Overview of Basic Security Properties and Cryptography Fundamentals
Security
COS 518:
Advanced Computer Systems
Lecture 17
Michael Freedman
•
C
o
n
f
i
d
e
n
t
i
a
l
i
t
y
:
C
o
n
c
e
a
l
m
e
n
t
o
f
i
n
f
o
r
m
a
t
i
o
n
o
r
r
e
s
o
u
r
c
e
s
•
A
u
t
h
e
n
t
i
c
i
t
y
:
I
d
e
n
t
i
f
i
c
a
t
i
o
n
a
n
d
a
s
s
u
r
a
n
c
e
o
f
o
r
i
g
i
n
o
f
i
n
f
o
•
I
n
t
e
g
r
i
t
y
:
T
r
u
s
t
w
o
r
t
h
i
n
e
s
s
o
f
d
a
t
a
o
r
r
e
s
o
u
r
c
e
s
i
n
t
e
r
m
s
o
f
p
r
e
v
e
n
t
i
n
g
i
m
p
r
o
p
e
r
a
n
d
u
n
a
u
t
h
o
r
i
z
e
d
c
h
a
n
g
e
s
•
A
v
a
i
l
a
b
i
l
i
t
y
:
A
b
i
l
i
t
y
t
o
u
s
e
d
e
s
i
r
e
d
i
n
f
o
o
r
r
e
s
o
u
r
c
e
•
N
o
n
-
r
e
p
u
d
i
a
t
i
o
n
:
O
f
f
e
r
o
f
e
v
i
d
e
n
c
e
t
h
a
t
a
p
a
r
t
y
i
n
d
e
e
d
i
s
s
e
n
d
e
r
o
r
a
r
e
c
e
i
v
e
r
o
f
c
e
r
t
a
i
n
i
n
f
o
r
m
a
t
i
o
n
•
A
c
c
e
s
s
c
o
n
t
r
o
l
:
F
a
c
i
l
i
t
i
e
s
t
o
d
e
t
e
r
m
i
n
e
a
n
d
e
n
f
o
r
c
e
w
h
o
i
s
a
l
l
o
w
e
d
a
c
c
e
s
s
t
o
w
h
a
t
r
e
s
o
u
r
c
e
s
(
h
o
s
t
,
s
o
f
t
w
a
r
e
,
n
e
t
w
o
r
k
)
2
B
a
s
i
c
s
e
c
u
r
i
t
y
p
r
o
p
e
r
t
i
e
s
I
n
t
r
o
t
o
c
r
y
p
t
o
i
n
1
5
m
i
n
u
t
e
s
3
4
•
From Greek, meaning
“
secret writing
”
•
Confidentiality: encrypt data to hide content
•
Include “signature” or “message authentication code”
–
Integrity: Message has not been modified
–
Authentication: Identify source of message
•
Modern encryption:
–
Algorithm
public,
key
secret and provides security
–
Symmetric (shared secret) or asymmetric (public-private key)
W
h
a
t
i
s
C
r
y
p
t
o
g
r
a
p
h
y
?
5
S
y
m
m
e
t
r
i
c
(
S
e
c
r
e
t
K
e
y
)
C
r
y
p
t
o
•
Sender and recipient share common key
–
M
a
i
n
c
h
a
l
l
e
n
g
e
:
H
o
w
t
o
d
i
s
t
r
i
b
u
t
e
t
h
e
k
e
y
?
•
Provides dual use:
–
Confidentiality (encryption)
–
Message authentication + integrity (MAC)
•
1000x more computationally efficient than asymmetric
6
S
y
m
m
e
t
r
i
c
C
i
p
h
e
r
M
o
d
e
l
P
u
b
l
i
c
-
K
e
y
C
r
y
p
t
o
g
r
a
p
h
y
•
E
a
c
h
p
a
r
t
y
h
a
s
(
p
u
b
l
i
c
k
e
y
,
p
r
i
v
a
t
e
k
e
y
)
•
A
l
i
c
e
’
s
p
u
b
l
i
c
k
e
y
P
K
–
Known by anybody
–
Bob uses PK to encrypt messages
to
Alice
–
Bob uses PK to verify signatures
from
Alice
•
A
l
i
c
e
’
s
p
r
i
v
a
t
e
/
s
e
c
r
e
t
k
e
y
:
s
k
–
Known only by Alice
–
Alice uses sk to decrypt ciphertexts sent to her
–
Alice uses sk to generate new signatures on messages
7
P
u
b
l
i
c
-
K
e
y
C
r
y
p
t
o
g
r
a
p
h
y
•
(PK, sk) = generateKey(keysize)
•
E
n
c
r
y
p
t
i
o
n
A
P
I
–
ciphertext = encrypt (message, PK)
–
message = decrypt (ciphertext, sk)
•
D
i
g
i
t
a
l
s
i
g
n
a
t
u
r
e
s
A
P
I
–
Signature = sign (message, sk)
–
isValid = verify (signature, message, PK)
8
(
S
i
m
p
l
e
)
R
S
A
A
l
g
o
r
i
t
h
m
•
Generating a key:
–
G
e
n
e
r
a
t
e
c
o
m
p
o
s
i
t
e
n
=
p
*
q
,
w
h
e
r
e
p
a
n
d
q
a
r
e
s
e
c
r
e
t
p
r
i
m
e
s
–
P
i
c
k
p
u
b
l
i
c
e
x
p
o
n
e
n
t
e
–
S
o
l
v
e
f
o
r
s
e
c
r
e
t
e
x
p
o
n
e
n
t
d
i
n
d
⋅
e
≡
1
(
m
o
d
(
p
-
1
)
(
q
–
1
)
)
–
Public key = (e, n), private key = d
•
Encrypting message m:
c = m
e
mod n
•
Decrypting ciphertext c:
m = c
d
mod n
•
S
e
c
u
r
i
t
y
d
u
e
t
o
c
o
s
t
o
f
f
a
c
t
o
r
i
n
g
l
a
r
g
e
n
u
m
b
e
r
s
–
F
i
n
d
i
n
g
(
p
,
q
)
g
i
v
e
n
n
t
a
k
e
s
O
(
e
l
o
g
n
l
o
g
l
o
g
n
)
o
p
e
r
a
t
i
o
n
s
–
n chosen to be 2048 or 4096 bits long
9
C
r
y
p
t
o
g
r
a
p
h
i
c
h
a
s
h
f
u
n
c
t
i
o
n
( and using them in systems )
10
10
11
11
C
r
y
p
t
o
g
r
a
p
h
y
H
a
s
h
F
u
n
c
t
i
o
n
s
I
•
Take message
m
of arbitrary length and produces
fixed-size (short) number
H(m)
•
One-way function
–
Efficient: Easy to compute
H(m)
–
H
i
d
i
n
g
p
r
o
p
e
r
t
y
:
H
a
r
d
t
o
f
i
n
d
a
n
m
,
g
i
v
e
n
H
(
m
)
•
Assumes “m” has sufficient entropy, not just {“heads”, “tails”}–
R
a
n
d
o
m
:
O
f
t
e
n
a
s
s
u
m
e
s
f
o
r
o
u
t
p
u
t
t
o
“
l
o
o
k
”
r
a
n
d
o
m
12
12
C
r
y
p
t
o
g
r
a
p
h
y
H
a
s
h
F
u
n
c
t
i
o
n
s
I
I
•
Collisions exist: | possible inputs | >> | possible outputs |
… but hard to find
•
Collision resistance:
–
Strong resistance:
Find any m != m
’
such that H(m) == H(m’)
–
Weak resistance:
Given m, find m’
such that H(m) == H(m’)
–
For 160-bit hash (SHA-1)
•
Finding any collision is birthday paradox: 2^{160/2} = 2^80•
Finding specific collision requires 2^160
13
13
H
a
s
h
P
o
i
n
t
e
r
s
h
=
H
(
)
(
d
a
t
a
)
14
14
S
e
l
f
-
c
e
r
t
i
f
y
i
n
g
n
a
m
e
s
F
n
a
m
e
=
H
(
)
•
P2P file sharing software (e.g., Limewire)
–
File named by
F
name
= H (data)
–
Participants verify that
H (downloaded) == F
name
(
d
a
t
a
)
15
15
S
e
l
f
-
c
e
r
t
i
f
y
i
n
g
n
a
m
e
s
•
BitTorrent
–
Large file split into smaller chunks (~256KB each)
–
Torrent file specifies the name/hash of each chunk
–
Participants verify that
H (downloaded) == C
name
–
Security relies on getting torrent file from trustworthy source
c
h
u
n
k
c
h
u
n
k
c
h
u
n
k
c
h
u
n
k
c
h
u
n
k
Creates a “tamper-evident” log of data
16
16
H
a
s
h
c
h
a
i
n
s
d
a
t
a
p
r
e
v
:
H
(
)
d
a
t
a
p
r
e
v
:
H
(
)
d
a
t
a
p
r
e
v
:
H
(
)
H
(
)
If data changes, all subsequent hash pointers change
Otherwise, found a hash collision!
17
17
H
a
s
h
c
h
a
i
n
s
d
a
t
a
p
r
e
v
:
H
(
)
d
a
t
a
p
r
e
v
:
H
(
)
d
a
t
a
p
r
e
v
:
H
(
)
H
(
)
S
e
c
u
r
i
t
y
m
o
r
e
b
r
o
a
d
l
y
18
18
F
o
r
t
u
n
e
f
a
v
o
r
s
t
h
e
a
t
t
a
c
k
e
r
•
Cost asymmetry
–
Defense must protect everything
–
Offense must find just one hole
•
“Security” is a negative goal: hard to achieve
–
Policy: desired goal
–
Threat model: assumptions about what can go
wrong
19
19
W
a
y
s
t
o
a
t
t
a
c
k
g
r
a
d
e
s
.
t
x
t
•
Change permissions on grades.txt to get access
•
Access disk blocks directly
•
Access grades.txt via www.cs.princeton.edu
•
Reuse memory after Mike’s text editor exits, read data
•
Read backup copy of grades.txt from Mike’s text editor
•
Intercept network packets to file server storing grades.txt
•
Send Mike a trojaned text editor that emails out the file
•
Steal disk from file server storing grades.txt
•
Get discarded printout of grades.txt from the trash
•
Call sysadmin, pretend to be Mike, reset his password
•
...
20
20
Example from MIT 6.033
p
a
y
m
a
x
x
.
c
o
m
(
2
0
0
5
)
•
https://my.paymaxx.com/
–
Requires username and password
–
If you authenticate, provides menu of options
–
One option is to get a PDF of your W2 tax form
•
https://my.paymaxx.com/get-w2.cgi?id=1234
–
Gets a PDF of W2 tax form for ID 1234
–
get-w2.cgi forgot to check authorization
•
Attacker manually constructs URLs to fetch all data
21
21
Example from MIT 6.033
T
h
i
n
k
i
n
g
a
b
o
u
t
t
h
r
e
a
t
m
o
d
e
l
s
…
22
22
23
23
•
Can’
t store passwords in a file that could be read
–
Concerned with insider attacks / break-ins
•
Must compare typed passwords to stored passwords
–
Does
H (input) == H (password)
?
•
Memory cheap: build table of all likely password hashes?
E
x
a
m
p
l
e
:
P
a
s
s
w
o
r
d
s
P
a
s
s
w
o
r
d
s
t
a
t
s
(
l
e
a
k
e
d
3
2
M
p
a
s
s
w
o
r
d
s
,
2
0
0
9
)
•
5,000 unique passwords account for 20% users (6.4M)
•
Similar statistics in Gawker breakin, 2010
24
24
25
25
•
Can’
t store passwords in a file that could be read
–
Concerned with insider attacks / break-ins
•
Must compare typed passwords to stored passwords
–
Does
H (input) == H (password)
?
•
Memory cheap: build table of all likely password hashes?
–
Use “salt”
to compute
h = H (password || salt)
–
Store salt as plaintext in password file, not a secret
–
Then check whether
H (input, salt) == h
E
x
a
m
p
l
e
:
P
a
s
s
w
o
r
d
s
A
t
t
a
c
k
i
n
g
s
p
e
c
i
f
i
c
a
c
c
o
u
n
t
s
•
“Tar pit” connections
–
Failed logins take 2-3 seconds to respond
–
...but can just retry within 100s of ms
–
...or launch attack from many bots concurrently
•
Max number of failed connections
–
“Lock” account and require additional information
•
Two-factor auth
–
“What you have” + “what you know”
26
26
H
T
T
P
S
e
c
u
r
i
t
y
27
27
“
S
e
c
u
r
i
n
g
”
H
T
T
P
•
Threat model
–
Eavesdropper listening on conversation (confidentiality)
–
Man-in-the-middle modifying content (integrity)
–
Adversary impersonating desired website (authentication, and
confidentiality)
•
Enter HTTP-S
–
HTTP sits on top of secure channel (SSL/TLS)
–
All (HTTP) bytes written to secure channel are encrypted and
authenticated
–
Problem:
What is actually authenticated to prevent
impersonation? Which keys used for crypto protocols?
28
28
L
e
a
r
n
i
n
g
a
v
a
l
i
d
p
u
b
l
i
c
k
e
y
•
What is that lock?
–
Securely binds domain name to public key (PK)
•
Believable only if you trust the attesting body
•
Bootstrapping problem: Who to trust, and how to tell if
this message is actually from them?
–
If PK is authenticated, then any message signed
by PK cannot be forged by non-authorized party
29
29
H
o
w
t
o
a
u
t
h
e
n
t
i
c
a
t
e
P
K
30
30
T
r
a
n
s
p
o
r
t
L
a
y
e
r
S
e
c
u
r
i
t
y
(
T
L
S
)
(
E
n
h
a
n
c
e
s
/
R
e
p
l
a
c
e
s
S
S
L
)
•
Send new random value,
list of supported ciphers
•
Send pre-secret, encrypted
under PK
•
Create shared secret key
from pre-secret and random
•
Switch to new symmetric-
key cipher using shared key
•
Send new random value,
digital certificate with PK
•
Create shared secret key
from pre-secret and random
•
Switch to new symmetric-
key cipher using shared key
31
31
C
o
m
m
e
n
t
s
o
n
H
T
T
P
S
•
Note that HTTPS authenticates server, not content
•
Switch to symmetric-key crypto after public-key ops
–
Symmetric-key crypto much faster (100-1000x)
–
PK crypto can encrypt message only approx. as large as key
(2048 bits – this is a simplification) – afterwards uses hybrid
•
HTTPS on top of TCP, so reliable byte stream
–
Can leverage fact that transmission is reliable to ensure: each
data segment received exactly once
–
Adversary can
’
t successfully drop or replay packets
32
32
•
Browse/OS vendors pick which CAs to trust
–
Sometimes they revoke this trust – e.g. DigiNotar.
•
No notion of CAs having authority over only given TLD
•
T
rust the {Iranian, Chinese, US} national authorities?•
What standards does Apple use to pick root certs?
Google? MSFT?
–
There’s a restraint-of-trade issue here. Can’t enter the
CA business without vendor support…
33
33
T
h
e
t
r
o
u
b
l
e
w
i
t
h
C
A
s
D
N
S
S
e
c
u
r
i
t
y
34
34
35
com
edu
org
ac
uk
zw
arpa
unnamed
root
bar
west
east
foo
my
ac
cam
usr
in-
addr
12
34
56
generic domains
country domains
my.east.bar.edu
usr.cam.ac.uk
12.34.56.0/24
H
i
e
r
a
r
c
h
i
c
a
l
n
a
m
i
n
g
i
n
D
N
S
•
If domain name doesn
’
t exist, DNS should return
NXDOMAIN (non-existant domain) msg
•
Verisign instead creates wildcard DNS record for all
.com
and
.net
domain names not yet registered
–
September 15 – October 4, 2003
•
Redirection for these domain names to Verisign web
portal:
“
to help you search
”
–
and serve you ads…and get
“
sponsored
”
search
–
Verisign and online advertising companies make money…
36
36
D
N
S
I
n
t
e
g
r
i
t
y
:
T
r
u
s
t
t
h
e
T
L
D
o
p
e
r
a
t
o
r
s
?
D
N
S
I
n
t
e
g
r
i
t
y
:
A
n
s
w
e
r
f
r
o
m
a
u
t
h
o
r
i
t
a
t
i
v
e
s
e
r
v
e
r
?
•
DNS cache poisoning
–
Client asks for www.evil.com
–
Nameserver authoritative for www.evil.com returns
additional section for (www.cnn.com, 1.2.3.4, A)
–
Thanks! I won
’
t bother check what I asked for
37
•
To prevent cache poisoning, client remembers domain
and 16-bit request ID (used to demux UDP response)
•
But…DNS hijacking attack:
-
16 bits: 65K possible IDs
-
What rate to enumerate all in 1 sec? 64B/packet
-
64*65536*8 / 1024 / 1024 = 32 Mbps
-
Prevention: Also randomize the DNS source port
-
Windows DNS alloc
’
s 2500 DNS ports: ~164M possible IDs
-
Would require 80 Gbps
-
Kaminsky attack: this source port…wasn
’
t random after all
38
38
D
N
S
I
n
t
e
g
r
i
t
y
:
A
n
s
w
e
r
f
r
o
m
a
u
t
h
o
r
i
t
a
t
i
v
e
s
e
r
v
e
r
?
L
e
t
’
s
s
t
r
o
n
g
l
y
b
e
l
i
e
v
e
t
h
e
a
n
s
w
e
r
!
E
n
t
e
r
D
N
S
S
E
C
•
DNSSEC protects against data spoofing and
corruption
•
DNSSEC also provides mechanisms to
authenticate servers and requests
•
DNSSEC provides mechanisms to establish
authenticity and integrity
39
39
•
The DNS servers sign the hash of resource record set
with its private (signature) keys
•
Public keys can be used to verify the SIGs
•
Leverages hierarchy:
–
Authenticity of nameserver’s public keys is established by a
signature over the keys by the parent’s private key
–
In ideal case, only roots’ public keys need to be distributed out-
of-band
40
40
P
K
-
D
N
S
S
E
C
(
P
u
b
l
i
c
K
e
y
)
stub
resolver
Question: www.cnn.com ?
www.cnn.com A ?
resolver
.
(root)
www.cnn.com A ?
ask .com server
SIG (ip addr and PK of .com server)
.
com
www.cnn.com A ?
ask cnn.com server
SIG (ip addr and PK of cnn.com server)
cnn.com
www.cnn.com A ?
SIG (xxx.xxx.xxx.xxx)
xxx.xxx.xxx.xxx
add to cache
src.cs.princeton.edu
dns.cs.princeton.edu
transaction
signatures
slave servers
transaction
signatures
41
V
e
r
i
f
y
i
n
g
t
h
e
t
r
e
e
This content provides an introduction to basic security properties such as confidentiality, authenticity, integrity, availability, non-repudiation, and access control. It also covers the fundamentals of cryptography, including symmetric and asymmetric encryption, public-key cryptography, and the importance of key distribution. The material discusses how cryptography ensures data confidentiality, message integrity, authentication, and more in computer systems.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Security COS 518: Advanced Computer Systems Lecture 17 Michael Freedman
Basic security properties Confidentiality: Concealment of information or resources Authenticity: Identification and assurance of origin of info Integrity: Trustworthiness of data or resources in terms of preventing improper and unauthorized changes Availability: Ability to use desired info or resource Non-repudiation: Offer of evidence that a party indeed is sender or a receiver of certain information Access control: Facilities to determine and enforce who is allowed access to what resources (host, software, network) 2
What is Cryptography? From Greek, meaning secret writing Confidentiality: encrypt data to hide content Include signature or message authentication code Integrity: Message has not been modified Authentication: Identify source of message encryption decryption ciphertext plaintext plaintext Modern encryption: Algorithm public, key secret and provides security Symmetric (shared secret) or asymmetric (public-private key) 4
Symmetric (Secret Key) Crypto Sender and recipient share common key Main challenge: How to distribute the key? Provides dual use: Confidentiality (encryption) Message authentication + integrity (MAC) 1000x more computationally efficient than asymmetric 5
Public-Key Cryptography Each party has (public key, private key) Alice s public key PK Known by anybody Bob uses PK to encrypt messages to Alice Bob uses PK to verify signatures from Alice Alice s private/secret key: sk Known only by Alice Alice uses sk to decrypt ciphertexts sent to her Alice uses sk to generate new signatures on messages 7
Public-Key Cryptography (PK, sk) = generateKey(keysize) Encryption API ciphertext = encrypt (message, PK) message = decrypt (ciphertext, sk) Digital signatures API Signature = sign (message, sk) isValid = verify (signature, message, PK) 8
(Simple) RSA Algorithm Generating a key: Generate composite n = p * q, where p and q are secret primes Pick public exponent e Solve for secret exponent d in d e 1 (mod (p -1) (q 1)) Public key = (e, n), private key = d Encrypting message m: c = me mod n Decrypting ciphertext c: m = cd mod n Security due to cost of factoring large numbers Finding (p,q) given n takes O(e log n log log n) operations n chosen to be 2048 or 4096 bits long 9
Cryptographic hash function ( and using them in systems ) 10
Cryptography Hash Functions I Take message m of arbitrary length and produces fixed-size (short) number H(m) One-way function Efficient: Easy to compute H(m) Hiding property: Hard to find an m, given H(m) Assumes m has sufficient entropy, not just { heads , tails } Random: Often assumes for output to look random 11
Cryptography Hash Functions II Collisions exist: | possible inputs | >> | possible outputs | but hard to find Collision resistance: Strong resistance: Find any m != m such that H(m) == H(m ) Weak resistance: Given m, find m such that H(m) == H(m ) For 160-bit hash (SHA-1) Finding any collision is birthday paradox: 2^{160/2} = 2^80 Finding specific collision requires 2^160 12
Hash Pointers h = H( ) (data) 13
Self-certifying names Fname = H( ) (data) P2P file sharing software (e.g., Limewire) File named by Fname = H (data) Participants verify that H (downloaded) == Fname 14
Self-certifying names Cname = H( ) H( ) H( ) H( ) H( ) chunk chunk chunk chunk chunk BitTorrent Large file split into smaller chunks (~256KB each) Torrent file specifies the name/hash of each chunk Participants verify that H (downloaded) == Cname Security relies on getting torrent file from trustworthy source 15
Hash chains H( ) prev: H( ) prev: H( ) prev: H( ) data data data Creates a tamper-evident log of data 16
Hash chains H( ) prev: H( ) prev: H( ) prev: H( ) data data data If data changes, all subsequent hash pointers change Otherwise, found a hash collision! 17
Fortune favors the attacker Cost asymmetry Defense must protect everything Offense must find just one hole Security is a negative goal: hard to achieve Policy: desired goal Threat model: assumptions about what can go wrong 19
Ways to attack grades.txt Change permissions on grades.txt to get access Access disk blocks directly Access grades.txt via www.cs.princeton.edu Reuse memory after Mike s text editor exits, read data Read backup copy of grades.txt from Mike s text editor Intercept network packets to file server storing grades.txt Send Mike a trojaned text editor that emails out the file Steal disk from file server storing grades.txt Get discarded printout of grades.txt from the trash Call sysadmin, pretend to be Mike, reset his password ... 20 Example from MIT 6.033
paymaxx.com (2005) https://my.paymaxx.com/ Requires username and password If you authenticate, provides menu of options One option is to get a PDF of your W2 tax form https://my.paymaxx.com/get-w2.cgi?id=1234 Gets a PDF of W2 tax form for ID 1234 get-w2.cgi forgot to check authorization Attacker manually constructs URLs to fetch all data 21 Example from MIT 6.033
Example: Passwords Can t store passwords in a file that could be read Concerned with insider attacks / break-ins Must compare typed passwords to stored passwords Does H (input) == H (password) ? Memory cheap: build table of all likely password hashes? 23
Password stats (leaked 32M passwords, 2009) 5,000 unique passwords account for 20% users (6.4M) Similar statistics in Gawker breakin, 2010 24
Example: Passwords Can t store passwords in a file that could be read Concerned with insider attacks / break-ins Must compare typed passwords to stored passwords Does H (input) == H (password) ? Memory cheap: build table of all likely password hashes? Use salt to compute h = H (password || salt) Store salt as plaintext in password file, not a secret Then check whether H (input, salt) == h 25
Attacking specific accounts Tar pit connections Failed logins take 2-3 seconds to respond ...but can just retry within 100s of ms ...or launch attack from many bots concurrently Max number of failed connections Lock account and require additional information Two-factor auth What you have + what you know 26
Securing HTTP Threat model Eavesdropper listening on conversation (confidentiality) Man-in-the-middle modifying content (integrity) Adversary impersonating desired website (authentication, and confidentiality) Enter HTTP-S HTTP sits on top of secure channel (SSL/TLS) All (HTTP) bytes written to secure channel are encrypted and authenticated Problem: What is actually authenticated to prevent impersonation? Which keys used for crypto protocols? 28
Learning a valid public key What is that lock? Securely binds domain name to public key (PK) Believable only if you trust the attesting body Bootstrapping problem: Who to trust, and how to tell if this message is actually from them? If PK is authenticated, then any message signed by PK cannot be forged by non-authorized party 29
Transport Layer Security (TLS) (Enhances/Replaces SSL) Send new random value, list of supported ciphers Send new random value, digital certificate with PK Send pre-secret, encrypted under PK Create shared secret key from pre-secret and random Switch to new symmetric- key cipher using shared key Create shared secret key from pre-secret and random Switch to new symmetric- key cipher using shared key 31
Comments on HTTPS Note that HTTPS authenticates server, not content Switch to symmetric-key crypto after public-key ops Symmetric-key crypto much faster (100-1000x) PK crypto can encrypt message only approx. as large as key (2048 bits this is a simplification) afterwards uses hybrid HTTPS on top of TCP, so reliable byte stream Can leverage fact that transmission is reliable to ensure: each data segment received exactly once Adversary can t successfully drop or replay packets 32
The trouble with CAs Browse/OS vendors pick which CAs to trust Sometimes they revoke this trust e.g. DigiNotar. No notion of CAs having authority over only given TLD Trust the {Iranian, Chinese, US} national authorities? What standards does Apple use to pick root certs? Google? MSFT? There s a restraint-of-trade issue here. Can t enter the CA business without vendor support 33
DNS Security 34
Hierarchical naming in DNS unnamed root zw arpa uk com edu org ac generic domains country domains in- addr bar ac west east 12 cam foo my 34 usr my.east.bar.edu usr.cam.ac.uk 56 12.34.56.0/24 35
DNS Integrity: Trust the TLD operators? If domain name doesn t exist, DNS should return NXDOMAIN (non-existant domain) msg Verisign instead creates wildcard DNS record for all .com and .net domain names not yet registered September 15 October 4, 2003 Redirection for these domain names to Verisign web portal: to help you search and serve you ads and get sponsored search Verisign and online advertising companies make money 36
DNS Integrity: Answer from authoritative server? DNS cache poisoning Client asks for www.evil.com Nameserver authoritative for www.evil.com returns additional section for (www.cnn.com, 1.2.3.4, A) Thanks! I won t bother check what I asked for 37
DNS Integrity: Answer from authoritative server? To prevent cache poisoning, client remembers domain and 16-bit request ID (used to demux UDP response) But DNS hijacking attack: - 16 bits: 65K possible IDs - What rate to enumerate all in 1 sec? 64B/packet - 64*65536*8 / 1024 / 1024 = 32 Mbps - Prevention: Also randomize the DNS source port - Windows DNS alloc s 2500 DNS ports: ~164M possible IDs - Would require 80 Gbps - Kaminsky attack: this source port wasn t random after all 38
Lets strongly believe the answer! Enter DNSSEC DNSSEC protects against data spoofing and corruption DNSSEC also provides mechanisms to authenticate servers and requests DNSSEC provides mechanisms to establish authenticity and integrity 39
PK-DNSSEC (Public Key) The DNS servers sign the hash of resource record set with its private (signature) keys Public keys can be used to verify the SIGs Leverages hierarchy: Authenticity of nameserver s public keys is established by a signature over the keys by the parent s private key In ideal case, only roots public keys need to be distributed out- of-band 40
Verifying the tree Question: www.cnn.com ? . (root) dns.cs.princeton.edu src.cs.princeton.edu ask .com server SIG (ip addr and PK of .com server) www.cnn.com A ? stub resolver resolver xxx.xxx.xxx.xxx www.cnn.com A ? .com transaction signatures ask cnn.com server SIG (ip addr and PK of cnn.com server) add to cache slave servers transaction signatures cnn.com 41
