I mport ance of Net work Securit y? Think about The most pr - PDF document

I mport ance of Net work Securit y? � Think about … � The most pr ivat e, embar r assing or valuable 15: piece of inf or mat ion you’ve ever st or ed on a comput er Net work Securit y Basics � How much you r ely on comput er syst ems t o be available when you need t hem � The degr ee t o which you quest ion whet her a piece of email r eally came f r om t he per son Last Modif ied: list ed in t he Fr om f ield 4/ 21/ 2003 8:30:27 PM � How convenient it is t o be able t o access pr ivat e inf or mat ion online (e.g. buy wit hout ent er ing all dat a, look up your t r anscr ipt wit hout r equest ing a copy,… ) 7: Net wor k Secur it y 1 7: Net wor k Secur it y 2 I mport ance of Net work Types of at t acks Securit y � Societ y is becoming increasingly reliant on � What ar e we wor r ied about ? t he correct and secure f unct ioning of � P assive: comput er syst ems � I nterception : at t acks conf ident ialit y. a.k.a., eavesdropping, “man- in- t he- middle” at t acks. � Medical r ecor ds, f inancial t r ansact ions, et c. � Traf f ic Analysis: at t acks conf ident ialit y, or anonymit y. � I t is our j obs as prof essional comput er Can includet raceback on a net work, CRT radiat ion. scient ist s: � Act ive: � To evaluat e t he syst ems we use t o under st and � I nterruption : at t acks availabilit y. t heir weaknesses (a.k.a., denial- of- service at t acks � To educat e our selves and ot her s t o be wise � Modif ication : at t acks int egrit y. net wor k consumer s � Fabrication : at t acks aut hent icit y. � To design net wor ked syst ems t hat ar e secur e 7: Net wor k Secur it y 3 7: Net wor k Secur it y 4 Fundament als of Def ense Crypt ography � The most widely used t ool f or secur ing � What can we do about it ? inf or mat ion and ser vices is cr ypt ogr aphy. � Rest rict ed Access � Cr ypt ogr aphy r elies on cipher s: mat hemat ical � Rest r ict physical access, close net wor k por t s, f unct ions used f or encr ypt ion and decr ypt ion of a isolat e f r om t he I nt er net , f ir ewalls, NAT message. gat eways, swit ched net wor ks � Encrypt ion : t he process of disguising a message in such a � Monit or ing way as t o hide it s subst ance. � Know what nor mal is and wat ch f or deviat ions � Ciphert ext : an encrypt ed message � Het erogeneit y/ Randomness � Decrypt ion: t he process of ret urning an encrypt ed message back int o plaint ext . � Var iet y of I mplement at ions, Random sequence number s, Random por t number s Or iginal Plaint ext Cipher t ext Plaint ext � Crypt ography… … Encr ypt ion Decr ypt ion 7: Net wor k Secur it y 7: Net wor k Secur it y 5 6 1

What makes a good cipher? Ciphers subst it ut ion cipher : subst it ut ing one t hing f or anot her � The secur it y of a cipher (like a subst it ut ion � monoalphabet ic cipher: subst it ut e one let t er f or anot her cipher ) may r est in t he secr ecy of it s r est r ict ed algor it hm. plaintext: abcdefghijklmnopqrstuvwxyz � Whenever a user leaves a group, t he algorit hm must change. ciphertext: mnbvcxzasdfghjklpoiuytrewq � Can’t be scrut inized by people smart er t han you. � But , secrecy is a popular approach :( E.g.: Plaintext: bob. i love you. alice � Moder n cr ypt ogr aphy r elies on secr et keys, a select ed value f r om a lar ge set (a keyspace), e.g., a ciphertext: nkn. s gktc wky. mgsbc 1024 -bit number . 2 1024 values! � Securit y is based on secrecy of t he key, not t he det ails Q: How har d t o br eak t his simple cipher ?: of t he algorit hm. •br ut e f or ce (how har d?) � Change of aut horized part icipant s requires only a change •ot her? in key. 7: Net wor k Secur it y 7 7: Net wor k Secur it y 8 Keys: Symmet ric vs Assymet ric Session Keys � The most common cr ypt ogr aphic t ools ar e � Symmet r ic key algor it hms ar e f ast er t han � Symmet ric key ciphers asymmet r ic key algor it hms • Use same key t o encr ypt and decr ypt � Of t en asymmet r ic key cr ypt ogr aphy used t o • One key shar ed and kept secr et exchange a shar ed secr et key • DES, 3DES, AES, Blowf ish, Twof ish, I DEA � This key called a symmet r ic session key is t hen • Fast and simple (based on addit ion, masks, and shif t s) used t o encr ypt t his conver sat ion wit h symmet r ic • Typical key lengt hs are 40, 128, 256, 512 key crypt ograhy � Asymmet ric key ciphers • Pair of keys: one encr ypt s and anot her decrpyt s � Each new conver sat ion would use a dif f er ent • One key (t he privat e key) must be kept secret ; t he ot her session key key (t he public key) can be f r eely disclosed � Ot her benef it s (I n addit ion t o ef f iciency) • RSA, El Gamal � session keys also reduce t he key exposure or amount of • Slow, but versat ile (usually requires exponent iat ion) encrypt ed t ext t hat could be collect ed t o aid in analysis • Typical key lengt hs are 512, 1024, 2048 � I f session key compromised only get inf o in t he last session 7: Net wor k Secur it y 9 7: Net wor k Secur it y 10 Symmet ric key crypt o: DES Public key encrypt ion algorit hms DES: Dat a Encr ypt ion St andar d Two int er-relat ed requirement s: � US encr ypt ion st andar d [NI ST 1993] � 56-bit symmet r ic key, 64 bit plaint ext input . . need a decr ypt ion f unct ion d B ( ) and an 1 � init ial permut at ion encr ypt ion f unct ion e B ( ) such t hat � 16 ident ical “rounds” of f unct ion applicat ion, each using dif f erent 48 bit s of key d (e (m)) = m e (d (m)) = m � f inal permut at ion B B B B � How secure is DES? 2 need public and pr ivat e keys . . � DES Challenge: 56- bit -key- encrypt ed phrase decrypt ed f or d B ( ) and e B ( ) (brut e f orce) in a lit t le over 22 hours (1999 DES Challenge I I I ) � no known “backdoor” decrypt ion approach � making DES mor e secur e � use t hree keys sequent ially (3- DES) on each dat um � use cipher - block chaining 7: Net wor k Secur it y 7: Net wor k Secur it y 11 12 2

RSA RSA in a nut shell 1. Choose t wo large prime numbers p, q. � Ronald L. Rivest, Adi Shamir and Leonard (e.g., 1024 bit s each) M. Adleman 2. Comput e n = pq, z = (p-1)(q-1 ) � Won 2002 Tur ing awar d f or t his wor k! � Want a f unct ion e B t hat is easy t o do, but 3. Choose e ( wit h e< n) t hat has no common f act or s hard t o undo wit hout a special decrypt ion wit h z. ( e, z ar e “r elat ively pr ime”). key 4. Choose d such t hat ed-1 is exact ly divisible by z . � Based on t he dif f icult y of f act oring large (in ot her wor ds: ed mod z = 1 ). numbers (especially ones t hat have only 5. Public key is (n,e). Pr ivat e key is (n,d). large prime f act ors) Why? (Will hint at) How? (Won’t discuss) 7: Net wor k Secur it y 13 7: Net wor k Secur it y 14 RSA: Encrypt ion, decrypt ion RSA: small example Bob chooses p=5, q=7 . Then n=35, z=24 . 0. Given ( n,e ) and ( n,d ) as comput ed above e=5 (so e, z r elat ively pr ime). d=29 (so ed-1 exact ly divisible by z. 1. To encr ypt bit pat t er n (message), m , comput e e e c = m mod n (i.e., r emainder when m is divided by n ) me e let t er m c = m mod n 2. To decr ypt r eceived bit pat t er n, c , comput e encrypt : d l 1524832 17 d 12 (i.e., r emainder when c is divided by n ) m = c mod n cd d c m = c mod n let t er decrypt : Magic d e m = (m mod n) mod n 17 481968572106750915091411825223072000 12 l happens! 7: Net wor k Secur it y 15 7: Net wor k Secur it y 16 Reversible e d RSA: Why? m = (m ) mod n Number t heor y r esult : I f p,q prime, n = pq, t hen � What t he privat e key encrypt s t he public y mod (p-1)(q-1) y x mod n = x mod n key decrypt s � What t he public key encrypt s t he privat e d e ed mod n = m mod n (m ) key decrypt s ed mod (p-1)(q-1) = m mod n I f it wer e easy (using number t heory result above) t o f act or n int o p and q t hen we 1 = m mod n would be in (since we chose ed t o be divisible by t rouble! (p- 1)(q-1) wit h remainder 1 ) = m 7: Net wor k Secur it y 7: Net wor k Secur it y 17 18 3