1. EEC 688/788 Secure and Dependable Computing
Lecture 3
Wenbing Zhao
Department of Electrical and Computer Engineering
Cleveland State University
4/20/2017
EEC688: Secure & Dependable Computing

2. EEC688: Secure & Dependable Computing
Outline
Public-key algorithms
Digital signatures, Message digest, Message authentication code
Public key management
Authentication Concept
Authentication protocols
Attacks on authentication protocols
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

3. Public-Key Algorithms
Distributing keys => the weakest link in most cryptosystems
No matter how strong a cryptosystem was, if an intruder could steal the key, the system was worthless
Cryptologists always took for granted that the encryption key and decryption key were the same
Diffie and Hellman (1976) proposed a radically new kind of cryptosystem: encryption and decryption keys were different
D(E(P)) = P
It is exceedingly difficult to deduce D from E
E cannot be broken by a chosen plaintext attack
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

4. Public-Key Algorithms
Public-key cryptography:
Encryption algorithm and the encryption key can be made public
How to establish a secure channel
Alice and Bob have never had previous contact
Alice sends Bob EB(P) (message P encrypted using Bob’s public encryption key EB)
Bob receives the encrypted message and retrieves the plaintext by using his private key P = DB(EB(P))
Bobs then sends a reply EA(R) to Alice
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

5. EEC688: Secure & Dependable Computing
RSA
Rivest, Shamir, Adleman, 1978: a good method for public-key cryptography
RSA method:
Choose two large primes, p and q (typically 1024 bits)
Compute n = p  q and z = (p-1)  (q-1)
Choose a number relatively prime to z and call it d
Find e such that e  d = 1 mod z
To encrypt a message, P, Compute C = Pe (mod n)
To decrypt C, compute P = Cd (mod n)
The public key consists of the pair (e, n)
The private key consists of the pair (d, n)
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

6. EEC688: Secure & Dependable Computing
RSA
An example of the RSA algorithm
P = 3, q = 11 => n = 33 and z = 20
A suitable value for d = 7
e can be found by solving the eq. 7e = 1 (mod 20) => e = 3
C = P3 (mod 33), P = C7 (mod 33)
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

7. EEC688: Secure & Dependable Computing
Digital Signatures
Requirement on digital signatures: one party can send a signed message to another party in such a way that the following conditions hold:
The receiver can verify the claimed identity of the sender
The sender cannot later repudiate the contents of the message
The receiver cannot possibly have fabricated the message himself
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

8. Symmetric-Key Signatures
Big Brother (BB): a central authority that knows everything and whom everyone trusts
Each user chooses a secret key and shares it with BB
Digital signatures with Big Brother
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

9. Public-Key Signatures
Digital signatures using public-key cryptography
Requires E(D(P)) = P (in addition to D(E(P)) = P)
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

10. EEC688: Secure & Dependable Computing
Message Digests
Message digest (MD): using a one-way hash function that takes an arbitrarily long piece of plaintext and from it computes a fixed-length bit string
Requirement on the hash function:
Given P, it is easy to compute MD(P)
Given MD(P), it is effectively impossible to find P
No collision: given P no one can find P’ such that MD(P’) = MD(P)
A change to the input of even 1 bit produces a very different output
Often, authentication is needed but secrecy is not
Given P no one can find P’ such that MD(P’) = MD(P): it means that the task to find a collision is computationally very expensive
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

11. Digital Signatures Using Message Digests
Ask question: why encryption of message digest is not needed?
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

12. EEC688: Secure & Dependable Computing
MD5
One of the most widely used hash functions
MD5 is the fifth in a series of message digests designed by Ronald Rivest (1992)
It operates by mangling bits in a sufficiently complicated way that every output bit is affected by every input bit
MD5 generates a 128-bit fixed value
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

13. EEC688: Secure & Dependable Computing
SHA-1
SHA-1: Secure Hash Algorithm 1, developed by National Security Agency (NSA) and blessed by NIST. It generates 160-bit message digest
SHA-2: a set of secure hash algorithms
SHA-224, SHA-256, SHA-384, SHA-512
Use of SHA-1 and RSA for signing nonsecret messages
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

14. Message Authentication Code
MACs are used between two parties that share a secret key in order to validate information transmitted between these parties
The MAC mechanism that is based on cryptographic hash functions is called HMAC:
Append the key to the plaintext and generate a digest using a hash function
Ship the plaintext together with the digest
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

15. Management of Public Keys
Problem statement
Certificates
X.509
Public key infrastructure
Start next Wednesday 9/16
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

16. Problems with Public-Key Management
If Alice and Bob do not know each other, how do they get each other’s public keys to start the communication process ?
It is essential Alice gets Bob’s public key, not someone else’s
A way for Trudy to subvert public-key encryption
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

17. EEC688: Secure & Dependable Computing
Certificates
Certification Authority (CA): an organization that certifies public keys
It certifies the public keys belonging to people, companies, or even attributes
CA does not need to be on-line all the time (in ideal scenarios)
A possible certificate and its signed hash
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

18. EEC688: Secure & Dependable Computing
X.509
Devised and approved by ITU
The basic fields of an X.509 certificate
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

19. Public-Key Infrastructures
A Public-Key Infrastructure (PKI) is needed for reasons of
Availability, Scalability, Ease of management
A PKI has multiple components
Users, CAs, Certificates, RAs (Registration Authorities)
A PKI provides a way of structuring these components and define standards for the various documents and protocols
A simple form of PKI is hierarchical CAs
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

20. Public-Key Infrastructures
Hierarchical PKI
A chain of trust/certification path: A chain of certificates going back to the root
A registration authority (RA) that acts as the verifier for the certificate authority before a digital certificate is issued to a requestor
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

21. Public-Key Infrastructures
Revocation: sometimes certificates can be revoked, due to a number of reasons
Reinstatement: a revoked certificate could conceivably be reinstated
Each CA periodically issues a CRL (Certificate Revocation List) giving the serial numbers of all certificates that it has revoked
A user who is about to use a certificate must now acquire the CRL to see if the certificate has been revoked
Having to deal with revocation (and possibly reinstatement) eliminates one of the best properties of certificates, namely, that they can be used without having to contact a CA
Revocation examples:
Person or organization holding it has abused it in some way
The subject's private key has been exposed
The CA's private key has been compromised
Reinstatement example:
if it was revoked for nonpayment of some fee that has since been paid
4/20/2017
EEC688: Secure & Dependable Computing

22. Authentication Protocols
Authentication is the technique by which a process verifies that its communication partner is who it is supposed to be and not an imposter
Verifying the identity of a remote process in the face of a malicious, active intruder is surprisingly difficult and requires complex protocols based on cryptography
Not to be confused with authorization
Authorization is concerned with what process is permitted to do
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

23. EEC688: Secure & Dependable Computing
Authorization
Authentication: Verify the claim that a subject says it is S: verifying the identity of a subject
Authorization: Determining whether a subject is permitted certain services from an object
Note: authorization makes sense only if the requesting subject has been authenticated
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

24. General Model for Authentication Protocols
Alice starts out by sending a message either to Bob or to a trusted KDC (Key Distribution Center), which is expected to be honest
Several other message exchanges follow in various directions
Trudy may intercept, modify, or replay the messages transmitted to trick Alice and Bob
When the protocol has been completed, Alice is sure she is talking to Bob and Bob is sure he is talking to Alice
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

25. General Model for Authentication Protocols
In general, the authentication process also produce a secret session key for use in the upcoming conversation
For each new connection, a new, randomly-chosen session key should be used
Public-key cryptography is widely used for the authentication protocols themselves and for establishing the session key
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

26. EEC688: Secure & Dependable Computing
Why Use a Session Key
For performance reasons, symmetric key encryption is much faster than public-key encryption
To minimize the amount of traffic that gets sent with the users’ secret keys
These keys are used to establish the secure session
To reduce the amount of ciphertext encrypted using the same key which an intruder can obtain
If a session key is broken, only info sent in that session is exposed
To minimize the damage done if a process crashes and its core dump falls into the wrong hands. Hopefully, the only key present then will be the session key
All the permanent keys should have been carefully zeroed out after the session was established
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

27. Authentication Protocols
Authentication Based on a Shared Secret Key
Establishing a Shared Key: Diffie-Hellman
Authentication Using a Key Distribution Center
Authentication Using Public-Key Cryptography
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

28. Authentication Based on a Shared Secret Key
Two-way authentication using a challenge-response protocol
Challenge-response: one party sends a random number to the other, who then transforms it in a special way and then returns the result
Nonces: random numbers used just once in challenge-response protocols
Assume that Alice and Bob already share a secret key, KAB
What else should only be used once?
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

29. Authentication Based on a Shared Secret Key
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

30. Authentication Based on a Shared Secret Key
A shortened two-way authentication protocol. Is this new protocol an improvement over the original one ?
It is shorter
But it is also wrong
Under certain circumstances, Trudy can defeat this protocol by using what is known as a reflection attack
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

31. EEC688: Secure & Dependable Computing
Reflection Attack
The reflection attack: Trudy can break it if it is possible to open multiple sessions with Bob at once
This attack can be defeated by encrypting RB with KAB in message 2
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

32. General Rules for Authentication Protocols Design
Rule#1: Have the initiator prove who she is before the responder has to
In the previous case, Bob gives away valuable information before Trudy has to give any evidence of who she is
Rule#2: Have the initiator and responder use different keys for proof, e.g., KAB and K'AB
Rule#3: Have the initiator and responder draw their challenges from different sets
E.g., the initiator uses even numbers, the responder uses odd numbers
Rule#4: Be aware of parallel sessions (no info flows across different sessions)
Rule#1: In the previous case, Bob gives away valuable information before Trudy has to give any evidence of who she is
Rule#2: even if this means having two shared keys, KAB and K'AB
Rule#3: E.g., the initiator uses even numbers, the responder uses odd numbers
Rule#4: Make the protocol resistant to attacks involving a second parallel session in which information obtained in one session is used in a different one
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

33. Establishing a Shared Key: The Diffie-Hellman Key Exchange
A protocol that leads to the establishment of a shared secrete key is called key agreement protocol or key exchange protocol
Diffie-Hellman key exchange
Two large numbers, n and g, where n is a prime, (n - 1)/2 is also a prime and certain conditions apply to g
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

34. Establishing a Shared Key: The Diffie-Hellman Key Exchange
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

35. Establishing a Shared Key: The Diffie-Hellman Key Exchange
Example: n = 47 and g = 3. Alice picks x = 8 and Bob picks y = 10. Both of these are kept secret
Alice's message to Bob is (47, 3, 28) because 38 mod 47 is 28. Bob's message to Alice is (17)
Alice computes 178 mod 47, which is 4
Bob computes 2810 mod 47, which is 4
Alice and Bob have independently determined that the secret key is now 4
Trudy has to solve the equation 3x mod 47 = 28
47 is a prime, so does (47-1)/2=23
Trudy has to solve the equation 3x mod 47 = 28, which can be done by exhaustive search for small numbers like this, but not when all the numbers are hundreds of bits long
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

36. Establishing a Shared Key: The Diffie-Hellman Key Exchange
The man-in-the-middle attack
When Bob gets (47, 3, 28), how does he know it is from Alice and not from Trudy? There is no way he can know
Trudy can exploit this fact to deceive both Alice and Bob
Man in the middle attack is also called bucket brigade
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

37. Man-In-The-Middle Attack
A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised
The attacker must be able to observe and intercept messages going between the two victims
The MITM attack can work against public-key cryptography and is also particularly applicable to the original Diffie-Hellman key exchange protocol, when used without authentication.
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

38. Authentication Using a Key Distribution Center
Each user has a single key shared with the KDC. Authentication and session key management now goes through the KDC
The following protocol is subject to replay attack
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

39. Needham-Schroeder Authentication Protocol
Needham-Schroeder protocol: a multi-way challenge-response protocol
To eliminate the possibility of replay attacks, have each party both generate a challenge and respond to one
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

40. Needham-Schroeder Authentication Protocol
Message 1: RA is a nonce
Message 2:
KB(A, KS) is ticket Alice will send to Bob
RA: so that message 2 is not a replay
B: so that if Trudy replaces B with her id in message 1, it will be detected
Ticket is encrypted using Bob’s key KB so that Trudy cannot replace it with something else on the way back to Alice
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

41. Needham-Schroeder Authentication Protocol
Message 3: a new nonce RA2 is used
Message 4: Bob sends back KS(RA2-1) instead of KS(RA2) so that Trudy cannot steal KS(RA2) from message 3 and replay it here
Message 5: to convince Bob he is talking to Alice and no replays are being used
Regarding msg#4: if it is expected Bob to send KS(RA2) back instead of KS(RA2-1), Trudy could intercept msg#3 and response with msg#4 without the need to know either KB and KS. This would invalidate the purpose to authenticate Bob. The original design idea: to get expected response, Bob needs to know KS, to know KS, Bob must have KB.
Good protocol have defense in depth: even if Trudy supplied an expected reply, she still must break the session key KS to cause any damage.
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

42. Authentication Using Public-Key Cryptography
Message 1: Alice asks a directory server for Bob’s certificate (containing Bob’s public key)
Message 2: An X.509 certificate containing Bob's public key is sent to Alice
Message 3: When Alice verifies that the signature is correct, she sends Bob a message containing her identity and a nonce
Message 4: When Bob receives this message, he asks the directory server for Alice's public key
Message 5: An X.509 certificate containing Alice’s public key is sent to Bob
Message 6: Bob then sends Alice a message containing Alice's RA, his own nonce, RB, and a proposed session key, KS
Message 7: When Alice gets message 6, she decrypts it using her private key. The fact that RA is in message 6 proves that
The message must have come from Bob, since Trudy has no way of determining RA
Furthermore, it must be fresh and not a replay, since she just sent Bob RA
Alice agrees to the session by sending back message 7
When Bob sees RB encrypted with the session key he just generated, he knows Alice got message 6 and verified RA
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao

43. Authentication Using Public-Key Cryptography
What can Trudy do to try to subvert this protocol?
She can fabricate message 3 and trick Bob into probing Alice, but Alice (from message 6) will see an RA that she did not send and will not proceed further
Trudy cannot forge message 7 back to Bob because she does not know RB or KS and cannot determine them without Alice's private key
4/20/2017
EEC688: Secure & Dependable Computing

44. EEC688: Secure & Dependable Computing
Exercise 1: Recall that the following authentication protocol is vulnerable to the reflection attack. Make one change to the protocol so that it is no longer vulnerable to the reflection attack.
Software control will be elaborated in more details in the next slide
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao 44

45. EEC688: Secure & Dependable Computing
Exercise 2: Prove that the following symmetric key based digital signature satisfies the three requirements for digital signatures.
Software control will be elaborated in more details in the next slide
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao 45

46. EEC688: Secure & Dependable Computing
Exercise 3: Considering the following way of producing a digital signature using message digests. If the one-way hash function used is not robust and one can easily find the collision on the hash. Which requirement (or requirements) of the digital signature would be violated?
Software control will be elaborated in more details in the next slide
4/20/2017
EEC688: Secure & Dependable Computing
Wenbing Zhao 46