Network Security. Information secrecy-only specified parties know the information exchanged. Provided by criptography. Information integrity-the information.

Network Security

Network Security

• Information secrecy-only specified parties know the information exchanged. Provided by criptography.

• Information integrity-the information is unaltered received by the specified party. Provided by digital signatures.

• Authenticaton-user is communicating with the user with whom he/she thinks is communicating.

Cryptography

The encryption model (for a symmetric-key cipher).

Symmetric-Key Algorithms

• Transmitting and receiving users have the same key that they agreed on somehow.

• Plain text, P, is encrypted by the transmitting user based on key, K, and becomes EK(P). Receiver is decrypting EK(P) using the same key, and obtains plaintext P=DK(EK(P)). Function P is impossible (or very hard) to guess from EK(P).

• DES – Data Encryption Standard– Key has 64 bits

• AES – Advanced Encryption Standard– Key has 128 bits

Public-Key Algorithms

• Each user has a public and a private key.

• Plain text, P, is encrypted by the transmitting user based on the public key of the receiving user, Bpub, and becomes EBpub(P).

• Receiving user is decrypting the message using its private key Bpri and obtains plaintext P=DBpri(EBpub(P)).

Public-Key Algorithms

• RSA (Rivest,Shamir, Adleman)

1. Choose two large prime numbers p and q (typically 1024 bits)

2. Compute n=pxq and z=(p-1)x(q-1)

3. Choose a number relatively prime to z and call it d.

4. Find e such that exd=1mod z

5. Public key is (n,e), private key is (n,d)

6. Encryption is C=Pemod n

7. Decryption is P=Cd mod n

Learning Shared Keys

• Encryption using a symmetric shared key is much faster. Users can exchange the shared key, either by using public keys or key distribution centers (KDC).

• Transmitting user encrypts the shared-key using public key of the receiving user. Receiving user decrypts the message and learns the shared key.

• KDC has a key for each user. User A sends encrypted request that it wants to communicate with user B. KDC sends the shared key, S, and encrypted pair EB(A,S).

Digital Signatures

• Ensure to the receiving party that it is receive the exact information that was sent my the transmitting party.

• For example, transmitting user adds to the plaintext the signature which is the encrypted plaintext using its private key. Receiving user decrypts the signature using the public key of the transmitting user, and compares with the plaintext.

Public-Key Signatures

Digital signatures using public-key cryptography.

,P ,P,P)

P

Digital Signatures Using Message Digests (MD5,SHA-1)

• Forming the signature by encrypting the entire plaintext is time consuming, and incurs an inefficient communication.

• For this reason, a message digest is derived from the plaintext (message). Message digest is a function of the plaintext such that it is computationaly infeasible to find two messages with the same message digest (hash). Singature is encrypted hash.

• Since the message digest is much shorter than the message itself, the signature takes less time to compute and less bandwidth to transfer.

Authentication Protocol(Shared Key)

• User A sends to user B “I am A”, and nonce RA.

• B sends a nonce RB and HASH(RA,RB,A,B,S) to A.

• A sends HASH(RA,RB,S) and sends it to B

Authentication Protocol(Public Key)

• User A sends to user B “I am A”, and RA.

• B sends a nonce RB and EBpriv(RA,RB,A,B) to A.

• A decrypts encrypted part of the message to check if it is B and sends encrypted nonces using its private key EApriv(RA,RB) and sends it to B.

• B decrypts encrypted message and checks if this is really A.

Management of Public Keys

• How users learn real public keys of other users.

• Certificate comprises the public key and basic data about some user, and is signed by the certificate authority (CA).

• X.509 defines certificate’s format.

• Public key infrastructures comprises CAs that are organized hierarchicaly.

Certificates

A possible certificate and its signed hash.

+ Alg for hashing,Certificate Authority,

Time validity

Public-Key Infrastructures

(a) A hierarchical PKI. (b) A chain of certificates.

Network Security in Practice

• IPsec• Firewalls• Virtual Private Networks (VPNs)• E-mail security (Pretty Good

Privacy-PGP)• DNS security• WWW security (Secure Sockets

Layer-SSL)

IPsec based onAuthentication Header Protocol

The IPsec authentication header in transport mode for IPv4.

Determines security association with IP source address and security protocol

Using encrypted message disgest based on a shared key

IPsec based onEncapsulation Security Payload Protocol

(a) ESP in transport mode. (b) ESP in tunnel mode.

Firewalls

• Two types: packet filtering, and application gateways.

• Packet filtering is done based on IP addresses, TCP or UDP ports, ICMP message type, TCP SYN or ACK bits (first segment has ACK=0 so this prevents outside users to open TCP connections with inside servers).

• Application gateways may restrict certain applications to certain users.

Virtual Private Networks

(a) A leased-line private network. (b) A virtual private network.

E-mail SecurityPGP – Pretty Good Privacy

PGP in operation for sending a message.

International DataEncryption Alg

Secure DNS

An example RRSet for bob.com. The KEY record is Bob's public key. The SIG record is the top-level com server's signed hash of A and KEY records to verify their authenticity.

SSL

A simplified version of the SSL connection establishment subprotocol.