1. Class 16 Deniable Authentication CIS 755: Advanced Computer Security Spring 2014 Eugene Vasserman http://www.cis.ksu.edu/~eyv/CIS755_S14/

2. Administrative stuff Office hours moved on Monday – Will be 3 – 4:30 Quiz today (last 15 minutes)

3. Anonymous Web Browsing Low latency Low to medium throughput Server does not know client Provides sender unlinkability – Have to be careful about authentication No default end-to-end confidentiality (SSL) NOT secure against global adversary

4. File Sharing Medium to high latency Medium throughput Default end-to-end confidentiality(-ish) Default content confidentiality(-ish) Secure against global adversary? Is our adversary model the same?

5. Censorship Resistance ?? latency ?? throughput Default end-to-end confidentiality? Default content confidentiality? Secure against global adversary? Who is our adversary? – What are they willing to do?

6. ISP Anonymity ISP AS1 AS2 Anonymizing Network

7. ISP Censorship Resistance ISP AS1 AS2 Anonymizing Network Membership Concealing Network

9. Tor and Bridges

10. Multiple Join/Bootstrap Attack A, B, C D, E, F Join Never let nodes re-join/get more contacts!

11. Harvesting Attack Never contact anyone except neighbors!

12. Confirmation Attack Yes Are you in the secret network? Never respond to anyone except neighbors!

13. secret Covert Auth. !! Hi? Hi! XX Hi? ?? !!??

14. secret?? BridgeSPA Bridges

15. Ongoing problems SilentKnock MitM vulnerability Bridge TLS distinguishability Other solutions? – TCP fragmentation, apparently – obfsproxy

16. SilentKnock Software has exploitable bugs (!) Firewalls can not protect services that should be externally accessible Can we prevent unauthorized users from accessing the service? Can we prevent them from even detecting the service?

17. Problem Overview BUG X Big evil untrusted Internet

18. TCP 3-way handshake Server SYN (25) SYN-ACK Client SMTP (port 25) Web (port 80) Mail software ACK (25) Data (25)

19. What is Port Knocking? Server SYN (666) SYN (777) SYN (888) SYN (25) SYN-ACK Client SMTP (closed) Web (port 80) Mail software SYN (25) Code: 666, 777, 888 Code: 666, 777, 888 SMTP (port 25)

20. Covert Authentication Dining Freemasons: – Alice is able to authenticate to Bob using a shared secret without Mallory being aware that an authentication took place – Bob is unaware that Alice tries to authenticate if Bob does not share a secret with Alice

21. Problem Statement Design a port knocking system that provides – Authentication – Replay protection – Non-detection – Practical implementation – Formal threat model – Provable security

22. Security of Port Knocking Computationally bounded adversary may: – observe many authenticated sessions – arbitrarily inject, delete, and reorder messages Cannot distinguish a port knocking client/server pair from those using ordinary TCP/IP, plus some out-of-band authentication mechanism E. Vasserman, N. Hopper, J. Laxson, and J. Tyra – SilentKnock: practical, provably undetectable authentication

23. Security Definition Hidden world (implementation) Plausible world (ideal security) SC A Queue SC A keyed

24. Implementation Overview “Simulate” shared signaling by steganographically embedding a MAC into TCP SYN packet Application-transparent proxies: – sknockproxy (client) automatically detects “protectable” streams – sknockd (server) decodes/verifies embedded MAC Userspace implementation

25. System Overview ClientServer

26. Packet Filter Hooks sknockd – Listen for SYN, FIN, RST – Passively examines only those packets sknockproxy – Listen for all packets going to given IP/port pair – Modifies all packets in stream of interest Server-optimized

27. Steganographic Embedding Linux 2.6 TCP SYN packet header with embedded MAC

28. Timestamp Encoding Details Only get to modify lowest byte Must delay packet dispatch Re-transmitted SYN packets must have the same sequence number but different timestamp – Re-encode retransmitted packets and delay dispatch again

29. Replay Protection Two-field counter (C 1 || C 2 ) C 1 = C 2 = 0 at first server connection De-synchronization can occur if SYN or SYN-ACK is lost Auto-resynchronization using timed counter field

30. Optimizations MAC pre-computation for first connection Background MAC computations for future connections (not yet implemented) – Counter values and passwords are known for future connections, can AES-encrypt them while waiting for connection – Can even store in config file!

31. sknockd Timing Results ExperimentSSH onlysknockdwithout commit Average response time (μs) 242.86 ± 8.59 389.33 ± 13.36 295.44 ± 8.64 Slowdown factor 11.601.22

32. Known Limitations Only protects start of connection (TCP hijacking still possible) Limited MAC size Identity binding: IP addresses Distinguishability by packet-modifying adversary

33. Key Exchange Password/key Client OS/TCP implementation Counter increment time SYN retransmit maximum

34. Questions? Reading discussion