CS CS 683 683 - Se Securi rity and Pri rivacy Sp Spri ring 2018 2018 Instr Ins truc uctor: Ka Karim El Elde defr frawy http://www.cs.usfca.edu/~keldefrawy/teaching/spring20 18/cs683/cs683_main.htm (https://goo.gl/t396Fw) 1
Ou Outline • The players/actors • Terminology • Attacks, services and mechanisms • Security attacks • Security services • Methods of defense • A model for network security 2
Co Comp mputer r Se Securi rity: y: Th The Ca Cast of of C Characters Attacker or Adversary Your Computer/Phone/Tablet Your data: financial, health records, intellectual property … Can be: individuals, organizations, nations … 3
Ne Network S Secu curity: Th The Cast of of Ch Characters communication channel Bob Alice Eve(sdropper) 4
Te Terminology (Cr (Cryp yptogr graphy) y) • Cryptology, Cryptography, Cryptanalysis • Cipher, Cryptosystem, Encryption scheme • Encryption/Decryption, Encipher/Decipher • Privacy/Confidentiality, Authentication, Identification • Integrity • Non-repudiation • Freshness, Timeliness, Causality • Intruder, Adversary, Interloper, Attacker • Anonymity, Unlinkability/Untraceability 5
Te Terminology (S (Security) ) • Access Control & Authorization • Accountability • Intrusion Detection • Physical Security • Tamper-Resistance • Certification & Revocation 6
At Attacks, Services and Mechanisms • Security Attack: Any action (or event) that aims to compromise (undermine) the security of information • Security Mechanism: A measure (technique or method) designed to detect, prevent, or recover from, a security attack • Security Service: something that enhances the security of data processing systems and information transfers. A “security service” makes use of one or more “security mechanisms” • Example: – Security Attack: Eavesdropping (Interception) – Security Mechanism: Encryption – Security Service: Confidentiality 7
So Some me Cl Classes of Se Securi rity Attacks 8
Se Securi rity Attacks • Interruption: attack on availability • Interception: attack on confidentiality • Modification: attack on integrity • Fabrication: attack on authenticity 9
Ma Main Se Securi rity Goals Confidentiality Authenticity Integrity Availability 10
Security Th Threats: Th Threat vs Attack? By Injection By Deletion 11
Ex Exampl ple Secur urity y Services • Confidentiality: to assure information privacy and secrecy • Authentication: to assert who created or sent data • Integrity: to show that data has not been altered • Access control: to prevent misuse of resources • Availability: to offer access to resources, permanence, non- erasure Examples of attacks on Availability: – Denial of Service (DoS) Attacks • e.g., against a name server – Malware that deletes or encrypts files 12
Bob Alice Attacker/Adversary 13
So Some me Me Methods of Defense • Cryptography à confidentiality, authentication, identification, integrity, etc. • Software Controls (e.g., in databases, operating systems) à protect users from each other • Hardware Controls (e.g., smartcards, badges) à authenticate holders (users) • Policies (e.g., frequent password changes, separations of duty) à prevent insider attacks • Physical Controls (doors, guards, etc.) à control physical access 14
Cr Cryp yptography: His History an and Sim imple le Enc Encryp yption Me Methods an and Pr Preliminaries 15
Cryp Cr yptography The word cryptography comes from the Greek words κρυπτός (hidden or secret) and γράφειν (writing). So historically cryptography has been the “art of secret writing.” Most of cryptography is currently well grounded in mathematics and it can be debated whether there’s still an “art” aspect to it. 16
Cryp Cr yptography y can be use sed at di differ eren ent level els • Algorithms: encryption, signatures, hashing, Random Number Generator (RNG) • Protocols (2 or more parties): key distribution, authentication, identification, login, payment, etc. • Systems: electronic cash, secure filesystems, smartcards, VPNs, e-voting, etc. • Attacks: on all the above 17
So Some me Applications of Cr Cryptography • Network, operating system security • Protect Internet, phone, space communication • Electronic payments (e-commerce) • Database security • Software/content piracy protection • Pay TV (e.g., satellite) • Military communications • Voting 18
Op Open vs. s. Cl Close sed Desi sign gn Model • Open design : algorithm, protocol, system design (and even possible plaintext) are public information. Only key(s) are kept secret. • Closed design : as much information as possible is kept secret. 19
Co Core Issu ssue in Network rk Se Securi rity y : How to to Com ommunicate S Securely? Alice Bob Looks simple … But, the devil is in the details Note: even storage is a Eve(sdropper) form of communication 20
Th The Biggest “Headache” is that… Good security must be Effective Yet Unobtrusive Because security is not a service in and of itself, but a burden! 21
Cr Cryp yptography y is s Ol Old … • Most sub-fields in CS are fairly new (20-30 years): – Graphics, compilers, software, OS, architecture • And, a few are quite old (more than several decades): – Cryptography, database, networking 22
So Some me History: : Ca Caesar’s Ci Cipher Homo Krpr Hominem Krplqhp Lupus! Oxsxv! 23
So Some me History: : Rosetta St Stone 24
So Some me History: : Enigma ma Alan Turing (1912-1954) 25
His Historic ical al (Prim imitiv itive) e) Cipher iphers • Shift (e.g., Caesar): Enc k (x) = x+k mod 26 • Affine: Enc k1,k2 (x) = k1 *x + k2 mod 26 • Substitution: Enc perm (x) = perm(x) • Vigenere: Enc K (x) = ( X[0]+K[0], X[1]+K[1], … ) • Vernam: One-Time Pad (OTP) 26
Sh Shift (Ca Caesar) r) Ci Cipher r Example: K = 11 W E W I L L M E E T A T M I D N I G H T 22 4 22 8 11 11 12 4 4 19 0 19 12 8 3 13 8 6 7 19 7 15 7 19 22 22 23 15 15 4 11 4 23 19 14 24 19 17 18 4 H P H T W W X P P E L E X T O Y T R S E • How many keys are there? • How many trials are needed to find the key? 27
Su Substitution Ci Cipher r Example: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z X N Y A H P O G Z Q W B T S F L R C V M U E K J D I KEY W E W I L L M E E T A T M I D N I G H T K H K Z B B T H H M X M T Z A S Z O G M • How many keys are there? • How many trials are needed to find the key? 28
Su Substitution Ci Cipher r Cryptanalysis Probabilities of Occurrence 0.14 0.127 0.12 0.1 0.091 0.082 0.08 0.075 0.07 0.067 0.06 0.063 0.061 0.06 0.043 0.04 0.04 0.028 0.028 0.024 0.023 0.022 0.02 0.02 0.019 0.02 0.015 0.01 0.008 0.002 0.001 0.001 0.001 0 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 29
Su Substitution Ci Cipher r Cryptanalysis s Frequency of some common digram 3.5 3.21 3.05 3 2.5 2.3 2.13 2 1.9 1.83 1.81 1.53 1.51 1.5 1.36 1.32 1.3 1.28 1.28 1.22 1 0.5 0 AN AT ED EN ER ES HE IN ON OR RE ST TE TH TI 30
VE VERNAM One-Ti Time Pad (OTP TP): Wo World’s Best Cipher = Plaintext { p ,..., p } - 0 n 1 = One - time pad stream { otp ,..., otp } - 0 n 1 = Ciphertext { c ,..., c } - 0 n 1 where : = Å " < < c p otp 0 i n i i i = Å C A B Å = C B A 31
VE VERNAM One-Ti Time Pad (OTP TP): Wo World’s Best Cipher Vernam offers perfect information-theoretic • security, but: How long does the OTP keystream need to be? • How do Alice and Bob exchange the keystream? • 32
Encryp Enc yption n Princ ncipl ples • A cryptosystem has (at least) five ingredients: – Plaintext – Secret Key – Ciphertext – Encryption Algorithm – Decryption Algorithm • Security usually depends on the secrecy of the key, not the secrecy of the algorithms 33
Cr Cryp ypto Ba Basi sics 34
Average Ti Time Required fo for Exha Exhaus ustive Ke Key Sear earch (f (for Bru Brute Fo Force Atta ttacks) ) Key Size Number of Time required at 10 6 (bits) Alternative Keys Decr/µs 2 32 = 4.3 x 10 9 32 2.15 milliseconds 2 56 = 7.2 x 10 16 56 10 hours 5.4 x 10 18 years 128 2 128 = 3.4 x 10 38 5.9 x 10 30 years 168 2 168 = 3.7 x 10 50 35
Ty Types of Attainable Security • Perfect, unconditional or “information theoretic”: the security is evident free of any (computational/hardness) assumptions • Reducible or “provable”: security can be shown to be based on some common (often unproven) assumptions, e.g., the conjectured difficulty of factoring large integers • Ad hoc: the security seems good often -> “snake oil”… Take a look at: http://www.ciphersbyritter.com/GLOSSARY.HTM 36
Recommend
More recommend
