1. System Security: Cryptography Technologies CPE 261403 - Operating Systems http://www.e-cpe.org/moodle

2. What does the fish mean?

3. Ichthys

5. User name / Password

6. Threat Ex: Wifi Packet Sniffers

7. Protection with Cryptography

8. Encryption and Decryption Symmetric – Uses a shared key Asymmetric – Added security with Public and Private keys

9. Symmetric Encryption I LOVE YOU Simple example: Add a constant to the ASCII value J MPWF ZPV Key = 1

10. The Enigma Machine German Encryption Machine For WWI

12. Enigma was cracked by the Allies in WWII Some say this helped shortened WWII by two years

13. Some Examples Data Encryption Standard (DES)  56 bit key for every 64 bit value Advanced Encryption Standard (AES)  256 bit key for every 128 bit value RC4  As used in WEP (Wired Equivalent Privacy) WPA, WPA2 (Wi-Fi Protected Access)  256 bit key

14. Asymmetric Encryption

15. Algorithm Example Public Key = (kd, N) Private Key = (ke, N) N = p.q (where p, q are prime numbers) Pick kd that is < N Calculate ke where  ke.kd mod (p-1)(q-1) = 1

16. Example If p = 7 and q = 13 N = 7.13 = 91 Pick Kd = 5 Find Ke  Ke.5 mod (7-1)(13-1) = 1  Ke = 29 Public Key = (5, 91) Private Key = (29, 91)

17. Encrypting and Decrypting Encrypt message = (input ^ ke ) mod N Decrypt message = (input ^ kd) mod N If we want to send the number 69 Encrypted message = 69 ^ 5 mod 91 = 62 Decrypted message = 62 ^ 29 mod 91 = 69 *Note: number must < N

18. Notes In reality p and q can be 512 bits each

19. Case Study: SSL (Secure Socket Layer Protocol)

20. An Online Bank Example Browser SCB Server Request Secure Connection (HTTPS) Sends a Public Key Encrypt & Send Login/Password Is there a problem with this method? Yes. A fake web site can also send a public key

21. SSL Certificate Verification Browser SCB Server Request SSL Sends key + Certificate Verify

22. SSL Protocol Browser SCB Server Request SSL Sends key + Certificate Verify Encrypt + send user/password Ok. Now the client can send secure info to the server. But how can the bank send secure information to the client?

23. SSL Protocol Browser SCB Server Request SSL Sends key + Certificate Verify Sends client’s public key Do we need to verify the Server’s second response? Yes. But now it is easier. Data encrypted with client’s public key

24. SSL Protocol Browser SCB Server Request SSL Sends key + Certificate Verify Sends client’s public key If the client can de-crypt the data with the server’s public key It verifies that data is sent from the server. Data encrypted with client’s public key Encrypt with server’s private key

25. Browser SCB Server SSL Protocol Data encrypted with client’s public key Encrypt with server’s private key Double encryption is too much work. Can we optimize?

26. Browser with New (pub/pri) keys Server with New (pub/pri) keys SSL Protocol Send a new public key Encrypt with server’s private key Yes. The server can send a new set of keys for future use Secure Data Encrypt with the new public key Encrypt with the new private key Encrypt with the client’s public key

27. Summary Browser SCB Server Request SSL Sends key + Certificate Verify Sends client’s public key Send new pub key Secure Data

28. Encryption is a cat & mouse game Encryption is becoming more complex (64bits, 128bits, …, 512bits, …, ?) Relies on Mathematical Models. Can be cracked. Never fully trust that your data is safe with encryption