Upload File

network security. cryptography cryptography functions secret key (e.g., des) public key (e.g., rsa)...

  • Home
  • Documents
  • Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:
24
Network Security

Upload: darcy-heath

Post on 11-Jan-2016

243 views

Category:

Documents


2 download

Report

Tags:

TRANSCRIPT

Page 1: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Network Security

Page 2: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:
Page 3: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

CryptographyCryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5)

Security services Privacy: preventing unauthorized release of information Authentication: verifying identity of the remote

participant Integrity: making sure message has not been altered

Page 4: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

DES

Data Encryption Standard (DES)56 bit key, insecureTriple DES is secure, but supplanted by

AES

Advanced Encryption Standard (AES)Specified for US Government contracts

Neither are provably secure

Page 5: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Encryption Algorithms

Private Key (DES)

64-bit key (56-bits + 8-bit parity)

16 rounds

Round 1

Round 2

Round 16

. . .

plain text

Initial Permutation

Final Permutation

56bitKey

Encrypt w/Secret Key

Decrypt w/Secret Key

plaintext plaintext

ciphertext

Page 6: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Each round

Function F and generation of Ki for each round not shown

Repeat for larger messages

L i -1 R i 1

L i R i

F

+

iK

cipher1

block1

DES

+IV

cipher

block

DES

+

2

2 cipher

block

DES

+

3

3 cipher

block

DES

+

4

4

Page 7: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

AES

AES operates on a 4×4 array of bytes, termed the state

For encryption, each round of AES consists of four stages: AddRoundKey - each byte of the state is combined with the

derived cipher key SubBytes - a non-linear substitution step where each byte is

replaced with another according to a lookup table. ShiftRows - a transposition step where each row of the state

is shifted cyclically a certain number of steps. MixColumns - a mixing operation which operates on the

columns of the state, combining the four bytes in each column using a linear transformation.

Page 8: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

RSA

Public key/Private Key

Provably secure (NP-Complete type proof)

Slow

Page 9: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Multiplicative inverse for public key

With n=7

4*2 mod 7 = 1

4 and 2 are multiplicative inverses mod 7

4*3 mod 7 = 12 mod 7 = 5

2*5 mod 7 = 10 mod 7 = 3

If you multiply any number by 4, take the result and multiply it by 2, you will get the original number back

Page 10: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Encryption & Decryption

c = me mod n

m = cd mod n

Encrypt w/Public Key

Decrypt w/Private Key

plaintext plaintext

ciphertext

Page 11: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Public Key (RSA)Based on multiplicative group operationsGenerate a public and private key choose two large prime numbers p and q (each 256 bits) multiply p and q together to get n (at most 512 bits) choose the encryption key e, such that e and (p-1) x (q-1)

are relatively prime two numbers are relatively prime if they have no common factor

greater than one. compute decryption key d such that

d = e-1 mod((p-1)*(q-1)) construct public key as <e, n> construct private key as <d, n> discard (do not disclose) original primes p and q

Page 12: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Examplep=5, q=11, n=p*q=55, m=message=9, (p-1)(q-1)=40, e=23 and (p-1)*(q-1) are relatively primeWe want d*e=1mod 40, d*23=1mod40 You can try all values less than 40 23*2=46=6mod40, 23*3=69=29mod40, 23*4=92=12mod40,

23*5=115=35mod40, 23*6=138=18mod40 23*7=161=1mod40, d=7

For a message m=9 c=memodn=923mod55 How big is this? = 910mod55*913mod55= 1*14 mod 55 m=cdmodn=147mod55=105413504mod55=9

Page 13: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Breaking RSA

1977 challenge to break 430-bit message

Estimated 40 Quadrillion years to factor large composites

April 1994 broken with 5000 MIP-years of CPU

Breakage can be easier if something is known about the key generation (time of day)

Page 14: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Message Digest

Cryptographic checksum: just as a regular checksum protects the

receiver from accidental changes to the message, a cryptographic checksum protects the receiver from malicious changes to the message.

Page 15: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

One-way function:

given a cryptographic checksum for a message, it is virtually impossible to figure out what message produced that checksum; it is not computationally feasible to find two messages that hash to the same cryptographic checksum.

Page 16: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Relevance:

if you are given a checksum for a message and you are able to compute exactly the same checksum for that message, then it is highly likely this message produced the checksum you were given.

Page 17: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Speed

175MHz DEC AlphaCustom HardwareSonicwall claims 54Mbps DES3 in hardwaressl.com advertises 75Mbps DES todayMd5 1.27GbpsSHA 1.02GbpsRSA 400 keys/second

Page 18: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Message Integrity Protocols

Digital signature using RSAspecial case of a message integrity where

the code can only have been generated by one participant

compute signature with private key and verify with public key

Page 19: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Making Signatures

Compute checksum of signed document

Encrypt checksum, time and date, and other information using private key

Attach digital signature to end of document

Optionally, encrypt signed document with receiver’s public key

Page 20: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Checking Signatures

Decrypt signed document, if necessary, using private key

Decrypt digital signature using public key

Verify checksum for document

Display the time and date of the document

Page 21: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

CertificatesCertified EntityCA

Verifier

Decrypt senders public key using CA-publickey

Albert Levi

Albert Levi

Albert Levi

Register with CA, send client Public Key

CA-Publickey and Certificate with RSA(client Public Key,CA-privatekey)

Certificate

Page 22: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

Application (e.g., HTTP)

Secure transport layer

TCP

IP

Subnet

TLS,SSL,HTTPSTransport Layer Security, Secure Socket Layer

Page 23: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

SSL

Each browser is configured with a root CAWhen a session is initiated, server and client agree on security capabilities. (most clients are 40 bit encryption, but 128 bit encryption is available on many strong serversThe server is authenticated by the certificate authorityUsing the server public key from the CA, the client sends a DES key to the serverThe DES key is used to encrypt the session

Page 24: Network Security. Cryptography Cryptography functions Secret key (e.g., DES) Public key (e.g., RSA) Message digest (e.g., MD5) Security services Privacy:

IPSEC

Optional in IPv4, mandatory in IPv6Data Confidentiality---The IPSec sender can encrypt packets before transmitting them across a network. Data Integrity---The IPSec receiver can authenticate packets sent by the IPSec sender to ensure that the data has not been altered during transmission. Data Origin Authentication---The IPSec receiver can authenticate the source of the IPSec packets sent. This service is dependent upon the data integrity service. Anti-Replay---The IPSec receiver can detect and reject replayed packets.


Cryptography - cs.drexel.edugreenie/cs645/CS645-13-05.pdfCryptography • Symmetric key cryptography (secret key crypto): sender and receiver keys identical • Asymmetric key cryptography

Cryptography or Smalltalkers 2 Public Key Cryptography

Part 1 Cryptography 1 Chapter 4: Public Key Cryptography RSA Diffie-Hellman key Elliptic Curve Cryptography Public key crypto application

Chapter 9 Public Key Cryptography and RSA. Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared by both sender

Bronson Jastrow. Outline What is cryptography? Symmetric Key Cryptography Public Key Cryptography How Public Key Cryptography Works Authenticating

symmetric key cryptography

Symmetric-Key Cryptography · cryptography does not eliminate the need for symmetric-key cryptography. Need for Both . The main idea behind asymmetric-key cryptography is the concept

1 Lecture 2: Introduction to Cryptography Outline uses of cryptography secret key cryptography public key cryptography message digests

Public Key Cryptography and RSAblk/cryptography/ch09-publicKey... · 2006-06-28 · Public Key Cryptography and RSA • Major topics – Principles of public key cryptosystems –

Methods of Public-Key Cryptography Emilie Wheeler · cryptography can be divided into two large branches: Private-Key Cryptog-raphy and Public-Key Cryptography. Private-key cryptography,

Public Key Cryptography

Chapter 9 – Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared by both

Public-Key Cryptography - Stanford University · Public-Key Cryptography Public-Key Cryptography Eric Roberts CS 54N November 7, 2016 Public-Key Encryption • In 1999, shortly before

[MS-PKCA]: Public Key Cryptography for Initial ...... · Public Key Cryptography for Initial Authentication (PKINIT) ... The Public Key Cryptography for Initial ... for Initial Authentication

Cryptography - Key Agreement and Key Transport Using Elliptic Curve Cryptography

Beginning Cryptography With Java - Symmetric Key Cryptography

Public-Key Cryptography

Public Key Cryptography - ict.ac.cnbioinfo.ict.ac.cn/~dbu/AlgorithmCourses/Lectures/Lec6-Knapsack... · Public Key Cryptography • Motivations – In symmetric key cryptography,

Cryptography - Dalhousie Universitytt/ECMM6010/6010_crypto.pdf · – Diffie-Hellman key exchange – Public-key cryptography RSA elliptic curve cryptography 12 23 Key generation

Private-Key Cryptography

Java*Cryptography - Cogent Logic · Java*Cryptography Symmetric*Key*Cryptography • Cryptography. Cryptography

Key Exchange With Public Key Cryptography

Part 1 Cryptography 1 Chapter 4: Public Key Cryptography Knapsack RSA Diffie-Hellman key Elliptic Curve Cryptography Public key crypto application

Chapter 10 Asymmetric-Key · PDF fileObjectives Present asymmetric-key cryptography. Distinguish between symmetric-key cryptography and asymmetric-key cryptography. Introduce trapdoor

Public-Key Cryptography

CRYPTOGRAPHY Gayathri V.R. Kunapuli. OUTLINE History of Cryptography Need for cryptography Private Key Cryptosystems Public Key Cryptosystems Comparison

Pubic-Key Cryptography

Secret Key Cryptography