 k = 5: fghijklmnopqrstuvwxyzabcde Plaintext: bob. i love you. ciphertext: ghu. n etox dhz. e.g.: C 2 k = 19: tuvwxyzabcdefghijklmnopqrs

16. 8-16Network Security Cipher types  Two broad classes of symmetric encryption techniques: stream ciphers and block ciphers  Stream ciphers used in wireless LANs  Block ciphers used in many secure Internet protocols  PGP (secure e-mail)  SSL (secure TCP connections)  IPsec (secure network-layer transport)

17. 8-17Network Security Block Ciphers  Block technique  message broken into blocks of k-bits  each block encrypted independently.  cipher uses a one-to-one mapping to map the k-bit block of cleartext to a k-bit block of ciphertext  k today is commonly 128 (see AES later)

18. 8-18Network Security Block Ciphers  Block Example  k = 3 map 3-bit inputs to 3-bit outputs  one possible mapping is in the table below  010110001111 inputoutput 000110 001111 010101 011100 inputoutput 100011 101010 110000 111001 101000111001

19. 8-19Network Security Block Ciphers  Block technique  how many different mappings for 3 bits?  a mapping is a permutation of all possible inputs  2 3 possible inputs (the input columns)  8! permutations = 40,320 different ways  each of these mappings is a different key  Attack  brute force: if know k, can try all the different mappings  for k=3 would take milliseconds to break.  Protection  bigger blocks (56 bits or 128 bits are used)  Number of different permutations for k bits is 2 k !  Problem: tables also become very large!

20. 8-20Network Security Block Ciphers  Simulated randomly-permuted tables technique  large blocks create tables that are too large to use  break blocks into chunks, process chunks.  Repeat n times until every input bit affects every output bit.  Example  k = 64  break into 8 chunks (each chunk has 8 bits)  process each chunk with a separate 8-bit table (label T i )  reassemble into 64 bit block  permute bits (to scramble them)  repeat n times  see table on next slide

21. 8-21 Network Security Block Ciphers

22. 8-22Network Security Symmetric key crypto: DES DES: Data Encryption Standard  US encryption standard [NIST 1993]  56-bit symmetric key, 64-bit plaintext input  block cipher with cipher block chaining  how secure is DES?  DES Challenge: 56-bit-key-encrypted phrase decrypted (brute force) in less than a day  no known good analytic attack  making DES more secure:  3DES: encrypt 3 times with 3 different keys

23. 8-23Network Security Symmetric key crypto: DES initial permutation 16 identical “rounds” of function application, each using different 48 bits of key final permutation DES operation

24. 8-24Network Security AES: Advanced Encryption Standard  symmetric-key NIST standard, replacied DES (Nov 2001)  processes data in 128 bit blocks  128, 192, or 256 bit keys  brute force decryption (try each key) taking 1 sec on DES, takes 149 trillion years for AES

25. 8-25Network Security Public Key Cryptography symmetric key crypto  requires sender, receiver know shared secret key  Q: how to agree on key in first place (particularly if never “met”)? public key crypto  radically different approach [Diffie- Hellman76, RSA78]  sender, receiver do not share secret key  public encryption key known to all  private decryption key known only to receiver

26. 8-26Network Security Public key cryptography plaintext message, m ciphertext encryption algorithm decryption algorithm Bob’s public key plaintext message K (m) B + K B + Bob’s private key K B - m = K ( K (m) ) B + B -

27. 8-27Network Security Public key encryption algorithms need K ( ) and K ( ) such that B B.. given public key K, it should be impossible to compute private key K B B requirements: 1 2 RSA: Rivest, Shamir, Adelson algorithm + - K (K (m)) = m B B - + + -

28. 8-28Network Security Prerequisite: modular arithmetic  x mod n = remainder of x when divide by n  facts: [(a mod n) + (b mod n)] mod n = (a+b) mod n [(a mod n) - (b mod n)] mod n = (a-b) mod n [(a mod n) * (b mod n)] mod n = (a*b) mod n  thus (a mod n) d mod n = a d mod n  example: x=14, n=10, d=2: (x mod n) d mod n = 4 2 mod 10 = 6 x d = 14 2 = 196 x d mod 10 = 6

29. 8-29Network Security RSA: getting ready  message: just a bit pattern  bit pattern can be uniquely represented by an integer number  thus, encrypting a message is equivalent to encrypting a number. example:  m= 10010001. This message is uniquely represented by the decimal number 145.  to encrypt m, we encrypt the corresponding number, which gives a new number (the ciphertext).

30. 8-30Network Security RSA: Creating public/private key pair 1. choose two large prime numbers p, q. (e.g., 1024 bits each) 2. compute n = pq, z = (p- 1 )(q- 1 ) 3. choose e (with e<n) that has no common factors with z (e, z are “relatively prime”). 4. choose d such that ed- 1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5. public key is (n,e). private key is (n,d). K B + K B -

31. 8-31Network Security RSA: encryption, decryption 0. given (n,e) and (n,d) as computed above 1. to encrypt message m (<n), compute c = m mod n e 2. to decrypt received bit pattern, c, compute m = c mod n d m = (m mod n) e mod n d magic happens! c

32. 8-32Network Security RSA example: Bob chooses p=5, q=7. Then n = pq, z = (p- 1 )(q- 1 ) so n=35, z = 4*6 =24. choose e=5 (so e, z relatively prime). choose d=29 (so ed – 1 = 5*29 – 1 = 144 exactly divisible by z). bit pattern m m e c = m mod n e 0000l000 12 24832 17 encrypt: encrypting 8-bit messages. Public key = (n,e) = (35, 5) Private Key = (n,d) = (35, 29) c m = c mod n d 17 481968572106750915091411825223071697 12 c d decrypt:

33. 8-33Network Security RSA example: Bob chooses p=3, q=11. Then n=?, z=?. e=? (so e, z relatively prime). d=? (so ed-1 exactly divisible by z). bit pattern m m e c = m mod n e 0000l000 12 ??? ?? encrypt: encrypting 8-bit messages. c m = c mod n d ?? ???????????????????????????? 12 c d decrypt:

34. 8-34Network Security RSA example: Bob chooses p=3, q=11. Then n=33, z=20. e=7 (so e, z relatively prime). d=3 (so ed-1 exactly divisible by z): 3 [(3 * 7) % 20 = 1] (there are other choices for e and d!) bit pattern m m e c = m mod n e 00000010 2 2 7 = 128 128 mod 33 = 29 encrypt: encrypting 8-bit messages. Public key: (e,n) (7,33) Private key: (d,n) (3,33) c m = c mod n d 29 29 3 =24389 24389% 33 = 2 c d decrypt:

35. 8-35Network Security Why does RSA work?  must show that c d mod n = m where c = m e mod n  fact: for any x and y: x y mod n = x (y mod z) mod n  where n= pq and z = (p-1)(q-1)  thus, c d mod n = (m e mod n) d mod n = m ed mod n = m (ed mod z) mod n = m 1 mod n = m from number theory: if p and q are prime, n = pq and z = (q-1)(q-1) then x y mod n = x (y mod z) mod n When m is not relatively prime to n, the argument just given is invalid. This is highly improbable

36. 8-36Network Security RSA: another important property The following property will be very useful later: K ( K (m) ) = m B B - + K ( K (m) ) B B + - = use public key first, followed by private key use private key first, followed by public key result is the same!

37. 8-37Network Security follows directly from modular arithmetic: (m e mod n) d mod n = m ed mod n = m de mod n = (m d mod n) e mod n K ( K (m) ) = m B B - + K ( K (m) ) B B + - = Why ?

38. 8-38Network Security Why is RSA secure?  suppose you know Bob’s public key (n,e). How hard is it to determine d?  essentially need to find factors of n without knowing the two factors p and q  fact: factoring a big number is hard

39. 8-39Network Security RSA in practice: session keys  exponentiation in RSA is computationally intensive  DES is at least 100 times faster than RSA  use public key cryto to establish secure connection, then establish second key – symmetric session key – for encrypting data session key, K S  Bob and Alice use RSA to exchange a symmetric key K S  once both have K S, they use symmetric key cryptography

40. 8-40Network Security Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity, authentication 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS

41. 8-41Network Security Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap1.0: Alice says “I am Alice” Failure scenario?? “I am Alice”

42. 8-42Network Security in a network, Bob can not “see” Alice, so Trudy simply declares herself to be Alice “I am Alice” Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap1.0: Alice says “I am Alice”

43. 8-43Network Security Authentication: another try Protocol ap2.0: Alice says “I am Alice” in an IP packet containing her source IP address Failure scenario?? “I am Alice” Alice’s IP address

44. 8-44Network Security Trudy can create a packet “spoofing” Alice’s address “I am Alice” Alice’s IP address Authentication: another try Protocol ap2.0: Alice says “I am Alice” in an IP packet containing her source IP address

45. 8-45Network Security Protocol ap3.0: Alice says “I am Alice” and sends her secret password to “prove” it. Failure scenario?? “I’m Alice” Alice’s IP addr Alice’s password OK Alice’s IP addr Authentication: another try

46. 8-46Network Security playback attack: Trudy records Alice’s packet and later plays it back to Bob “I’m Alice” Alice’s IP addr Alice’s password OK Alice’s IP addr “I’m Alice” Alice’s IP addr Alice’s password Protocol ap3.0: Alice says “I am Alice” and sends her secret password to “prove” it. Authentication: another try

47. 8-47Network Security Authentication: yet another try Protocol ap3.1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it. Failure scenario?? “I’m Alice” Alice’s IP addr encrypted password OK Alice’s IP addr

48. 8-48Network Security record and playback still works! “I’m Alice” Alice’s IP addr encrypted password OK Alice’s IP addr “I’m Alice” Alice’s IP addr encrypted password Authentication: yet another try Protocol ap3.1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it.

49. 8-49Network Security Goal: avoid playback attack Failures, drawbacks? nonce: number (R) used only once-in-a-lifetime ap4.0: to prove Alice “live”, Bob sends Alice nonce, R. Alice must return R, encrypted with shared secret key “I am Alice” R K (R) A-B Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice! Authentication: yet another try

50. 8-50Network Security Authentication: ap5.0 ap4.0 requires shared symmetric key  can we authenticate using public key techniques? ap5.0: use nonce, public key cryptography “I am Alice” R Bob computes K (R) A - “send me your public key” K A + (K (R)) = R A - K A + and knows only Alice could have the private key, that encrypted R such that (K (R)) = R A - K A +

51. 8-51Network Security ap5.0: security hole man (or woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice) I am Alice R T K (R) - Send me your public key T K + A K (R) - Send me your public key A K + T K (m) + T m = K (K (m)) + T - Trudy gets sends m to Alice encrypted with Alice’s public key A K (m) + A m = K (K (m)) + A - R

52. 8-52Network Security difficult to detect:  Bob receives everything that Alice sends, and vice versa. (e.g., so Bob, Alice can meet one week later and recall conversation!)  problem is that Trudy receives all messages as well! ap5.0: security hole man (or woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice)