1. March 2005 1R. Smith - University of St Thomas - Minnesota CISC 210 - Class Today HomeworkHomework Project ScheduleProject Schedule LabLab RecapRecap Protecting packet integrityProtecting packet integrity IPSECIPSEC

2. Recap Protocols and LayeringProtocols and Layering –The funnel Lots of ApplicationsLots of Applications Narrow middle for the “protocol stack”Narrow middle for the “protocol stack” Lots of device drivers for different network hardwareLots of device drivers for different network hardware Network EncryptionNetwork Encryption –Link vs Network vs Application Different protection afforded at different layersDifferent protection afforded at different layers –Let’s bring up Wireshark for a moment March 2005 2R. Smith - University of St Thomas - Minnesota

3. Project Schedule April 20: Next MondayApril 20: Next Monday –Project Proposal DUE –You want to start working on the project NOW –You want to have your team in place ASAP April 27: Twelve Days from TodayApril 27: Twelve Days from Today –Project OUTLINE Due –The outline is a bit of work If you’re a group, figure out how to divide it upIf you’re a group, figure out how to divide it up Hand in combined outline and combined reference listHand in combined outline and combined reference list –It counts for a chunk of the assignment (20% or so) –DON’T MESS IT UP March 2005 3R. Smith - University of St Thomas - Minnesota

4. The Lab How are people doing?How are people doing? –Due Next Wednesday –Don’t get wrapped around the Loopback: 127.0.0.1 Where to do itWhere to do it –Lab down the hall – OSS 429 When to do itWhen to do it –Do I need to schedule some time? –Do enough people have card access? 12/21/2015 4R. Smith - University of St Thomas - Minnesota

5. Protecting Packet Integrity Tools at our disposalTools at our disposal –Encryption, checksums, CRCs, one-way hash ThreatsThreats –Fabricating new packets – forgery –Changing packet contents – tricking the application –Changing packet addresses – redirecting the packet March 2005 5R. Smith - University of St Thomas - Minnesota

6. Checksums for packet protection Incorporating a secret for protectionIncorporating a secret for protection March 2005 6R. Smith - University of St Thomas - Minnesota

7. Attacking the simple checksum The checksum isn’t sensitive to positionThe checksum isn’t sensitive to position March 2005 7R. Smith - University of St Thomas - Minnesota

8. Practical problems The secret information isn’t very muchThe secret information isn’t very much –Trial-and-error can generate a working checksum The checksum isn’t very sensitiveThe checksum isn’t very sensitive –Obvious errors aren’t detected –Designed to detect simple, random errors –Not really designed to protect against clever people What tool(s) can improve this?What tool(s) can improve this? March 2005 8R. Smith - University of St Thomas - Minnesota

9. Keyed Hash Use one-way hash with a shared secretUse one-way hash with a shared secret –Hash included in message –Recipient verifies the message with the shared secret March 2005 9R. Smith - University of St Thomas - Minnesota

10. Issues with Keyed Hashes One-way hashes aren’t perfectOne-way hashes aren’t perfect –Research has found ways to fiddle with them –In particular, some aren’t sensitive enough to ‘truncation’ Alternative #1: put secret on front and backAlternative #1: put secret on front and back –Initial strategy used in the IPSEC protocols Still sensitive to other hash vulnerabilitiesStill sensitive to other hash vulnerabilities –Designers sought a way to cover weaknesses –Apply hash multiple times to cover various problems March 2005 10R. Smith - University of St Thomas - Minnesota

11. Keyed Hash on Steroids - HMAC State of the art in keyed hashingState of the art in keyed hashing March 2005 11R. Smith - University of St Thomas - Minnesota

12. IP Security Protocol – IPSEC Security protection that’s IP routableSecurity protection that’s IP routable We authenticate the IP addressesWe authenticate the IP addresses We encrypt everything inside the IP headerWe encrypt everything inside the IP header March 2005 12R. Smith - University of St Thomas - Minnesota

13. Separate Headers AH – Authentication HeaderAH – Authentication Header –Keeps the packet intact ESP – Encapsulating Security PayloadESP – Encapsulating Security Payload –A ‘generic’ security format, originally just for encryption –Now does both encryption and authentication March 2005 13R. Smith - University of St Thomas - Minnesota

14. Practical question for network geeks What parts of the IP packet MUST be modified?What parts of the IP packet MUST be modified? What happens during routing?What happens during routing? MAC addressingMAC addressing Hop-per-hopHop-per-hop March 2005 14R. Smith - University of St Thomas - Minnesota

15. Authentication Header – ‘AH’ Protects unchanging bits of the IP headerProtects unchanging bits of the IP header “SPI” – Security Parameter Index“SPI” – Security Parameter Index –Identifies the keying and hash algorithm to use March 2005 15R. Smith - University of St Thomas - Minnesota

16. March 2005 16R. Smith - University of St Thomas - Minnesota That’s it Questions?Questions? Creative Commons License This work is licensed under the Creative Commons Attribution-Share Alike 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/us/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA.