CONFIDENTIALY USING CONVENTIONAL ENCRYPTION – Chapter 7

• Historically – Conventional Encryption• Recently – Authentication, Integrity,

Signature, Public-key • Link• End-to-End• Traffic-Analysis• Key Distribution• Random Number Generation

2

Points of Vulnerability

L A N

C omm sSer ver

W orkstation

W ir ingC loset

F r ame R elayor A T MN etwor k

T elcoC entr alO ffice

F igur e 7.1 P oints of V ulner abil ity

3

Link / End-to-End

P acket-switchingnetworkP SN P SN

P SN

P SN

= end-to-end encryption device

= link encryption device

P SN = packet sw itching node

F igur e 7.2 E ncr yption A cr oss a P ack et-Sw itching N etwork

• Link - both ends of link - many encryps / decryps - all links use it - decrypt at packet switch (read addr.) - unique key / node pair• End- to-End - only at ends - data encrypted, not address (header) - one key pair - traffic pattern insecure - authentication from sender

Confidentiality

Table 7.1

Characteristics of Link and End-to-End

- Data secure at nodes - Authentication

• LINK – low level (physical/link)• END-TO-END – network (X.25) End0

End1 (ends separately End2

protected)

Cannot service internet traffic

Both Link and End-to-End

Front-End Processor Function

E-mail Gateway

F igur e 7.4 E ncr yption C over age I mplications of Stor e-and-F or war d C ommunications

E mailP resentation

Session

T ranspor t

N etwork

Data L ink

P hysical

P resentation

Session

T ranspor t

N etwor k

Data L ink

P hysical

Scope of link -levelencryption

Scope of end-to-end encryption below app lication layer

E mail

T C P

I P

Data L ink

P hysical

E mail

T C P

I P

Data L ink

P hysical

E mail

O SI E ndSystem M ail G ateway T C P /I P E nd

System

Scope of A pplication-L ayer E nd-to-E nd E ncryption

Internetwork I nternetwork

OSI email gateway TCP

• no end-to-end protocol below appl. layer• networks terminate at mail gateway• mail gateway sets up new transport/network connections• need end-to-end encryp. at appl. Layer - disadvantage: many keys

E-mail Gateway

Various Encryption StrategiesL ink -H Net-H I P -H T C P -H Data L ink -T

(a) A pplication-L evel E ncryption (on links and at routers and gateways)

F igur e 7.5 R elationship between E ncr yption and P r otocol L evels

T C P -HShading indicates encryption. = T C P headerIP-H = IP headerN et-H = N etw ork- level header (e.g., X .25 packet header, L L C header)L ink-H = D ata link control protocol headerL ink-T = D ata link control protocol trailer

O n links and at routers

In gateways

(b) T C P -L evel E ncryption

O n links

In routers and gateways

(c) L ink -L evel E ncryption

L ink -H Net-H I P -H T C P -H Data L ink -T

L ink -H Net-H I P -H T C P -H Data L ink -T

L ink -H Net-H I P -H T C P -H Data L ink -T

L ink -H Net-H I P -H T C P -H Data L ink -T

Traffic Confidentiality• Identities• Message Frequency• Message Pattern• Event Correlation• Covert ChannelLink• Headers encrypted• Traffic padding (Fig 7.6)End-to-End• Pad data• Null messages

Traffic Padding

E ncr yptionalgorithm

C ontinuousr andom-data

gener ator

D iscontinuousplaintext input

K ey

C ontinuouscipher text output

F igur e 7.6 T r affic-P adding E ncr yption Device

KEY DISTRIBUTION1. Physically deliver2. Third party physically select/deliver3. EKold(Knew) →4. End-to-End(KDC): A EKA(Knew) C EKB(Knew) B

N hosts → (N)choose(2) keys – Fig 7.7

KDC – Key hierarchy – Fig 7.8 Session Key – temporary : end ↔ end

Only N master keys – physical delivery

#End-to-End Keys

10 6

10 7

10 8

10 9

Num

ber o

f key

s

5 6 7 8 910 3

2 3 4 5 6 7 8 910 4

2 3 4 5 6 7 8 910 5

Number of endpoints

F igur e 7.7 N umber of K eys R equir ed to Suppor t A rbitrar yC onnections B etween E ndpoints

Key HierarchyD ata C r yptogr aphic

P r otection

Session K eys C r yptogr aphicP r otection

M aster K eys N on-C r yptogr aphicP r otection

F igur e 7.8 T he U se of a K ey H ier ar chy

16

KEY DISTRIBUTION SCENARIO

(1) R equest || N 1

K ey distributionsteps

A uthenticationsteps

F igur e 7.9 K ey D istr ibution Scenar io

I nitiatorA

R esponderB

K eyD istr ibution

C enter (K D C )

(2) E K a[K s || R equest || N 1] || E K b(K s, ID A )]

(4) E K s[N 2]

(5) E K s[f(N 2)]

(3) E K b[K s || ID A ]

KEY DISTRIBUTIONUser shares Master Key with KDCSteps 1-3 : Key DistributionSteps 3,4,5 : Authentication

Key Distribution Centre (KDC) Hierarchy

LOCAL KDCs KDCX KDCA KDCB A B

Key selected by KDCA, KDCB, or KDCX

LIFETIMEShorter Lifetime → Highter Security

→ Reduced Capacity

Connection-oriented: - change session key periodically

Connectionless: - new key every exchange

or #transactions or after time period

Key Distribution (connection-oriented)

End-to-End (X.25,TCP), FEP obtains session keys

H O ST H O ST

K D C

network

F E P

FEP

FEP

1

2 3

4

1. H ost sends pack et requesting connection2. F r ont end buffer s pack et; asks K D C for session key3. K D C distr ibutes session key to both fr ont ends4. B uffer ed pack et tr ansm itted

F E P = fr ont end pr ocessorK D C = key distr ibution center

F igur e 7.10 A utomatic K ey D istr ibution for C onnection-O r iented P r otocol

Decentralised Key Control

Not practical for large networks - avoids trusted third party

(1) Request || N 1

F igur e 7.11 D ecentralized K ey D istr ibution

I nitiatorA

R esponderB

(2) E M K m[K s || R equest || ID A || f(N 1) || N 2 ]

(3) E K s[ f(N 2) ]

KEY USAGE

key types : Data, PIN, Filekey tags : Session/Master/Encryp/Decryp

Control Vector:associate session key with control vector

(Fig 7.12)

Control Vector Encryp. and Decryp.C ontrolV ector

M asterK ey

SessionK ey

H ashingF unction

K eyinput

P laintextinput

E ncryptionF unction

E ncr yptedSession K ey

(a) C ontrol V ector E ncryption

C ontrolV ector

M asterK ey

E ncr yptedSession K ey

H ashingF unction

K eyinput

P laintextinput

DecryptionF unction

Session K ey

(b) C ontrol V ector Decryption

F igur e 7.12 C ontrol V ector E ncr yption and D ecr yption

» »

PRNG From Counter

C

C + 1

C ounter w ithP er iod N

E ncryptionA lgor ithm

M aster K eyK m

X i = E K m[C + 1]

F igur e 7.13 P seudor andom N umberG eneration F rom a C ounter

ANSI X9.17 PRNG

E D E

E D E

E D E

K 1, K 2

D T i

V i

R i

V i+1

F igure 7.14 A N SI X 9.17 P seudor andom N umber G enerator

Random Number Generation

• Linear Congruential Generator Xn+1 = (aXn + c) mod m

• Encryption : DES (OFB) – (Fig 7.14)

• Blum Blum Shub (BBS) X0 = s2 mod n for i = 1 to infinity Xi = (Xi-1)2 mod n Bi = Xi mod 2