Kemal AkkayaWireless & Network Security 1 Department of Computer Science Southern Illinois University Carbondale CS 591 – Wireless & Network Security Lecture 12: Key Management in Wired Networks Dr. Kemal Akkaya

Kemal AkkayaWireless & Network Security 2 Key Management  Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between authorized parties.  Key management encompasses techniques and procedures supporting:  initialization of systems users within a domain;  generation, distribution, and installation of keying material;  controlling the use of keying material;  update, revocation, and destruction of keying material;  storage, backup/recovery, and archival of keying material.

Kemal AkkayaWireless & Network Security 3 Key Distribution/Establishment  How to have two parties agree on an encryption key securely? 1.A can select key and physically deliver to B 2.third party can select & deliver key to A & B 3.if A & B have communicated previously can use previous key to encrypt a new key 4.if A & B have secure communications with a third party C, C can relay key between A & B  Public key encryption: Solves the problem against passive attackers. e.g. DH Key Exchange: Trudy can’t get g ab mod p. BobAlice g a mod p g b mod p K = g ab mod p

Kemal AkkayaWireless & Network Security 4 Active Attacks  Attacker can intercept, modify, insert, delete messages on the network.  E.g., Man-in-the-Middle attack against DH: Trudy can translate messages between Alice & Bob without being noticed  Similar attacks possible on RSA & other PKC protocols. BobAlice g a mod p g b’ mod p K’ = g ab’ mod p g a mod p g b’ mod p Trudy K’’ = g a’b mod p

Kemal AkkayaWireless & Network Security 5 Trusted Third Parties  Solution against active attackers: “Trusted Third Parties” (TTPs)  Symmetric key solution: KDC  Everyone registers with the KDC, shares a secret key.  When A & B want to communicate, they contact the KDC & obtain a session key.  Public key solution: CA  Everyone registers with the CA, obtains a “certificate” for his/her public key.  Certificate: A document signed by the CA, including the ID and the public key of the subject.  People obtain each other’s certificates thru a repository, a webpage, or at the beginning of the protocol,  and use the certified public keys in the protocols.

Kemal AkkayaWireless & Network Security 6 KDC vs. CA  KDC  faster (being based on symmetric keys)  has to be online  Preferred for LANs  CA  doesn’t have to be online  if crashes, doesn’t disable the network  much simpler  scales better  certificates are not disclosure-sensitive  a compromised CA can’t decrypt conversations  Preferred for WANs (e.g., the Internet).

Kemal AkkayaWireless & Network Security 7 Key Distribution with KDC  A simple protocol:  K A, K B : Long-term secret keys of Alice, Bob. K A {m}: Encryption of m with K A.  Problems with this protocol:  possible delayed delivery of K B {A,B,K AB }.  No freshness guarantee for B (i.e., Trudy can replay K B {A,B,K AB } for a previously compromised K AB ). BA A, B K A {A,B,K AB } KDC K B {A,B,K AB } K AB

Kemal AkkayaWireless & Network Security 8 Key Distribution with CA  A simple protocol:  certificates are obtained in advance  session key transport with public key encryption:  {m} X : Encryption of message m with the public key of X  [m] X : Signature on message m with the public key of X  Problems with this protocol:  B doesn’t authenticate A  No freshness guarantee for B BA { [ A, B, r, K AB ] A } B K AB {r}

Kemal AkkayaWireless & Network Security 9 “Station-to-Station” Protocol  Authenticated DH protocol; basis for many real-life app’s.  Certified PKs are used for signing the public DH parameters. A slightly simplified version: where x = g a mod p, y = g b mod p, k = g ab mod p.  STS vs. encrypted key transport: STS (DH) provides “perfect forward secrecy”. (In encrypted transport, if the long-term RSA key is compromised, the session keys are also compromised.) BobAlice x cert(B), y, [x,y] B cert(A), [x,y] A

Kemal AkkayaWireless & Network Security 10 Multiple Domains with KDC A to talk to B:  contacts KDC A  KDC A contacts KDC B, or tells A how to contact KDC B (e.g. generates a session key for A & KDC B )  KDC B generates a session key for A & B, passes it to them. B A KDC A KDC B

Kemal AkkayaWireless & Network Security 11 Multiple Domains with CA  A, to authenticate the public key of B,  verifies B’s cert. issued by CA B,  verifies CA B ’s cert. issued by CA A,  B does vice versa to authenticate A’s key B A CA A CA B certify each other