Study with the several resources on Docsity
Earn points by helping other students or get them with a premium plan
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
An overview of various security scenarios and encryption techniques, including secret key encryption, kerberos, public key encryption, and digital signatures. It includes examples of alice and bob's secure communication, authenticated communication with a server, and authenticated communication with public keys. The document also discusses the use of certificates and popular encryption schemes.
Typology: Study notes
1 / 9
This page cannot be seen from the preview
Don't miss anything!
] Questions on laboratory 3 ] Continue scenarios ] Needham-Schroeder ] Brief summary of common algorithms ] Kerberos
Encrypted message: E(K, M) = {M}K
Decrypted message: D(K, E(K, M)) = D(K, {M}K ) = M
It is hard to get M from {M}K without knowing K
Alice and Bob share a secret key KAB. Alice wants to send a secret message M to Bob****.
1. Alice uses KAB and an agreed encryption function E(KAB , M) to encrypt and send message M to Bob. 2. Bob reads the encrypted messages using the corresponding decryption function D(KAB , M).
How can Bob and Alice safely get the shared key KAB?
How can Bob know that M wasn’t a replay_?_
Alice wants to access Bob’s files on a local file server. Sara is a trusted authentication server that holds passwords and current secret keys.
1. Alice sends a message to Sara asking for a ticket to access Bob 2. Sara sends Alice a response encrypted with KA that is a ticket encrypted with KB and a new secret key KAB for communication:
{{ticket}KB , KAB } (^) KA
3. Alice decrypts response with KA 4. Alice sends ticket, her ID and request R to Bob: {ticket}KB, Alice, R 5. Bob decrypts ticket using KB (the ticket was {KAB, Alice} (^) KB )
This is the simplified scenario for Kerberos. KAB is the session key.
Alice wants to sign document M so that any recipient can verify it came from Alice. This assumes that Alice has a private-public key pair. A digest is like a checksum.
1. Alice computes a fixed-length digest Digest(M).
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. Alice’s bank account certificate
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. Public-key certificate for Bob’s Bank
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. X509 Certificate format
Subject (^) Distinguished Name, Public Key Issuer Distinguished Name, Signature Period of validity Not Before Date, Not After Date Administrative information Version, Serial Number Extended Information
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. Performance of encryption and secure digest algorithms
Key size/hash size (bits)
Extrapolated speed (kbytes/sec.)
PRB optimized (kbytes/s)
TEA 128 700 - DES 56 350 7746 Triple-DES 112 120 2842 IDEA 128 700 4469 RSA 512 7 - RSA 2048 1 - MD5 128 1740 62425 SHA 160 750 25162
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. The Needham–Schroeder secret-key authentication protocol
Header Message Notes
S returns a message encrypted in A’s secret key, containing a newly generated key KAB and a ‘ticket’ encrypted in B’s secret key. The nonce NA demonstrates that the message was sent in response to the preceding one. A believes that S sent the message because only S knows A’s secret key.
{ KAB, A } K B { NB } K (^) AB { NB - 1} K AB
] Follows Needham and Schroeder very closely
] Uses time values as nonces
] When user logs in, the login program sends user’s name to the kerberos authentication server
] If user is known, server replies with a session key and a nonce encrypted in the user’s password and a ticket for TGS
] After login program authenticates the information, it can erase the user’s password from memory
Instructor’s Guide for Coulouris, Dollimore and Kindberg© Addison-Wesley Publishers 2000 Distributed Systems: Concepts and Design Edn. 3
Figure 7. System architecture of Kerberos
Client Server DoOperation
Authenticationdatabase
Login session setup
grantingTicket- service T
Kerberos Key Distribution Centre
session setupServer
Authen-tication
functionService
Step B
Step A
Step C
C (^) S
