c. xu, 2002-20091 security in distributed systems ece7610/ece7650 cheng-zhong xu
TRANSCRIPT
C. Xu, 2002-2009 2
Outline• General Security Requirements
• Cryptography
• Secure Channel
• Access Control
• Security in Mobile Codes
• Case Studies– Kerberos Systems– SSL – SET
C. Xu, 2002-2009 3
General Security Requirements
• Confidentiality (Privacy, Secrecy) – Protection from disclosure to unauthorized parties– E.g. overhear talk, illegal data copy (Interception)
• Integrity– Protection from unauthorized change of data/tampering
of services– Violations be detectable and recoverable– E.g. Message relay (Fabrication, Modification)
• Availability– Legitimate users have access anytime– E.g. Denial of Service Attack (Interrupt)– One facet of dependable systems, as well
C. Xu, 2002-2009 4
Security Policy vs Mechanism
• Policy specifies which actions the entities of a system can or can’t take– Entities: users, services, data, machines, etc
• Mechanism facilitates policy enforcement– Encryption: transform data into unreadable – Authentication: verify claimed identify– Authorization: – Auditing: help detect security breach
C. Xu, 2002-2009 5
Security in Distributed Systems• Security threats in isolated systems
– Assumption: Isolated systems are secure– Security Mechanism: Protect from physical break-in
• Security in networked systems within an administrative domain but isolated from Internet– Identity Assumption:
• Whenever a program attempts some action, we can easily identify a person to whom that action can be attributed, and it is safe to assume that that person intends the action to be taken.
– Optimistic Assumption about Trojan Horse Attack • Users are responsible for actions of their programs
– Mechanisms:• Cryptographic Password• Authorized users with different privilege levels
C. Xu, 2002-2009 6
Security in Distrib. Systems (cont’)
• Security in systems cross admini. domains– Assumptions
• Untrusted users in open systems, but protection domain per user
• Insecure communication
• Rare code migration becomes common
Communication channel
Process p Process q
The enemym’
Copy of m
m
C. Xu, 2002-2009 7
Security in Distributed Systems (cont’)
• Examples of Mechansims (e-Commerce):– Authentication: verify claimed identify (CA) – Secure comm. channel (SSL based https)– Firewall: packet filtering, authorization check– Resource access control: client access resources via
server ops; access right checking during invocations.
Principal A
Secure channelProcess p Process q
Principal BThe enemyCryptography
C. Xu, 2002-2009 8
Threats not defeated by secure channels or other cryptographic techniques
• Denial of service attacks– Deliberately excessive use of resources to the extent that they are
not available to legitimate users• E.g. the Internet 'IP spoofing' attack, February 2000
• Trojan horses and other viruses– Viruses can only enter computers when program code is imported.
– But users often require new programs, for example:• New software installation
• Mobile code downloaded dynamically by existing software (e.g. Java applets)
• Accidental execution of programs transmitted surreptitiously
– Defences: code authentication (signed code), code validation (type checking, proof), sandboxing.
*
Taxonomy 1-9
Recap: Network Security attacks on Internet infrastructure:
infecting/attacking hosts: spyware, virus, worms, Trojan Horse, unauthorized access, and malware in geneal
• Malware: sw designed to infiltrate or damage a computer system w/o the owner’s informed consent [Wikipedia]; based on intention of its creator, rather than any features
• In law, malware is defined as a computer contaminant denial of service: deny access to resources (servers, link
BW)• Vulnerability attack; BW flooding; Connection flooding
Internet not originally designed with security in mind original vision: “a group of mutually trusting users attached
to a transparent network” Internet protocol designers playing “catch-up” Security considerations in all layers!
Taxonomy 1-10
What can bad guys do: malware? Spyware:
infection by downloading web page with spyware
records keystrokes, web sites visited, upload info to collection site
Virus infection by receiving
object (e.g., e-mail attachment), actively executing
self-replicating: propagate itself to other hosts, users
Worm: infection by passively
receiving object that gets itself executed
self- replicating: propagates to other hosts, users
Sapphire Worm in 2003: aggregate scans/sec in first 5 minutes of outbreak (CAIDA, UWisc data)
Double in every 8.5 sec90% infected in 10 min
Taxonomy 1-11
Denial of service attacks attackers make resources (server, bandwidth)
unavailable to legitimate traffic by overwhelming resource with bogus traffic
1. select target
2. break into hosts around the network (collectively, known as botnet)
3. send packets toward target from compromised hosts
target
Taxonomy 1-12
Sniff, modify, delete your packetsPacket sniffing:
broadcast media (shared Ethernet, wireless) promiscuous network interface reads/records all packets
(e.g., including passwords!) passing by
A
B
C
src:B dest:A payload
Ethereal (Wireshark) software used for end-of-chapter labs is a (free) packet-sniffer
Taxonomy 1-13
Masquerade as you IP spoofing: send packet with false source
address
A
B
C
src:B dest:A payload
Taxonomy 1-14
Masquerade as you Man-in-the-middle attack
IP spoofing: send packet with false source address record-and-playback: sniff sensitive info (e.g., password),
and use later password holder is that user from system point of view
A
B
C
src:B dest:A user: B; password: foo
Taxonomy 1-15
Masquerade as you IP spoofing: send packet with false source address record-and-playback: sniff sensitive info (e.g., password),
and use later password holder is that user from system point of view
A
B
later …..C
src:B dest:A user: B; password: foo
C. Xu, 2002-2009 16
Threats and forms of attack• Eavesdropping
– obtaining private or secret information
• Masquerading– assuming the identity of another user/principal
• Message tampering– altering the content of messages in transit
• man in the middle attack (tampers with the secure channel mechanism)
• Replaying– storing secure messages and sending them at a later date
• Denial of service– flooding a channel or other resource, denying access to others
*
C. Xu, 2002-2009 17
Key Issues
• Secure Channels– Authentication: Verify of claimed identify
– Message Integrity: Detect of any alteration
– Confidentiality: Inf exposes to authorized parties only
• Access Control– Authorization
Cryptography is fundamental
C. Xu, 2002-2009 18
Cryptography
• Three possible ways of attack– Intruders (eavesdroppers) intercept the msg silently – Modify the msg– Insert the msg, attempting to make R believe these msgs come from S.
C. Xu, 2002-2009 19
Cryptosystems• Symmetric Cryptosystem: same key to encrypt/decrypt
P = Dk( Ek(P) )– 56-bit Data Encryption Standard (DES), 128-bit IDEA and triple-DES
– New U.S. standard: 128, 192, 256-bit AES based Rijndael algorithm (Joan Daemen and Vincent Rijmen (Effective May 26, 2002)
• Asymmetric Cryptosystem. Two keys form a pair. e.g. RSA
P = Dkd( Eke(P) )
Public-key systems: K+ as public key and K- as private key
For example: – (1) How can Alice send a confidential msg to Bob ?
– (2) How can Bob verify if the msg come from Alice
C. Xu, 2002-2009 20
Symmetric Key Crypto: two basic ops
Substitution: substituting one thing for another– monoalphabetic cipher: substitute one letter for another
translation:abcdefghijklmnopqrstuvwxyz
table : mnbvcxzasdfghjklpoiuytrewq
Plaintext: bob. i love you. aliceciphertext: nkn. s gktc wky. mgsbc
E.g.:
Permutation: rearrange (shuffle) the input
C. Xu, 2002-2009 21
Symmetric encryption algorithmsThese are all programs that perform confusion and diffusion operations on
blocks of binary data
TEA: a simple but effective algorithm developed at Cambridge U (1994) for teaching and explanation. 128-bit key, 700 kbytes/sec
DES: The US Data Encryption Standard (1977). No longer strong in its original form. 56-bit key, 350 kbytes/sec.
Triple-DES: applies DES three times with two different keys. 112-bit key, 120 Kbytes/sec
IDEA: International Data Encryption Algorithm (1990). Resembles TEA. 128-bit key, 700 kbytes/sec
AES: A proposed US Advanced Encryption Standard (1997). 128/256-bit key.
There are many other effective algorithms. See Schneier [1996].The above speeds are for a Pentium II processor at 330 MHZ. Today's PC's (January
2002) should achieve a 5 x speedup.
*
C. Xu, 2002-2009 22
TEA encryption function
void encrypt(unsigned long k[], unsigned long text[]) {unsigned long y = text[0], z = text[1]; unsigned long delta = 0x9e3779b9, sum = 0; int n; for (n= 0; n < 32; n++) {
sum += delta; y += ((z << 4) + k[0]) ^ (z+sum) ^ ((z >> 5) + k[1]); 5z += ((y << 4) + k[2]) ^ (y+sum) ^ ((y >> 5) + k[3]); 6
}text[0] = y; text[1] = z;
}
• Lines 5 & 6 perform confusion (XOR of shifted text)and diffusion (shifting and swapping)
key 4 x 32 bits
plaintextand result 2 x 32
Exclusive OR
logical shift
C. Xu, 2002-2009 23
TEA decryption function
void decrypt(unsigned long k[], unsigned long text[]) {unsigned long y = text[0], z = text[1];unsigned long delta = 0x9e3779b9, sum = delta << 5; int n;for (n= 0; n < 32; n++) {
z -= ((y << 4) + k[2]) ^ (y + sum) ^ ((y >> 5) + k[3]);y -= ((z << 4) + k[0]) ^ (z + sum) ^ ((z >> 5) + k[1]);sum -= delta;
}text[0] = y; text[1] = z;
}
C. Xu, 2002-2009 24
TEA in usevoid tea(char mode, FILE *infile, FILE *outfile, unsigned long k[]) {/* mode is ’e’ for encrypt, ’d’ for decrypt, k[] is the key.*/
char ch, Text[8]; int i;while(!feof(infile)) {
i = fread(Text, 1, 8, infile); /* read 8 bytes from infile into Text */if (i <= 0) break;while (i < 8) { Text[i++] = ' ';) /* pad last block with spaces */switch (mode) {case 'e':
encrypt(k, (unsigned long*) Text); break;case 'd':
decrypt(k, (unsigned long*) Text); break;}fwrite(Text, 1, 8, outfile); /* write 8 bytes from Text to outfile */
}}
C. Xu, 2002-2009 25
Classical Feistel Structure• Virtually all conventional block
encryption algorithms, including Data Encryption Standard (DES) have a structure first described by Horst Feistel of IBM in 1973
• Properties– a particular structure of permutation
and substitution of input; the structure is made public
– the most important component is the F function
– the F function does not even need to be one-to-one to decrypt message so long the receiver knows the key
C. Xu, 2002-2009 26
DES: Data Encryption Standard• US encryption standard [NIST 1993]• 56-bit symmetric key, 64 bit plaintext input• Use a 16 round Feistel Network
input processing key generation
C. Xu, 2002-2009 27
Security of DES• Intuitively, the design of F is to make it hard to inverse the
function (by any crypto analysis technique), i.e., security by confusion and obfuscation– the design philosophy of the F function of DES is not known– thus the “best known” attack is to try all possible 56-bit keys on the
ciphertext to see if a key generates a “reasonable” plaintext
• However, 56 bit keys appear to be too short
ChallengeWinner(s)
AnnouncedKey Size / Encryption
TypeCracked
in...
RSA's DES Challenge June 1997 56-bit / DES 96 Days
RSA's DES Challenge II-1 February 1998 56-bit / DES 41 Days
RSA's DES Challenge II-2 July 1997 56-bit / DES 56 Hours
RSA's DES Challenge III January 1999 56-bit / DES 22 Hours
C. Xu, 2002-2009 28
Making DES More Secure
• Use three keys sequentially (3-DES) on each datum
• C = ciphertext• P = Plaintext• EK[X] = encryption of X using key K• DK[Y] = decryption of Y using key K
notation: EK[X], {X}K both mean encrypt X using key K
• Replaced by Advanced Encryption Standard [NIST 2000]:http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
C = EK3[DK2[EK1[P]]]
C. Xu, 2002-2009 30
Cipher blocks, chaining and stream ciphers
n
n+3 n+2 n+1 XOR
E(K, M)
n-1n-2n-3
plaintext blocks
ciphertext blocks
Cipher block chaining (CBC)
XOR
E(K, M)number generator n+3 n+2 n+1
plaintext stream
ciphertext stream
buffer
keystream Stream cipher
Most algorithms work on 64-bit blocks.Weakness of simple block cipher:- repeated patterns can be detected.
C. Xu, 2002-2009 31
Asymmetric encryption algorithms
RSA: The first practical algorithm (Rivest, Shamir and Adelman 1978) and still the most frequently used. Key length is variable, 512-2048 bits. Speed 1-7 kbytes/sec. (350 MHz PII processor)
Elliptic curve: A recently-developed method, shorter keys and faster.
Asymmetric algorithms are ~1000 x slower and are therefore not practical for bulk encryption, but their other properties make them ideal for key distribution and for authentication uses.
They all depend on the use of trap-door functionsA trap-door function is a one-way function with a secret exit - e.g. product of two large numbers; easy to multiply, very hard (infeasible) to factorize.
C. Xu, 2002-2009 32
RSA (1)To find a key pair e, d: 1. Choose two large prime numbers, P and Q (each greater than 10100), and form:
N = P x Q Z = (P–1) x (Q–1)
2. For d choose any number that is relatively prime with Z (that is, such that d has no common factors with Z).We illustrate the computations involved using small integer values for P and Q:
P = 13, Q = 17 –> N = 221, Z = 192 d = 5
3.To find e solve the equation: e x d = 1 mod ZThat is, e x d is the smallest element divisible by d in the series Z+1, 2Z+1, 3Z+1, ... .
e x d = 1 mod 192 = 1, 193, 385, ...385 is divisible by de = 385/5 = 77
4. (e, N) is an encryption key and (d, N) is corresponding descryption key
C. Xu, 2002-2009 33
RSA (2)To encrypt text using the RSA method, the plaintext is divided into equal blocks of
length k bits where 2k < N (that is, such that the numerical value of a block is always less than N; in practical applications, k is usually in the range 512 to 1024).
k = 7, since 27 = 128 The function for encrypting a single block of plaintext M is:
E'(e,N,M) = Me mod Nfor a message M, the ciphertext is M77 mod 221
The function for decrypting a block of encrypted text c to produce the original plaintext block is:
D'(d,N,c) = cd mod NRivest, Shamir and Adelman proved that E' and D' are mutual inverses
(that is, E'(D'(x)) = D'(E'(x)) = x) for all values of P in the range 0 ≤ P ≤ N.The two parameters e,N can be regarded as a key for the encryption function, and
similarly d,N represent a key for the decryption function. So we can write Ke
= <e,N> and Kd = <d,N>
C. Xu, 2002-2009 34
RSA Another Example
Bob chooses P=5, Q=7. Then N=35, Z=24.e=5 (so e, Z relatively prime)d=29 (so ed-1 exactly divisible by Z)
letter m me c = m mod ne
L 12 1524832 17
c m = c mod nd
17 481968572106750915091411825223071697 12
cdletter
L
encrypt:
decrypt:
C. Xu, 2002-2009 35
Digital signatures
Requirements:– To authenticate stored document files as well as messages
– To protect against forgery
– To prevent the signer from repudiating a signed document (denying their responsibility)
Encryption of a document in a secret key constitutes a signature- impossible for others to perform without knowledge of the key
- strong authentication of document
- strong protection against forgery
- weak against repudiation (signer could claim key was compromised)
*
C. Xu, 2002-2009 36
Secure Digest Function• h = H(m): take a msg of arbitrary length and produce a bit
string of a fixed length. • Example:
– 128-bit MD5 (Rivest’92): generate 128 bit fixed length msg digest from an arbitrary length binary input string
– 160-bit SHA (NIST’95), based on Rivest’s MD4, but made more secure by producing a 160-bit digest.
– Any symmetric encryption algorithm in the CBC (cipher block chaining) mode. The last block in the chain is H(m)
• Properties:– One-way function: Given h, it’s computationally infeasible to compute m– weak collision resistance: Given an input m and its associated output h, it’s
computationally infeasible to find another m’ that is not equal to m but H(m)=H(m’)
– strong collision resistance: Given only H, it’s computationally infeasible to find any two different inputs m and m’, such that H(m) = H(m’)
• Both MD5 and SHA are shown to be broken lately!!http://www.schneier.com/blog/archives/2005/06/more_md5_collis.htmlhttp://www.schneier.com/blog/archives/2005/02/sha1_broken.html
C. Xu, 2002-2009 37
Digital Signature for Message Integrity
• DA using public-key crypto, like RSA
• Bob verifies msg m by comparison• Alice is protected against Bob’s modification because
of her signature. • But, what if Alice wants to change her key?
Need central authority to keep records
C. Xu, 2002-2009 38
Digital Signatures (cont’)• Encryption of an entire message with a private key
is very time-consuming• Using hash function, H, to generate a message
digest and encrypting the digest instead
C. Xu, 2002-2009 39
MACs: Low-cost signatures with a shared secret key
Signing
Verifying
M
K
M
K
h = h'?authentic:forged
h
M
signed doc
H(M+K) h
h'
H(M+K)
Signer and verifier share a secret key K
MAC: Message Authentication Code
C. Xu, 2002-2009 40
Perf of encryption and secure digest algs
Key size/hash size(bits)
Extrapolatedspeed
(kbytes/sec.)
PRB optimized speed
(kbytes/s)
TEA 128 700 -
DES 56 350 7746
Triple-DES 112 120 2842
IDEA 128 700 4469
RSA 512 7 -
RSA 2048 1 -
MD5 128 1740 62425
SHA 160 750 25162
PRB = Preneel, Rijmen and Bosselaers [Preneel 1998]
Algorithm
Publickey
Secret key
Digest
speeds are for a Pentium II processor at 330 MHZFigure 7.14
C. Xu, 2002-2009 41
Outline• General Security Requirements• Cryptography• Secure Communication Channel
– Authentication– Message integrity and confidentiality
• Access Control• Security in Mobile Codes• Case Studies
– Kerberos Systems– SSL – E-Cash and SET
C. Xu, 2002-2009 42
Secure Channel
• Authentication
• Message Integrity: msg is protected against modification– More than authentication of communication
parties. e.g. protection of the integrity of on-line transaction agreement
• Confidentiality: Msg won’t be intercepted and read by evaesdroppers– Cryptographic keys are not enough
C. Xu, 2002-2009 43
Secure Channel: Authentication• Alice initiates in setting up a channel between
Alice and Bob. Once it is done, Alice and Bob know for sure whom they are talking to.
• Authentication based on shared secrete keys (Session Keys): Challenge-Response Protocol
1: identify of A2: Challenge of B3: Encrypted challenge4: Challenge of A5: Encrypted challenge
C. Xu, 2002-2009 44
Optimized Authentication ?
• Authentication based on a shared secret key, but using three instead of five keys
C. Xu, 2002-2009 45
Reflection Attack
• Two comm parties use the same challenge in different runs of the protocol
• Also, valuable info. Ka,b(Rc) is released to unknown person
C. Xu, 2002-2009 46
Key Distributed Center• Shared-key based authentication is not scalable. In a
system with n hosts, n(n-1)/2 keys are needed and each host needs to manage n-1 keys
• Alternative is to assume a trusted third party,like KDC, which shares a secret key with each host
• The message KB,KDC(KA,B) is called a ticket• Alice uses this ticket to establish connection with Bob
C. Xu, 2002-2009 47
Needham-Schroeder Protocol
• RA1 is a nonce (random number, “number use for once”) to uniquely related msg 1 and msg 2 to each other.
• The identify B of Bob is included in msg 2 to confirm the return ticket between A and B.
• Returning RA2-1 in msg 4 proves Bob knows the shared key and he actually has used the key to decrypted the challenge.
C. Xu, 2002-2009 48
Improved Needham-Schroeder Protocol
• Using an extra nonce RB1 to protect against malicious reuse of a previously generated session key
C. Xu, 2002-2009 49
Shared Key Setup by Public-Key• Mutual authentication, assuming knowledge
of public keys of each other
Be assured that Alice is actually using Bob’s public keyHow??
C. Xu, 2002-2009 50
Initial Key Establishment• Diffie-Hellman Key Exchange
– Alice and Bob agree on two large public numbers n and g
– Alice and Bob pick up two large random numbers, x and y, as their private keys
– Alice send gx mod n to Bob and Bob sends gy mod n to Alice, along with n ang g
• gx mod n is one-way function: x is impossible to be computed
– Established shared key: (gx mod n)y = gxy mod n
Diffie-Hellman can also be viewed as a public-key cryptography,
where x and y are private keys, gx mod n and gy mod n are public keys.
C. Xu, 2002-2009 51
Session key for Confidentiality
• Confidentiality: msg won’t be intercepted and read by eavesdroppers
• Cryptogrphaic keys are subject to “wear and tear” (A frequently used key tends to be stolen)
• Lose of cryptographic keys leads to replay attacks• Replacing cryptographic keys are expensive
Create a unique session key for each secure communication channel
Example in Java (http://www.javaworld.com)import java.io.*; import java.security.*; class GenSig { public static void main(String[] args) { /* java GenSig data-be-signed */ try{ /* Initialize the Key-Pair Generator */
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("DSA", "SUN");
keyGen.initialize(1024,SecureRandom.getInstance(“SHA1PRNG”,”SUN”)); /* Generate the Pair of Keys */
KeyPair pair = keyGen.generateKeyPair(); PrivateKey priv = pair.getPrivate(); PublicKey pub =
pair.getPublic(); /* Create a Signature and initialize it with the private key */
Signature dsa = Signature.getInstance("SHA1withDSA", "SUN");
dsa.initSign(priv); /* Update and sign the data */ FileInputStream fis = new FileInputStream(args[0]); BufferedInputStream bufin = new
BufferedInputStream( fis ); byte[] buffer = new byte[1024]; int len; while (bufin.available() != 0) { len = bufin.read(buffer); dsa.update(buffer, 0, len); }; bufin.close(); … …
52
C. Xu, 2002-2009 53
Example in Java (Cont’)try { … … /* Generate a signature for the data */ byte[] realSig = dsa.sign(); /* Save the signature in a file */ FileOutputStream sigfos = new FileOutputStream("sig"); sigfos.write(realSig); sigfos.close();
/* Save the public key in a file */ byte[] key = pub.getEncoded(); FileOutputStream keyfos = new FileOutputStream("suepk"); keyfos.write(key); keyfos.close(); } catch (Exception e) { System.err.println("Caught exception " + e.toString()); } };