EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao [email protected].
-
date post
21-Dec-2015 -
Category
Documents
-
view
216 -
download
0
Transcript of EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao [email protected].
![Page 1: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/1.jpg)
EEC-484/584EEC-484/584Computer NetworksComputer Networks
Lecture 16Lecture 16
Wenbing ZhaoWenbing Zhao
![Page 2: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/2.jpg)
22
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
OutlineOutline• Reminder
– Quiz#5 (take home exam) will be emailed to you around noon 5/13 or earlier. It is due by noon 5/14. Email submission of a scanned or typed copy is encouraged
– Final Revised Wiki Page due 5/13 midnight
• Cipher modes• Public key algorithm• Digital signature• Message digest and secure hash functions• Public key infrastructure
![Page 3: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/3.jpg)
33
EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Cipher Block Chaining ModeCipher Block Chaining Mode
• To avoid the ECB mode problem: replacing a block will cause the plaintext decrypted starting at the replaced to become garbage
• Exclusive OR the encrypted text with the next block of plaintext before encryption: C0 = E(P0 XOR IV), C1 = E(P1 XOR C0), etc.
Spring Semester 2009Spring Semester 2009
![Page 4: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/4.jpg)
44
EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Cipher Block Chaining ModeCipher Block Chaining Mode
• Exclusive OR the encrypted text with the next block of plaintext before encryption: C0 = E(P0 XOR IV), C1 = E(P1 XOR C0), etc.
InitializationVector
Encryption Decryption
Spring Semester 2009Spring Semester 2009
![Page 5: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/5.jpg)
55
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Stream Cipher ModeStream Cipher Mode
• To be insensitive to transmission error, an arbitrarily large sequence of output blocks, called the keystream, is treated like a one-time pad and XORed with the plaintext to get the ciphertext– It works by encrypting an IV, using a key to get an
output block– The output block is then encrypted, using the key to get
a second output block– This block is then encrypted to get a third block, and so
on
![Page 6: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/6.jpg)
66
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Stream Cipher ModeStream Cipher Mode
Encryption Decryption
• The keystream is independent of the data– It can be computed in advance– It is completely insensitive to transmission errors
![Page 7: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/7.jpg)
77
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Stream Cipher ModeStream Cipher Mode
• It is essential never to use the same (key, IV) pair twice with a stream cipher because doing so will generate the same keystream each time
• Using the same keystream twice exposes the ciphertext to a keystream reuse attack
• Stream cipher mode is also called output feedback mode
![Page 8: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/8.jpg)
88
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Keystream Reuse AttackKeystream Reuse Attack• Plaintext block, P0, is encrypted with the keystream to
get P0 XOR K0 • Later, a second plaintext block, Q0, is encrypted with the
same keystream to get Q0 XOR K0• An intruder who captures both ciphertext blocks can
simply XOR them together to get P0 XOR Q0, which eliminates the key
• The intruder now has the XOR of the two plaintext blocks• If one of them is known or can be guessed, the other can
also be found• In any event, the XOR of two plaintext streams can be
attacked by using statistical properties of the message
![Page 9: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/9.jpg)
99
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Public-Key AlgorithmsPublic-Key Algorithms• Distributing keys => the weakest link in most
cryptosystems– No matter how strong a cryptosystem was, if an intruder could
steal the key, the system was worthless– Cryptologists always took for granted that the encryption key and
decryption key were the same
• Diffie and Hellman (1976) proposed a radically new kind of cryptosystem: encryption and decryption keys were different– D(E(P)) = P– It is exceedingly difficult to deduce D from E– E cannot be broken by a chosen plaintext attack
![Page 10: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/10.jpg)
1010
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Public-Key AlgorithmsPublic-Key Algorithms
• Public-key cryptography: – Encryption algorithm and the encryption key can
be made public
• How to establish a secure channel– Alice and Bob have never had previous contact
– Alice sends Bob EB(P) (message P encrypted using Bob’s public encryption key EB)
– Bob receives the encrypted message and retrieves the plaintext by using his private key P = DB(EB(P))
– Bobs then sends a reply EA(R) to Alice
![Page 11: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/11.jpg)
1111
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
RSARSA
• Rivest, Shamir, Adleman, 1978: a good method for public-key cryptography
• RSA method:– Choose two large primes, p and q (typically 1024 bits)– Compute n = p q and z = (p-1) (q-1)– Choose a number relatively prime to z and call it d– Find e such that e d = 1 mod z
• To encrypt a message, P, Compute C = Pe (mod n)
• To decrypt C, compute P = Cd (mod n)• The public key consists of the pair (e, n)• The private key consists of the pair (d, n)
![Page 12: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/12.jpg)
1212
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
RSARSA• An example of the RSA algorithm
– P = 3, q = 11 => n = 33 and z = 20– A suitable value for d = 7– e can be found by solving the eq. 7e = 1 (mod 20) => e = 3
– C = P3 (mod 33), P = C7 (mod 33)
![Page 13: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/13.jpg)
1313
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Digital SignaturesDigital Signatures
• Requirement on digital signatures: one party can send a signed message to another party in such a way that the following conditions hold:– The receiver can verify the claimed identity of the
sender– The sender cannot later repudiate the contents of the
message– The receiver cannot possibly have concocted the
message himself
![Page 14: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/14.jpg)
1414
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Public-Key SignaturesPublic-Key Signatures
• Digital signatures using public-key cryptography– Requires E(D(P)) = P (in addition to D(E(P)) = P)
![Page 15: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/15.jpg)
1515
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Message DigestsMessage Digests
• Message digest (MD): using a one-way hash function that takes an arbitrarily long piece of plaintext and from it computes a fixed-length bit string– Given P, it is easy to compute MD(P)– Given MD(P), it is effectively impossible to find P– Given P no one can find P’ such that MD(P’) = MD(P)– A change to the input of even 1 bit produces a very different output
![Page 16: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/16.jpg)
1616
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Secure Hash FunctionsSecure Hash Functions• Hash function: mangling bits in a sufficiently
complicated way that every output bit is affected by every input bit
• MD5 is the fifth in a series of message digests designed by Ronald Rivest (1992)– MD5 generates a 128-bit fixed value
• SHA-1: Secure Hash Algorithm 1, developed by National Security Agency (NSA) and blessed by NIST– SHA-1 generates 160-bit message digest
![Page 17: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/17.jpg)
1717
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Digital Signatures Using Digital Signatures Using Message DigestsMessage Digests
![Page 18: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/18.jpg)
1818
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Message Authentication CodeMessage Authentication Code
• MACs are used between two parties that share a secret key in order to validate information transmitted between these parties
• The MAC mechanism that is based on cryptographic hash functions is called HMAC. Basic idea:– Append the key to the plaintext and generate a digest
using a hash function– Ship the plaintext together with the digest
![Page 19: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/19.jpg)
1919
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Management of Public KeysManagement of Public Keys
• Problem statement
• Certificates
• X.509
• Public key infrastructure
![Page 20: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/20.jpg)
2020
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Problems with Problems with Public-Key ManagementPublic-Key Management
• If Alice and Bob do not know each other, how do they get each other’s public keys to start the communication process ?– It is essential Alice gets Bob’s public key, not someone
else’s
• A way for Trudy to subvert public-key encryption
![Page 21: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/21.jpg)
2121
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
CertificatesCertificates• Certification Authority (CA): an organization that
certifies public keys– It certifies the public keys belonging to people, companies, or
even attributes– CA does not need to be on-line all the time (in ideal scenarios)
• A possible certificate and its signed hash
![Page 22: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/22.jpg)
2222
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
X.509X.509
• Devised and approved by ITU• The basic fields of an X.509 certificate
![Page 23: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/23.jpg)
2323
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Public-Key InfrastructuresPublic-Key Infrastructures
• A Public-Key Infrastructure (PKI) is needed for reasons of– Availability, Scalability, Ease of management
• A PKI has multiple components– Users, CAs, Certificates, Directories
• A PKI provides a way of structuring these components and define standards for the various documents and protocols– A simple form of PKI is hierarchical CAs
![Page 24: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/24.jpg)
2424
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Public-Key InfrastructuresPublic-Key Infrastructures
• Hierarchical PKI• A chain of trust/certification path:
A chain of certificates going back to the root
![Page 25: EEC-484/584 Computer Networks Lecture 16 Wenbing Zhao wenbing@ieee.org.](https://reader036.fdocuments.net/reader036/viewer/2022081519/56649d575503460f94a35cf6/html5/thumbnails/25.jpg)
2525
Spring Semester 2009Spring Semester 2009 EEC484/584 Computer NetworksEEC484/584 Computer Networks Wenbing ZhaoWenbing Zhao
Public-Key InfrastructuresPublic-Key Infrastructures• Revocation: sometimes certificates can be revoked, due
to a number of reasons• Reinstatement: a revoked certificate could conceivably be
reinstated• Each CA periodically issues a CRL (Certificate
Revocation List) giving the serial numbers of all certificates that it has revoked– A user who is about to use a certificate must now acquire the CRL
to see if the certificate has been revoked
• Having to deal with revocation (and possibly reinstatement) eliminates one of the best properties of certificates, namely, that they can be used without having to contact a CA