1 counter-measures threat monitoring cryptography as a security tool encryption digital signature...
Post on 18-Dec-2015
226 views
TRANSCRIPT
![Page 1: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/1.jpg)
1
Counter-measures
Threat Monitoring Cryptography as a security tool
Encryption Digital Signature Key distribution
![Page 2: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/2.jpg)
2
Threat Monitoring
Check for suspicious patterns of activity i.e., several incorrect password attempts may
signal password guessing Audit log
Records time, user, & type of all accesses to object
Useful for recovery from violation, developing better security measures
Scan system periodically for security holes Done when the computer is relatively unused
![Page 3: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/3.jpg)
3
Threat Monitoring (Cont.)
Check for: Short or easy-to-guess passwords Unauthorized setuid programs Unauthorized programs in system
directories Unexpected long-running processes Improper directory protections Improper protections on system data files Dangerous entries in the program search
path (Trojan horse) Changes to system programs: monitor
checksum values
![Page 4: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/4.jpg)
4
Cryptography
Cryptography: a set of mathematical functions with a set of nice properties. A common mechanism for enforcing policies.
Encrypt clear text into cipher text, and vice versa
plaintext plaintextciphertext
KA
encryptionalgorithm
decryption algorithm
Alice’s encryptionkey
Bob’s decryptionkey
KB
![Page 5: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/5.jpg)
5
Properties of Good Encryption Techniques
Encryption scheme depends not on secrecy of algorithm but on parameter of algorithm called encryption key
Extremely difficult for an intruder to determine the encryption key
![Page 6: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/6.jpg)
6
Cryptography Algorithms
Symmetric key algorithm: one shared by a pair of users used for both encryption and decryption.
Asymmetric or public/private key algorithms are based on each user having two keys:
public key – in public private key – key known only to
individual user
![Page 7: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/7.jpg)
7
Symmetric Key Cryptography
Symmetric key crypto: Bob and Alice share same (symmetric) key: K
plaintextciphertext
KA-B
encryptionalgorithm
decryption algorithm
A-B
KA-B
plaintextmessage, m
K (m)A-B
K (m)A-B
m = K ( ) A-B
Q: how do Bob and Alice agree on key value?
![Page 8: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/8.jpg)
8
Symmetric Key Cryptography: Substitution Ciper
Substituting one thing for another monoalphabetic cipher: substitute one letter
for anotherplaintext: abcdefghijklmnopqrstuvwxyz
ciphertext: mnbvcxzasdfghjklpoiuytrewq
Plaintext: bob. i love you. alice
ciphertext: nkn. s gktc wky. mgsbc
E.g.:
Q: How hard to break this simple cipher?• Brute force• Other
![Page 9: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/9.jpg)
9
Symmetric Key Crypto: DES
initial permutation 16 identical “rounds” of
function application, each using different 48 bits of key
final permutation
DES operation
DES: Data Encryption StandardUS encryption standard [NIST 1993]
![Page 10: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/10.jpg)
10
How Secure is DES?
DES Challenge: 56-bit-key-encrypted phrase (“Strong cryptography makes the world a safer place”) decrypted (brute force) in 4 months in 1997
No known “backdoor” decryption approach
Making DES more secure: use three keys sequentially (3-DES)
on each datum use cipher-block chaining
![Page 11: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/11.jpg)
11
AES: Advanced Encryption Standard
new (Nov. 2001) symmetric-key NIST standard, replacing DES
processes data in 128 bit blocks 128, 192, or 256 bit keys brute force decryption (try each
key) taking 1 sec on DES, takes 149 trillion years for AES
![Page 12: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/12.jpg)
12
Public Key Cryptography
symmetric key crypto
requires sender, receiver know shared secret key
Q: how to agree on key in first place (particularly if never “met”)?
public key cryptography
radically different approach [Diffie-Hellman76, RSA78]
sender, receiver do not share secret key
public key known to all
private key known only to an individual
![Page 13: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/13.jpg)
13
Public Key Cryptography
plaintextmessage, m
ciphertextencryptionalgorithm
decryption algorithm
Bob’s public key
plaintextmessageK (m)
B+
K B+
Bob’s privatekey
K B-
m = K (K (m))B+
B-
![Page 14: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/14.jpg)
14
Public Key Encryption Algorithms
need K ( ) and K ( ) such thatB B
given public key K , it should be impossible to compute private key KB
B
Requirements:
1
2
RSA: Rivest, Shamir, Adelson algorithm
+ -
K (K (m)) = m BB
- +
+
-
![Page 15: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/15.jpg)
15
RSA: Choosing Keys
1. Choose two large prime numbers p, q. (e.g., 1024 bits each)
2. Compute n = pq, z = (p-1)(q-1)
3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”).
4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ).
5. Public key is (n,e). Private key is (n,d).
K B+ K B
-
![Page 16: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/16.jpg)
16
RSA: Encryption, decryption
0. Given (n,e) and (n,d) as computed above
1. To encrypt bit pattern, m, compute
c = m mod n
e (i.e., remainder when m is divided by n)e
2. To decrypt received bit pattern, c, compute
m = c mod n
d (i.e., remainder when c is divided by n)d
m = (m mod n)
e mod n
dMagichappens!
c
![Page 17: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/17.jpg)
17
RSA Example:
Bob chooses p=5, q=7. Then n=35, z=24.e=5 (so e, z relatively prime).d=29 (so ed-1 exactly divisible by z).
letter m me c = m mod ne
l 12 1524832 17
c m = c mod nd
17 481968572106750915091411825223071697 12
cdletter
l
encrypt:
decrypt:
![Page 18: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/18.jpg)
18
RSA: Why it works
(m mod n)e mod n = m mod nd ed
Useful number theory result: If p,q prime and n = pq, then:
x mod n = x mod ny y mod (p-1)(q-1)
= m mod n
ed mod (p-1)(q-1)
= m mod n1
= m
(using number theory result above)
(since we chose ed to be divisible by(p-1)(q-1) with remainder 1 )
![Page 19: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/19.jpg)
19
RSA: Another Important Property
The following property will be very useful later:
K (K (m)) = m BB
- +K (K (m))
BB+ -
=
use public key first, followed by private key
use private key first,
followed by public key
Result is the same!
![Page 20: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/20.jpg)
20
Usage of Cryptography
Encryption (for confidentiality) Digital Signature Key distribution
![Page 21: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/21.jpg)
21
Digital Signatures
Cryptographic technique analogous to hand-written signatures.
sender (Bob) digitally signs document, establishing he is document owner/creator.
verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document
Digital Signature: signed (encrytped) message digest
![Page 22: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/22.jpg)
22
Message Digests
Goal: fixed-length, easy- to-compute digital “fingerprint”
apply hash function H to m, get fixed size message digest, H(m).
Hash function properties: many-to-1 produces fixed-size msg
digest (fingerprint) given message digest x,
computationally infeasible to find m’ such that x = H(m’)
large message
m
H: HashFunction
H(m)
![Page 23: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/23.jpg)
23
large message
mH: Hashfunction H(m)
digitalsignature(encrypt)
Bob’s private
key K B-
+
Bob sends digitally signed message:
Alice verifies signature and integrity of digitally signed message:
KB(H(m))-
encrypted msg digest
KB(H(m))-
encrypted msg digest
large message
m
H: Hashfunction
H(m)
digitalsignature(decrypt)
H(m)
Bob’s public
key K B+
equal ?
Digital Signature: Example
![Page 24: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/24.jpg)
24
Functionality of Digital signature
Functionality: Prove Bob signed the message Message has not been modified
Questions: Why sign message digest instead of
message? What if Bob wants m to be confidential?
Question: can you use symmetric cryptography for digital signature?
![Page 25: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/25.jpg)
25
Hash Function Algorithms
MD5 (Message-Digest algorithm 5) hash function widely used (RFC 1321) computes 128-bit message digest in 4-
step process. Designed by Rivest, 1992 Found security flaws in 1996, more
serious flaws found in 2004. SHA-1 (Secure Hash Algorithm) is also used.
US standard [NIST, FIPS PUB 180-1] 160-bit message digest Shown possible to break it faster than
brute-force, 2005
![Page 26: 1 Counter-measures Threat Monitoring Cryptography as a security tool Encryption Digital Signature Key distribution](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649d235503460f949fa4a4/html5/thumbnails/26.jpg)
26
Comparison of Symmetric & Asymmetric Cryptography
Symmetric cryptography Easy to compute
Asymmetric cryptography Computationally expensive Good theoretical bounds Provide more functionalities than
encryption (e.g., digital signature)