Understanding Cryptography: Key Distribution, Public Key Encryption, and Message Integrity, Slides of Computer Networks

Download Understanding Cryptography: Key Distribution, Public Key Encryption, and Message Integrity and more Slides Computer Networks in PDF only on Docsity!

Computer Networking Technology II

Security

Security in Networks

• Any two nodes (hosts, routers, etc.) might

need to exchange data securely

• Secure email, transfer routing tables, military secrets, private data (SSN, Visa), DNS servers, etc. all need secure communication
• Security has many aspects
• End-point Authentication : If Bob and Carol are communicating, how do they know it’s really Bob and Carol?

Basic Defense Strategy

• In any kind of security approach, we need

to consider three aspects in our strategy

• Prevent : Protect the network to make it harder for an attack to take place
• Detect : How do you know if you’ve been attacked? - Often very difficult in networking
• Mitigate : As or after an attack happens, how do you minimize the damage it did?

Non-network Example

• Consider the problem of a bomb on a plane
  • Prevent: might prevent the problem by 1) scanning luggage and passengers, 2) requiring security checks for airport employees, and 3) controlling access to planes on the ground
  • Detect: detect the problem by 1) a bomb going off, or 2) someone identifying they have a bomb
  • Mitigate: Reduce damage by 1) reducing altitude before the bomb goes off, 2) design the plane to avoid duplicate systems next to each other

Security vs classification

• In discussing security, the notion of

classification (e.g. Confidential, Secret, Top

Secret, etc.) can emerge

• Systems to handle classified material are

known as ‘trusted’ systems – look for that

keyword

• Often based on old standards such as the Rainbow Series’ Orange Book

Passive Intruder

• Going back to Bob and Carol, what happens if someone is listening to their exchange?
• A passive intruder could
  • Eavesdrop – listen to and record the secure exchange
  • Modify, insert, or delete messages that Bob and Carol were trying to exchange
  • Could lead to stealing data, impersonating another user, hijacking a session or causing DoS

Cryptography

• At the receiving end, the cipher text is turned

back into plain text using a decryption

algorithm , K B )

Keys

• A key is a string of characters, numbers, and other ASCII symbols that feeds into the encryption and decryption algorithms
• The longer the key (in bits), the harder it is to break - DES uses a 56-bit key - RC5-64 is a 64-bit key, RC5-72 is 72-bit - RSA and AES use up to 128-bit keys - PGP uses up to 4096-bit keys (great crypto paper)

Block vs Stream

• Another is whether each character is coded

individually ( stream cipher ), or a group of

characters are coded together ( block cipher )

• Stream cipher examples include Caesar’s code, the WWII Enigma machine, and WEP (Wired Equivalent Privacy)
• Block ciphers are very common (AES, RSA, etc.)
  • Block sizes are typically 64 or 128 bits

Cipher-Block Chaining (CBC)

• Repeated phrases, like ‘HTTP/1.1’ produce the

same string when encrypted, making it easier

to guess their meaning

• Send a 64-bit Initialization Vector (IV) first
• Encrypt and send (first block of text XOR IV)
• For each subsequent block, encrypt and send (previous block XOR current clear text)
• This keeps duplicate blocks from appearing

that way

Symmetric Key Crypto

• The Caesar cipher was very simple
• Just move the alphabet down some number of

characters, ‘k’

• A  G (for k = 6)
• Then B  H, C  I, D  J, etc.
• Wrap around when you get to T  Z, U  A
• If you know this is the type of cipher, there

are only 25 different possible keys!

Symmetric Key Crypto

• Improve on this with a monoalphabetic cipher
• Each letter corresponds to some other letter,

but they aren’t in order

• A  V, B  L, C  R, or whatever
• This makes 26! (= 4.03E26 or 4.03x10 26 ) key

combinations in theory, but patterns of

common words make it a lot easier to

break than that would suggest

DES

• The Data Encryption Standard (DES) was invented in 1977, and updated in 1993 - It is symmetric, uses 64-bit blocks, and nominally a 64-bit key - Ok, only 56 bits of the key are usable – the rest is for parity checks 2^56 = 72E15 possible keys
• How DES works is very messy
  • The 64 bits in a block are permuted, go through 16 cycles of math operations, and get permuted again at the end

DES

• Each of the 48-bit

keys (K1 to K16)

are different parts

of the overall

56-bit key