1. CSC 482/582: Computer Security
Security Protocols
CSC 482/582: Computer Security

2. Topics Basic Concepts of Cryptography Security Protocols
Authentication Protocols
Key Exchange Protocols
Kerberos
Public Key Infrastructure
CSC 482/582: Computer Security

3. Encryption and Decryption
The message M is called the plaintext. Alice will convert plaintext M to an encrypted form using an encryption algorithm E that outputs a ciphertext C for M.
encrypt
decrypt
ciphertext
plaintext
shared
secret
key
Communication channel
Sender
Recipient
Attacker
(eavesdropping)

4. Encryption and Decryption
As equations: C = E(M,K) M = D(C,K) The encryption and decryption algorithms are chosen so that it is infeasible for someone other than Alice and Bob to determine plaintext M from ciphertext C without knowing the key K. Thus, ciphertext C can be transmitted over an insecure channel that can be eavesdropped by an adversary.

5. Caesar Cipher
Replace each letter with the one “three over” in the alphabet.
Public domain image from

6. Kerckhoff’s Principle
Security of cryptosystem should only depend on
Quality of shared encryption algorithm E
Secrecy of key K
Security through obscurity tends to fail
ex: DVD Content Scrambling System

7. Symmetric Cryptosystems
Alice and Bob share a secret key, which is used for both encryption and decryption.
encrypt
decrypt
ciphertext
plaintext
shared
secret
key
Communication channel
Sender
Recipient
Attacker
(eavesdropping)

8. Symmetric Key Distribution
Requires each pair of communicating parties to share a (separate) secret key.
shared
secret
shared
secret
shared
secret
shared
secret
shared
secret
n (n-1)/2 keys
shared
secret

9. Public-Key Cryptography
Bob has two keys: a private key, SB, which Bob keeps secret, and a public key, PB, which Bob broadcasts widely.
In order for Alice to send an encrypted message to Bob, she need only obtain his public key, PB, use that to encrypt her message, M, and send the result, C = EPB (M), to Bob. Bob then uses his secret key to decrypt the message as M = DSB (C).

10. Public-Key Cryptography
Separate keys for encryption and decryption.
encrypt
decrypt
ciphertext
plaintext
public
key
private
Communication channel
Sender
Recipient
Attacker
(eavesdropping)

11. Public Key Distribution
Only one key is needed for each recipient
n key pairs
private
public

12. Digital Signatures
Public-key encryption provides a method for doing digital signatures, which serve the same authentication purpose as script signatures.
To sign a message, M, Alice just encrypts it with her private key, SA, creating C = ESA(M).
Anyone can decrypt this message using Alice’s public key, as M’ = DPA(C).
If M=M’, then signature is valid.

13. Secure Hash Functions
A secure hash function or message authentication code (MAC) is a checksum on a message, M, with the following properties:
One-way: it should be easy to compute Y=H(M), but hard to find M given only Y.
Collision-resistant: it should be hard to find two messages, M and N, such that H(M)=H(N).
Examples: MD5, SHA-1, SHA-256.
Images from

14. Message Authentication Codes
With the addition of a shared, secret key, a MAC allows for Alice and Bob to have data integrity.
Given a message M, Alice computes H(K||M) and sends M and this hash to Bob.
(attack detected) =?
MAC h
shared
secret
key
Communication channel
Sender
Recipient
Attacker
(modifying)
6B34339
4C66809
message M’
87F9024
received MAC
computed MAC
message M

15. What is a Protocol?
Human protocols: rules and procedures followed in human interactions, such as social situations.
Example: Ordering, eating, and paying in a restaurant.
Network protocols: rules followed in networked communication systems.
Examples: TCP/IP, HTTP, FTP, etc.
Security protocols: communication rules followed in a security application.
Examples: SSL/TLS, IPSec, Kerberos, etc.
CSC 482/582: Computer Security

16. ATM Machine Protocol Insert ATM card. Enter PIN.
Correct PIN? (3 tries allowed)
Yes? Conduct your transaction
No? Machine eats card

17. Dramatis Personae Cathy, the Computer, trusted 3rd party.
Alice, 1st participant
Bob, 2nd participant
Eve, the Eavesdropper
CSC 482/582: Computer Security

18. Notation X sends Y a message Z encrypted with key k.
X  Y : {Z} k
Concatenation of bit sequences A and B
A || B
Key subscripts indicate ownership
kA is the key belonging to user A(lice)
kA,B is a key shared by A(lice) and B(ob)
Nonces (nonrepeating random numbers)
r1, r2
CSC 482/582: Computer Security

19. Car unlocking protocols
Principals are the engine controller E and the car key transponder T.
T  E: KT
How does protocol address the threat of car theft?
Threat can replay KT to gain access to car later.
Can thief guess the transponder key, KT?

20. Car unlocking protocols II
Principals are engine controller E and the car key transponder T. N is a nonce, number used once.
T  E: T || {T,N}KT
How does protocol address the threat of car theft?
E verifies T with encrypted version of T.
Nonce prevents replay attack.

21. Car unlocking protocols III
Principals are engine controller E and the car key transponder T. N is a nonce, number used once.
E  T: N
T  E: {T || N }KT
How does protocol address the threat of car theft?
Interactive protocol starts with E sending T a nonce N.
T encrypts and returns nonce with transponder ID T.
Nonce cannot be replayed since returned nonce is encrypted.

22. Nonce
A nonce is an arbitrary nonrepeating number used in security protocols to protect against replay attacks.
If a nonce repeats, it fails to prevent replay attacks.
Generating a nonce
Timestamp
Random number from sufficiently large space not to repeat frequently enough to be vulnerable to replays.
CSC 482/582: Computer Security

23. Authentication Protocols
“I’m Alice”
Prove it
My password is “letmein”
Bob
Alice
Single computer authentication protocol, where
Alice is the user.
Bob is the login program.
CSC 482/582: Computer Security

24. Authentication Protocol Threats
“I’m Alice”
Prove it
My password is “letmein”
Bob
Alice
Sniffing
Replay attacks
Modifications
Eve
CSC 482/582: Computer Security

25. Hashes protect against Sniffing
“I’m Alice”
Prove it
h(Alice’s password)
Bob
Alice
h is a one-way
(hash) function.
Bob can compare with a stored hash
of Alice’s password.
What about
replay attacks?
Eve
CSC 482/582: Computer Security

26. Challenge-Response Authentication
“I’m Alice”
nonce
h(Alice’s password || nonce)
Bob
Alice
The nonce is the challenge.
The hash is the response.
Eve
CSC 482/582: Computer Security

27. Challenge-Response Protocol
Request from Alice
Challenge information
Information that can only be
from Alice which Bob can verify.
Bob
Alice
Eve
CSC 482/582: Computer Security

28. Symmetric Key Problems
Keys must be distributed in secret.
If key is compromised, Eve can decrypt all message traffic encrypted with key.
If each pair of users needs a key, number of keys n(n-1) increases rapidly with size of network.
CSC 482/582: Computer Security

29. Mixed PK/Classical Encryption
Alice communicates with Bob using PK cipher.
Alice randomly generates session key ks.
Key ks used only for this single message.
Alice enciphers ks with Bob’s public key kB .
kB enciphers all session keys Alice uses to communicate with Bob.
Called an interchange key.
Alice sends { m } ks || { ks } kB to Bob.
CSC 482/582: Computer Security

30. Session Key A key used to encrypt a single session. Advantages
Reduces data ciphered with a single key.
Protection against replay attacks.
Prevents forward search (dictionary) attack.
Forward search example
Alice client of Bob’s brokerage.
Communicates with BUY and SELL messages.
Eve enciphers both messages with Bob’s key.
Compares intercepted traffic with ciphertext.
CSC 482/582: Computer Security

31. Key Exchange Algorithms
Goal: Alice, Bob obtain shared secret key.
Requirements:
Key cannot be sent in clear:
Attacker can intercept key.
Key can be sent enciphered, or derived from exchanged data plus data not known to an eavesdropper.
Alice, Bob may trust third party (Cathy.)
All cryptosystems, protocols publicly known
Only secret data is keys or data used to derive keys.
Anything transmitted is assumed known to attacker.
CSC 482/582: Computer Security

32. Classical Key Exchange
Bootstrap problem: how do Alice, Bob begin?
Alice can’t send it to Bob in the clear!
Assume trusted third party, Cathy
Alice and Cathy share secret key kA.
Bob and Cathy share secret key kB.
Let Cathy generate shared key ks.
Cathy can send it securely to either A or B.
CSC 482/582: Computer Security

33. Simple Key Exchange Protocol
Cathy
{ request for session key to Bob } kA
{ ks } kA || { ks } kB
Alice
Bob
{ ks } kB
CSC 482/582: Computer Security

34. Simple Key Exchange Vulnerabilities
How does Bob know he is talking to Alice?
Replay attack: Eve records message from Alice to Bob, later replays it; Bob may think he’s talking to Alice, but he isn’t.
Session key reuse: Eve replays key exchange message from Alice to Bob, so Bob re-uses session key.
Protocols must provide authentication and defense against replay.
CSC 482/582: Computer Security

35. Needham-Schroeder
Alice
Cathy
Alice || Bob || r1
{ Alice || Bob || r1 || ks || { Alice || ks } kB } kA
Bob
{ Alice || ks } kB
{ r2 } ks
{ r2 – 1 } ks
Cathy
CSC 482/582: Computer Security

36. Is Alice really talking to Bob?
Second message
Cathy encrypted it, since only A, C know key kA.
It must be a response to first message as contains r1.
Third message
Alice knows only Bob can read it since encrypted w/ kB.
Any messages enciphered with kS are from Bob, since only Alice, Bob, and Cathy have kS.
CSC 482/582: Computer Security

37. Is Bob really talking to Alice?
Third message
Cathy encrypted it, since only B, C know key kB.
Cathy provides session key, says Alice is other party.
Fourth message
Uses session key to determine if 3rd was replay.
If not, Alice will respond correctly in fifth message.
If 3rd message was replay attack, Eve can’t decipher r2 and so can’t respond, or responds incorrectly.
CSC 482/582: Computer Security

38. Needham-Schroeder Assumptions
A trusted 3rd party exists, Cathy.
Many transactions require 3rd parties.
Session keys are always secure.
What if Eve can obtain old keys?
CSC 482/582: Computer Security

39. Denning-Sacco Modification
Eve can impersonate Alice if she can obtain old ks.
1. Eve replays Alice’s message { Alice || ks } kB.
2. Eve uses old ks to decipher Bob’s random number query.
Eve
Bob
{ Alice || ks } kB
{ r2 } ks
{ r2 – 1 } ks
CSC 482/582: Computer Security

40. Solution How can we avoid replay in step 3 of N-S?
Use time stamp T to detect replay.
Weakness: if clocks not synchronized, may either reject valid messages or accept replays.
Parties with slow/fast clocks vulnerable to replay.
Resetting clock does not eliminate vulnerability.
CSC 482/582: Computer Security

41. Needham-Schroeder + Denning-Sacco Mod
Bob will reject message if timestamp T is too old.
Alice
Cathy
Alice || Bob || r1
{ Alice || Bob || r1 || ks || { Alice || T || ks } kB } kA
Bob
{ Alice || T || ks } kB
{ r2 } ks
{ r2 – 1 } ks
CSC 482/582: Computer Security

42. Otway-Rees Protocol Corrects replay attack w/o timestamps.
Not vulnerable to clock skew problems of Denning-Sacco modification.
Uses integer n to associate all messages with a particular exchange.
CSC 482/582: Computer Security

43. Otway-Rees Protocol Alice Bob
n || Alice || Bob || { r1 || n || Alice || Bob } kA
Cathy
n || Alice || Bob || { r1 || n || Alice || Bob } kA ||
{ r2 || n || Alice || Bob } kB
n || { r1 || ks } kA || { r2 || ks } kB
n || { r1 || ks } kA
CSC 482/582: Computer Security

44. Argument: Alice talking to Bob
Fourth message
If n matches first message, Alice knows it is part of this protocol exchange.
Cathy generated ks because only she & Alice know kA .
Enciphered part belongs to exchange as r1 matches r1 in encrypted part of first message .
CSC 482/582: Computer Security

45. Argument: Bob talking to Alice
Third message
If n matches second message, Bob knows it is part of this protocol exchange.
Cathy generated ks because only she & Bob know kB .
Enciphered part belongs to exchange as r2 matches r2 in encrypted part of second message.
CSC 482/582: Computer Security

46. Defeating Replay Attacks
Eve acquires old ks, message in third step:
n || { r1 || ks } kA || { r2 || ks } kB
Eve forwards appropriate part to Alice:
Alice has no ongoing key exchange with Bob: n matches nothing, so is rejected.
Alice has ongoing key exchange with Bob: n does not match, so is again rejected.
If replay is for the current key exchange, and Eve sent the relevant part before Bob did, Eve could simply listen to traffic; no replay needed.
CSC 482/582: Computer Security

47. Kerberos Authentication system
Based on Needham-Schroeder with Denning-Sacco modification.
Central server plays role of trusted 3rd party Cathy.
Ticket vouches for identity of requester of service.
Active Directory =
Kerberos + LDAP
CSC 482/582: Computer Security

48. Ticket Granting Service
Requirement: Users only enter password once.
User u authenticates to Kerberos server.
Gets ticket Tu,TGS for ticket granting service (TGS)
Requirement: Users don’t send password over net.
Diagrams from O’Reilly’s Kerberos: The Definitive Guide
CSC 482/582: Computer Security

49. Service Tickets Procedure for a user u to use service s:
User sends authenticator Au, ticket Tu,TGS to TGS asking for ticket for service.
TGS sends ticket Tu,s to user.
User sends Au, Tu,s to server as request to use s.
CSC 482/582: Computer Security

50. Tu,s = s || { u || u’s address || valid time || ku,s } ks
Ticket Details
Credential saying issuer has identified requester.
Example ticket issued to user u for service s
Tu,s = s || { u || u’s address || valid time || ku,s } ks
where:
ku,s is session key for user and service.
Valid time is interval for which ticket valid.
u’s address may be IP address or something else.
CSC 482/582: Computer Security

51. Au,s = { u || generation time || kt } ku,s
Authenticator
Credential containing identity of sender of ticket.
Contains username and session key to confirm sender is entity to which ticket was issued.
Authenticator cannot be accessed without ticket, since data encrypted with ku,s.
Authenticator user u generates for service s
Au,s = { u || generation time || kt } ku,s
where:
kt is alternate session key.
Time is when authenticator generated.
CSC 482/582: Computer Security

52. Public Key Exchange Here interchange keys known Simple protocol
eA, eB Alice and Bob’s public keys known to all
dA, dB Alice and Bob’s private keys known only to owner
Simple protocol
ks is desired session key.
Alice
Bob
{ ks } eB
CSC 482/582: Computer Security

53. Problem and Solution Vulnerable to forgery or replay
Because eB known to anyone, Bob has no assurance that Alice sent message.
Simple fix uses Alice’s private key
ks is desired session key.
Alice
Bob
{ { ks } dA } eB
CSC 482/582: Computer Security

54. Notes Can include message enciphered with ks
Assumes Bob has Alice’s public key, and vice versa
If not, each must get it from public server.
If keys not bound to identity of owner, attacker Eve can launch a man-in-the-middle attack (next slide; Cathy is public server providing public keys.)
Solution: Public key infrastructure (PKI)
CSC 482/582: Computer Security

55. Man-in-the-Middle Attack
Alice
Cathy
please send Bob’s public key
Eve eB eE
Bob
{ ks } eE
{ ks } eB
Eve intercepts request
Eve intercepts message
CSC 482/582: Computer Security

56. Cryptographic Key Infrastructure
Solution: bind identity to key
Classical: not possible as all keys are shared
Use protocols to agree on a shared key (see earlier.)
Public key: bind identity to public key
Crucial as people will use key to communicate with principal whose identity is bound to key.
Erroneous binding means no secrecy between principals.
Assume principal identified by an acceptable name.
CSC 482/582: Computer Security

57. Certificates Create token (message) containing:
Identity of principal (here, Alice)
Corresponding public key
Timestamp (when issued)
Other information (perhaps identity of signer)
signed by trusted authority (Cathy.)
CA = { eA || Alice || T } dC
CSC 482/582: Computer Security

58. Use Bob downloads Alice’s certificate
If he knows Cathy’s public key, he can decipher the certificate
When was certificate issued?
Is the principal Alice?
Now Bob has Alice’s public key.
Problem: Bob needs Cathy’s PK to validate cert.
Problem pushed up a level.
Solution: signature chains.
CSC 482/582: Computer Security

59. Certificate Signature Chains
Create certificate:
Generate hash of identification information of requester.
Encipher hash with issuer’s private key.
Validate
Obtain issuer’s public key.
Decipher enciphered hash.
Recompute hash from certificate and compare.
CSC 482/582: Computer Security

60. X.509 (SSL) Certificates Some certificate components in X.509v3:
Version
Serial number
Signature algorithm identifier: hash algorithm
Issuer’s name; uniquely identifies issuer
Interval of validity
Subject’s name; uniquely identifies subject
Subject’s public key
Signature: enciphered hash
CSC 482/582: Computer Security

61. X.509 Certificate Validation
Obtain issuer’s public key
The one for the particular signature algorithm
Decipher signature
Gives hash of certificate
Recompute hash from certificate and compare
If they differ, there’s a problem
Check interval of validity
This confirms that certificate is current
CSC 482/582: Computer Security

62. Issuers X<<Y>>
Certification Authority (CA): entity that issues certificates; Cathy, the trusted 3rd party
Multiple issuers pose validation problem.
Alice’s CA is Cathy; Bob’s CA is Don; how can Alice validate Bob’s certificate?
Have Cathy and Don cross-certify
Each issues certificate for the other CA.
Notation: Certificate X issued for Y
X<<Y>>
CSC 482/582: Computer Security

63. Validation and Cross-Certifying
Certificates:
Cathy<<Alice>>
Dan<<Bob>>
Cathy<<Dan>>
Dan<<Cathy>>
Alice validates Bob’s certificate:
Alice obtains Cathy<<Dan>>
Alice uses (known) public key of Cathy to validate Cathy<<Dan>>
Alice uses Cathy<<Dan>> to validate Dan<<Bob>>
CSC 482/582: Computer Security

64. PGP Chains OpenPGP certificates verified via “web of trust”
No hierarchy of CAs to follow like SSL certificates
Certificates can be signed by multiple parties
OpenPGP certificates structured into packets:
One public key packet.
Zero or more signature packets.
CSC 482/582: Computer Security

65. Signing Single certificate may have multiple signatures.
Notion of “trust” embedded in each signature
Range from “untrusted” to “ultimate trust.”
Signer defines meaning of trust level (no standards!)
All version 4 keys signed by subject
Called “self-signing.”
CSC 482/582: Computer Security

66. Validating Certificates
Alice needs to validate Bob’s OpenPGP cert
!: Fred,Giselle,Ellen.
Alice gets Giselle’s cert
Knows Henry slightly, but signature at “casual” trust.
Alice gets Ellen’s cert
Knows Jack, so uses his cert to validate Ellen’s, then hers to validate Bob’s.
Jack<<Ellen>>Ellen<<Bob>>
Arrows show signatures
Self signatures not shown
Bob
Fred
Giselle
Ellen
Irene
Henry
Jack
CSC 482/582: Computer Security

67. Storing Keys
Multi-user or networked systems: attackers may defeat access control mechanisms.
Encipher file containing key.
Attacker can monitor keystrokes to decipher files
Key will be resident in memory.
Use physical devices like “smart card.”
Smart card performs encryption.
Computer transfers plaintext to card.
Card transfers ciphertext to computer.
Card can be stolen, split key between two devices.
CSC 482/582: Computer Security

68. Key Revocation Certificates invalidated before expiration Problems
Usually due to compromised key.
May be due to change in circumstance (e.g., someone leaving company.)
Problems
Is entity revoking certificate authorized to do so?
Can revocation information circulates to everyone quickly enough to avoid a compromise?
CSC 482/582: Computer Security

69. CRLs
A Certificate revocation list lists certificates that are revoked, with their IDs and revocation dates.
X.509: only issuer can revoke certificate.
PGP: signers can revoke signatures; owners can revoke certificates, or allow others to do so.
Revocation message placed in PGP packet and signed.
Flag marks it as revocation message.
CSC 482/582: Computer Security

70. Digital Signature
Construct that authenticates origin & contents of message in a manner provable to a disinterested third party (“judge.”)
Nonrepudiatable
Sender cannot deny having sent message.
Proves that sender’s key was used to sign message.
What if you claim key was stolen/compromised?
Court would have to decide.
CSC 482/582: Computer Security

71. Signing and Verification

72. Key Points Security protocols
Definition and notation
Authentication protocols
Key protocols critical to effective use of cryptosystems.
Different levels of keys (session vs. interchange.)
Nonces, sequence numbers, timestamps to avoid replay attacks.
Keys require an infrastructure to identify holders and allow revocation.
SSL certificates verified with hierarchy of CAs.
PGP certificates verified via web of trust.
Digital signatures: integrity of origin and content.
Signature is hash of signed document that is encrypted with signer’s private key.
CSC 482/582: Computer Security

73. References
Matt Bishop, Introduction to Computer Security, Addison-Wesley, 2005.
Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone, Handbook of Applied Cryptography, CRC Press, 1996.
Bruce Schneier, Applied Cryptography, 2nd edition, Wiley, 1996.
John Viega and Gary McGraw, Building Secure Software, Addison-Wesley, 2002.
CSC 482/582: Computer Security