Modified from Silberschatz, Galvin and Gagne Lecture 22 Chapter 15: Security

Modified from Silberschatz, Galvin and Gagne

Lecture 22

Chapter 15: Security

2Principles of Computer Operating Systems

Security Services

Enhance the security of data processing systems and information transfers of an organization.

Counter security attacks.

Security Attack

Action that compromises the security of information owned by an organization.

Security Mechanisms

Designed to prevent, detect or recover from a security attack.

Aspects of Security


Enhance security of data processing systems and information transfers

Authentication

Assurance that the communicating entity is the one claimed

Authorization

Prevention of the unauthorized use of a resource

Availability

Data is available in a timely manner when needed

Security Services


Confidentiality

Protection of data from unauthorized disclosure

Integrity

Assurance that data received is as sent by an authorized entity

Non-Repudiation

Protection against denial by one of the parties in a communication

Security Services


Security Attacks

Informationsource

Informationdestination

Normal Flow


Security Attacks

Informationsource


Interruption

Attack on availability

(ability to use desired information or resources)


Denial of Service

Internet

PerpetratorVictim

ICMP echo (spoofed source address of victim) Sent to IP broadcast address

ICMP echo reply

ICMP = Internet Control Message Protocol

Innocentreflector sites

Smurf Attack

1 SYN

10,000 SYN/ACKs – Victim is dead


Security Attacks

Informationsource


Interception

Attack on confidentiality

(concealment of information)


Packet Sniffing

Packet Sniffer

Client

Server

Network Interface Card allows only packets for this MAC address

Every network interface card has a unique 48-bit Media Access Control (MAC) address, e.g. 00:0D:84:F6:3A:10 24 bits assigned by IEEE; 24 by card vendor

Packet sniffer sets his card to promiscuous mode to allow all packets


Security Attacks

Informationsource


Fabrication

Attack on authenticity

(identification and assurance of origin of information)


IP addresses are filled in by the originating host

Using source address for authentication

r-utilities (rlogin, rsh, rhosts etc..)

IP Address Spoofing

• Can A claim it is B to the server S?

• ARP Spoofing

• Can C claim it is B to the server S?

• Source Routing

InternetInternet

2.1.1.1 C

1.1.1.1 1.1.1.2A B

1.1.1.3 S


Security Attacks

Informationsource


Modification

Attack on integrity

(prevention of unauthorized changes)


When is a TCP packet valid?

Address / Port / Sequence Number in window

How to get sequence number?

Sniff traffic

Guess it

Many earlier systems had predictable Initial Sequence Number

Inject arbitrary data to the connection

TCP Session Hijack


Security Attacks

Message interception

Trafficanalysis

eavesdropping, monitoring transmissions

Passive attacks

Masquerade Denial ofservice

some modification of the data stream

Active attacks

Replay Modification of message contents


Feature designed to

Prevent attackers from violating security policy

Detect attackers’ violation of security policy

Recover, continue to function correctly even if attack succeeds.

No single mechanism that will support all services

Authentication, authorization, availability, confidentiality, integrity, non-repudiation

Security Mechanism



Cryptography as a Security Tool

Broadest security tool available

Source and destination of messages cannot be trusted without cryptography

Means to constrain potential senders (sources) and / or receivers (destinations) of messages

Based on secrets (keys)


Secure Communication over Insecure Medium


Encryption

Encryption algorithm consists of

Set of K keys

Set of M Messages

Set of C ciphertexts (encrypted messages)

A function E : K → (M→C). That is, for each k K, E(k) is a function for generating ciphertexts from messages.

Both E and E(k) for any k should be efficiently computable functions.

A function D : K → (C → M). That is, for each k K, D(k) is a function for generating messages from ciphertexts.

Both D and D(k) for any k should be efficiently computable functions.

An encryption algorithm must provide this essential property: Given a ciphertext c C, a computer can compute m such that E(k)(m) = c only if it possesses D(k).

Thus, a computer holding D(k) can decrypt ciphertexts to the plaintexts used to produce them, but a computer not holding D(k) cannot decrypt ciphertexts.

Since ciphertexts are generally exposed (for example, sent on the network), it is important that it be infeasible to derive D(k) from the ciphertexts


Symmetric key cryptography

symmetric key crypto: Bob and Alice share know same (symmetric) key: K

e.g., key is knowing substitution pattern in mono alphabetic substitution cipher

Q: how do Bob and Alice agree on key value?

plaintextciphertext

KA-B

encryptionalgorithm

decryption algorithm

A-B

KA-B

plaintextmessage, m

K (m)A-B

K (m)A-B

m = K ( ) A-B


Symmetric Encryption

Data Encryption Standard

most commonly used symmetric block-encryption algorithm

created by US Govt

Encrypts a block of data at a time

initial permutation

16 identical “rounds” of function application, each using different 48 bits of key

final permutation

DES operation


Symmetric Encryption (cont)

DES is breakable using brute force making DES more secure

use three keys sequentially (3-DES) on each datum

use cipher-block chaining

Advanced Encryption Standard (AES)

symmetric-key NIST standard replacing DES, Nov 2001

processes data in 128 bit blocks

128, 192, or 256 bit keys

brute force decryption (try each key) taking 1 sec on DES, takes 149 trillion years for AES


Asymmetric Encryption

Public-key encryption based on each user having two keys: public key – published key used to encrypt data

private key – key known only to individual user used to decrypt data

Must be an encryption scheme that can be made public without making it easy to figure out the decryption scheme Most common is RSA block cipher

Efficient algorithm for testing whether or not a number is prime

No efficient algorithm is know for finding the prime factors of a number


Public key cryptography

plaintextmessage, m

ciphertextencryptionalgorithm

decryption algorithm

Bob’s public key

plaintextmessageK (m)

B+

K B+

Bob’s privatekey

K B-

m = K (K (m))B+

B-


Asymmetric Encryption (Cont.)

Formally, it is computationally infeasible to derive D(kd , N) from E(ke , N), and so E(ke , N) need not be kept secret and can be widely disseminated

E(ke , N) (or just ke) is the public key

D(kd , N) (or just kd) is the private key

N is the product of two large, randomly chosen prime numbers p and q (for example, p and q are 512 bits each)

Encryption algorithm is E(ke , N)(m) = mke mod N, where ke satisfies kekd mod (p−1)(q −1) = 1

The decryption algorithm is then D(kd , N)(c) = ckd mod N


RSA: Choosing keys

1. Choose two large prime numbers p, q. (e.g., 1024 bits each)

2. Compute n = pq, z = (p-1)(q-1)

3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”)

4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 )

5. Public key is (n,e). Private key is (n,d).

K B+ K

B-


RSA: Encryption, decryption

0. Given (n,e) and (n,d) as computed above

1. To encrypt bit pattern, m, compute

c = m mod ne (i.e., remainder when m is divided by n)e

2. To decrypt received bit pattern, c, compute

m = c mod nd (i.e., remainder when c is divided by n)d

m = (m mod n)e mod ndMagic

happens!c


Asymmetric Encryption Example

For example. make p = 7and q = 13

We then calculate N = 7 13 = 91 and (∗ p−1)(q−1) = 72

We next select ke relatively prime to 72 and< 72, yielding 5

Finally,we calculate kd such that kekd mod 72 = 1, yielding 29

We how have our keys

Public key, ke, N = 5, 91

Private key, kd , N = 29, 91

Encrypting the message 69 with the public key results in the cyphertext 62

Cyphertext can be decoded with the private key

Public key can be distributed in cleartext to anyone who wants to communicate with holder of public key


Encryption and Decryption using RSA Asymmetric Cryptography


Cryptography (Cont.)

Note symmetric cryptography based on transformations, asymmetric based on mathematical functions

Asymmetric much more compute intensive

Typically not used for bulk data encryption

Many times a combination is used:

use public key cryptography to share a secret key.

use the secret key to encrypt the bulk of the communication.



Authentication

Constraining set of potential senders of a message

Complementary and sometimes redundant to encryption

Also can prove message unmodified

Algorithm components

A set K of keys

A set M of messages

A set A of authenticators

A function S : K → (M→ A)

That is, for each k K, S(k) is a function for generating authenticators from messages

Both S and S(k) for any k should be efficiently computable functions

A function V : K → (M× A→ {true, false}).

That is, for each k K, V(k) is a function for verifying authenticators on messages

Both V and V(k) for any k should be efficiently computable functions


Authentication (Cont.)

For a message m, a computer can generate an authenticator a A such that V(k)(m, a) = true only if it possesses S(k)

Thus, computer holding S(k) can generate authenticators on messages so that any other computer possessing V(k) can verify them

Computer not holding S(k) cannot generate authenticators on messages that can be verified using V(k)

Since authenticators are generally exposed (for example, they are sent on the network with the messages themselves), it must not be feasible to derive S(k) from the authenticators


Authentication – Hash Functions

Basis of authentication

Creates small, fixed-size block of data (message digest, hash value) from m

Hash Function H must be collision resistant on m

Must be infeasible to find an m’ ≠ m such that H(m) = H(m’)

If H(m) = H(m’), then m = m’

The message has not been modified

Common message-digest functions include

MD5, which produces a 128-bit hash

SHA-1, which outputs a 160-bit hash


Authentication - MAC

Symmetric encryption used in message-authentication code (MAC) authentication algorithm

Simple example:

MAC defines S(k)(m) = f (k, H(m))

Where f is a function that is one-way on its first argument

– k cannot be derived from f (k, H(m))

Because of the collision resistance in the hash function, reasonably assured no other message could create the same MAC

A suitable verification algorithm is V(k)(m, a) ≡ ( f (k,m) = a)

Note that k is needed to compute both S(k) and V(k), so anyone able to compute one can compute the other


Message Authentication Code

m

s(shared secret)

(message)

H(.)H(m+s)

publicInternetappend

m H(m+s)

s

compare

m

H(m+s)

H(.)

H(m+s)

(shared secret)


Authentication – Digital Signature

Based on asymmetric keys and digital signature algorithm

Authenticators produced are digital signatures

In a digital-signature algorithm, computationally infeasible to derive S(ks ) from V(kv)

V is a one-way function

Thus, kv is the public key and ks is the private key

Consider the RSA digital-signature algorithm

Similar to the RSA encryption algorithm, but the key use is reversed

Digital signature of message S(ks )(m) = H(m)ks mod N

The key ks again is a pair d, N, where N is the product of two large, randomly chosen prime numbers p and q

Verification algorithm is V(kv)(m, a) ≡ (akv mod N = H(m))

Where kv satisfies kvks mod (p − 1)(q − 1) = 1

38Principles of Computer Operating Systems8: Network Security 8-38

Digital Signatures

simple digital signature for message m: Bob “signs” m by encrypting with his private key

KB, creating “signed” message, KB(m)--

Dear Alice

Oh, how I have missed you. I think of you all the time! …(blah blah blah)

Bob

Bob’s message, m

public keyencryptionalgorithm

Bob’s privatekey

K B-

Bob’s message, m, signed (encrypted) with his private key

K B-(m)


Digital Signatures

suppose Alice receives msg m, digital signature KB(m)

Alice verifies m signed by Bob by applying Bob’s public key KB to KB(m) then checks KB(KB(m) ) = m.

if KB(KB(m) ) = m, whoever signed m must have used

Bob’s private key.

+ +

-

-

- -

+

Alice thus verifies that:o Bob signed m.o No one else signed m.o Bob signed m and not m’.

non-repudiation: Alice can take m, and signature KB(m) to court and prove that

Bob signed m. -


large messagem

H: hashfunction H(m)

digitalsignature(encrypt)

Bob’s private

key K B-

+

Bob sends digitally signed message:

Alice verifies signature and integrity of digitally signed message:

KB(H(m))-

encrypted msg digest

KB(H(m))-

encrypted msg digest

large messagem

H: hashfunction

H(m)

digitalsignature(decrypt)

H(m)

Bob’s public

key K B+

equal ?

Digital signature = signed MAC


Authentication (Cont.)

Why authentication if a subset of encryption?

Fewer computations (except for RSA digital signatures)

Authenticator usually shorter than message

Sometimes want authentication but not confidentiality

Signed patches et al

Can be basis for non-repudiation


Key Distribution

Delivery of symmetric key is huge challenge

Sometimes done out-of-band

Asymmetric keys can proliferate

stored on key ring

Even asymmetric key distribution needs care

man-in-the-middle attack


Man-in-the-middle Attack on Asymmetric Cryptography


Digital Certificates

Proof of who or what owns a public key

Public key digitally signed a trusted party

Trusted party receives proof of identification from entity and certifies that public key belongs to entity

Certificate authority are trusted party – their public keys included with web browser distributions

They vouch for other authorities via digitally signing their keys, and so on


Certification Authorities

Certification Authority (CA): binds public key to particular entity, E.

E registers its public key with CA. E provides “proof of identity” to CA.

CA creates certificate binding E to its public key.

certificate containing E’s public key digitally signed by CA: CA says “This is E’s public key.”

Bob’s public

key K B+

Bob’s identifying informatio

n

digitalsignature(encrypt)

CA private

key K CA-

K B+

certificate for Bob’s public

key, signed by CA

-K CA(K ) B

+


Certification Authorities

when Alice wants Bob’s public key: gets Bob’s certificate (Bob or elsewhere).

apply CA’s public key to Bob’s certificate, get Bob’s public key

Bob’s public

key K B+

digitalsignature(decrypt)

CA public

key K CA

+

K B+

-K CA(K ) B

+

Documents

Modified from Silberschatz, Galvin and Gagne Lecture 22 Chapter 15: Security