1. Secure connections

2. Secure connections examples
Application Layer
– Pretty Good Privacy
Transport Layer
Secure Socket Layer
Network Layer
Ipsec (VPN)
DataLink Layer
Wifi – WEP (not part of curriculum)
Physical Layer
N/A

3. Secure Application layer email - PGP (Pretty Good Privacy)
Alice wants to send confidential , m, to Bob
KS( ) .
KB( ) + -
KS(m )
KB(KS ) m KS KB
Internet

4. Secure Application layer email - PGP (Pretty Good Privacy)
Alice wants to provide sender authentication message integrity
H( ) .
KA( ) - +
H(m )
KA(H(m)) m KA
Internet
compare

5. PGP – Both confidential & Integrity.
KA( ) - +
KA(H(m)) m KA
KS( )
KB( )
KB(KS ) KS KB
Internet

6. Secure Transport layer Secure Socket Layer (SSL)
SSL support Confidential (HTTPS is based on SSL)
SSL can support Integrity
Four keys (part of EMS – Encrypted Master Secret):
Kc = encryption key for data sent from client to server
Mc = MAC key for data sent from client to server
Ks = encryption key for data sent from server to client
Ms = MAC key for data sent from server to client

7. Secure Transport layer - Secure Socket Layer (SSL)
Normal TCP 3way Connection
hello
certificate, nonce
KB+(MS) = EMS
type 0, seq 1, data
type 0, seq 2, data
type 0, seq 3, data
type 1, seq 4, close
type 1, seq 2, close
encrypted
bob.com

8. Secure Network layer IPsec (Virtual Private Network - VPN)
edge routers IPsec-aware (tunnel)
IPsec
hosts IPsec-aware

9. Secure Network layer IPsec (Virtual Private Network - VPN)
Authentication Header (AH) protocol
provides source authentication & data integrity but not confidentiality
Encapsulation Security Protocol (ESP)
provides source authentication, data integrity, and confidentiality
more widely used than AH

10. VPN SA – or VPN as tunnel - the most often used security at Network layer
/24
/24
security association
Internet
headquarters
branch office R1 R2
new IP header
ESP
hdr
original IP hdr
Original IP
datagram payload
trl
auth
encrypted
“enchilada” authenticated
padding
pad length
next header
SPI
Seq #

11. Secure DataLink layer WEP - Wired Equivalent Privacy
authentication request
nonce (128 bytes)
nonce encrypted shared key
success if decrypted value equals nonce
Not very secure ! – use WPA -- Wifi Protected Access

12. Secure DataLink layer EAP- Extensible Authentication Protocol
EAP TLS
EAP
EAP over LAN (EAPoL)
IEEE
RADIUS
UDP/IP
wired
network
Network Security