Penultimate Review IT Security Ido Rosen University of Chicago 3 - PowerPoint PPT Presentation

Policy Cryptography Network Security Penultimate Review IT Security Ido Rosen University of Chicago 3 March 2007 Ido Rosen Penultimate Review

Policy Cryptography Network Security 1 Policy Information Security Framework Defining Security Risk Assessment 2 Cryptography Terminology Hashing Algorithms Example: MD5 Example: SHA1 Symmetric Algorithms Example: DES Example: TDEA (3DES) Example: AES Public Key Algorithms Example: RSA 3 Network Security Networks Review Firewalls & NAT Tunneling VPN Protocols SSL/TLS IPSec Kerberos Ido Rosen Penultimate Review

Policy Cryptography Network Security Information Security Framework Information Security Framework Strategies & Policies Manage Deployment Monitor Events Technology Solutions & Architecture Ido Rosen Penultimate Review

Policy Cryptography Network Security Defining Security Confidentiality Integrity Availability Consistency Control Audit Ido Rosen Penultimate Review

Policy Cryptography Network Security Risk Assessment Identify assets and their value. Identify threats. Calculate risks. Ido Rosen Penultimate Review

Policy Cryptography Network Security Risk Assessment If only it were this simple... cost of prevention − cost of loss · probability of loss Ido Rosen Penultimate Review

Policy Cryptography Network Security Terminology Terminology Public Key Private/Secret Key Shared-secret/passphrase/password Hash (and collision) Salt (and salted hash) Cryptanalysis Ciphertext-only attack Known plaintext attack Chosen plaintext attack Digital signature Encryption, decryption Signature, verification Ido Rosen Penultimate Review

Policy Cryptography Network Security Hashing Algorithms Concepts One-way encryption. Some information is lost. Hash usually much smaller than data. Hash usually fixed size. Can ensure integrity if used w/signature or encryption. Collisions are bad! Ido Rosen Penultimate Review

Policy Cryptography Network Security Hashing Algorithms MD5 Takes arbitrary length input. Outputs 128-bit fixed-length hash/digest. Collisions already detected. Ido Rosen Penultimate Review

Policy Cryptography Network Security Hashing Algorithms SHA1 Takes arbitrary length input. Outputs 160-bit hash/digest. Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms Concepts Same key to encrypt and decrypt. Faster than public key algorithms. Easier to implement in hardware. Hash(shared-secret + message) can ensure integrity. Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms DES Block cipher. 56-bit keys. (3DES: 168-bit keys) 64-bit blocks. 16 rounds. (3DES: 48 rounds) Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms TDEA (3DES) Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms AES State 4 × 4 array of bytes. Key 128, 192, or 256-bit shared secret. Key schedule Given a key, return subkeys for each round. Lookup table Rijndael S-box. A DD R OUND K EY : Combine each byte of state with round key; 1 each round key is derived from cipher key using key schedule. S UB B YTES : Non-linear substitution step, each byte is replaced 2 with another according to a lookup table. S HIFT R OWS : Transposition step, each row of the state is 3 shifted cyclically a certain number of steps. M IX C OLUMNS : Mixing operation, operates on the columns of 4 the state, combines four bytes in each column using linear transformation. In the last round, replace M IX C OLUMNS with A DD R OUND K EY . Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms AES: A DD R OUND K EY Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms AES: S UB B YTES Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms AES: S HIFT R OWS Ido Rosen Penultimate Review

Policy Cryptography Network Security Symmetric Algorithms AES: M IX C OLUMNS Ido Rosen Penultimate Review

Policy Cryptography Network Security Public Key Algorithms Concepts Public key to encrypt, private key to decrypt. Private key can be passphrase-protected. Rely on difficulty of reverse operation for security. Some allow for signing with private key, and verification with public key. Ido Rosen Penultimate Review

Policy Cryptography Network Security Public Key Algorithms RSA p , q ∈ { prime numbers } n = p · q e = small odd integer, relatively prime to p and q d = e − 1 mod φ n ( e , n ) = public key ( d , n ) = secret key φ n = ( p − 1 ) · ( q − 1 ) c i = m e mod n i m i = c d mod n i Ido Rosen Penultimate Review

Policy Cryptography Network Security Networks Review OSI Model Application Presentation Session Transport Network Link Physical Ido Rosen Penultimate Review

Policy Cryptography Network Security Networks Review Selected Topics Hardware (bridges, hubs, switches, routers) Addresses (MAC, IP , etc.) Packet Encapsulation Network Address Translation TCP vs. UDP Switching & Routing Protocols Address Resolution Protocol Spanning Tree Protocol Border Gateway Protocol Application Protocols HTTP , FTP , SMTP , IMAP , POP , SMB, NFS, ... SSH, FTP/SSL, HTTP/SSL, IMAP/SSL, ... Ido Rosen Penultimate Review

Policy Cryptography Network Security Firewalls & NAT Types of Firewalls Network layer firewalls A packet filter, such as iptables , which decides which packets will pass through to the internal network or protected resource based on packet headers. Can be stateful or stateless. Application layer firewalls A TCP wrapper, for example. Synonymous with proxy sometimes. Knows about the application-level protocol. Proxies Actually responds to/intervenes in the application-level protocol. Ido Rosen Penultimate Review

Policy Cryptography Network Security Firewalls & NAT Network Address Translation Usually done at router or gateway, between LAN and WAN. For example, masking a home network (multiple computers behind a router) as a single IP address to the rest of the world. Can be its own form of firewall. Works by changing the source/destination IP parts of the IP header in the packet and rerouting to the appropriate interface. Ido Rosen Penultimate Review

Policy Cryptography Network Security Firewalls & NAT Packet Filters Most firewalls today can be more than packet filters. Act on IP , TCP , UDP , or other encapsulated protocol packet header. “Policy” describes default action. (i.e.: DROP/ACCEPT) “Rules” describe specific actions based on packet headers. Ido Rosen Penultimate Review

Policy Cryptography Network Security Tunneling Tunneling protocols encapsulate one protocol inside another. L2TP , PPTP are commonly used datagram-based tunneling protocols in VPNs. TLS/SSL is most commonly used tunneling protocol. (i.e.: HTTPS) SSH is another tunneling protocol, though not its primary purpose. IPSec is a tunneling protocol to provide security at the IP (network) level. Ido Rosen Penultimate Review

Policy Cryptography Network Security VPN Virtual Private Network Private network overlaid on a public network. Password or certificate based authentication mechanism. IPSec, PPTP , L2TP are all VPN protocols. Ido Rosen Penultimate Review

Policy Cryptography Network Security Protocols SSL/TLS Operates on transport/session layer. Peer negotiation for algorithm support PKI-based key exchange and certificate authentication. Symmetrically encrypted traffic. Ido Rosen Penultimate Review

Policy Cryptography Network Security Protocols IPSec Operates on network layer. Encapsulates IP packets. Encrypts packets “end-to-end,” sometimes. Transport or tunnel mode. Transport mode: Only payload of IP packet is encrypted. (i.e.: host-to-host) Tunnel mode: Entire IP packet is encrypted. (i.e.: net-to-net) Ido Rosen Penultimate Review

Policy Cryptography Network Security Protocols Kerberos K AS is a pre-established secret key known only to A and S . K BS similarly, for B and S . K AB is a temporary session key between A and B . T S and T A are timestamps generated by S and A . L is a “lifespan” defining validity of a timestamp. A − → S : A , B S − → A : { T S , L , K AB , B , { T S , L , K AB , A } K BS } K AS A − → B : { T S , L , K AB , A } K BS , { A , T A } K AB B − → A : { T A + 1 } K AB Ido Rosen Penultimate Review

Policy Cryptography Network Security Protocols Kerberized Protocols AFS, NFS, SSH, SMB, AppleTalk, LDAP , IMAP , POP , FTP , Telnet, Apache, and many more can use Kerberos for authentication. Ido Rosen Penultimate Review

Policy Cryptography Network Security Ido Rosen Penultimate Review