ET4085/ET5085 Keamanan Jaringan Telekomunikasi ET4085/ET5085 Telecommunication Network Security

http://wp.me/P29YQz-k

1

TUTUN JUHANA TELECOMMUNICAT ION ENGINEERING

SCHOOL OF ELECTRICAL ENGINEERING & INFORMATIC SINST ITUT TEKNOLOGI BANDUNG

ht tp : / / t e l ecommun icat ion . i tb .ac . id /~tu tun /ET4085

ET4085/ET5085 Keamanan Jaringan Telekomunikasi

ET4085/ET5085 Telecommunication Network Security

http://wp.me/P29YQz-k

2

Cryptography

http://wp.me/P29YQz-k

3

Definition

Came from Greek cryptography krupto (hidden or secret) and grafh (written)Art of secret

writing

http://wp.me/P29YQz-k

4

Services Provided by Cryptography

User Authentication

http://wp.me/P29YQz-k

5

Data Authentication Data integrity

Data Integrity

http://wp.me/P29YQz-k

6

Data origin authentication

A B

He can claim that he is A

http://wp.me/P29YQz-k

7

Non-repudiation of origin

http://wp.me/P29YQz-k

8

Data confidentiality

?

http://wp.me/P29YQz-k

9

Friends and enemies: Alice, Bob, Trudy

well-known in network security world Bob, Alice (lovers!) want to communicate

“securely”Trudy (intruder) may intercept, delete, add

messages

http://wp.me/P29YQz-k

10

Who might Bob, Alice be?

Real-life Bobs and Alices!Web browser/server for electronic

transactions (e.g., on-line purchases)on-line banking client/serverDNS serversrouters exchanging routing table updatesetc.

http://wp.me/P29YQz-k

11

The language of cryptography

m plaintext messageKA(m) ciphertext, encrypted with key KAm = KB(KA(m)) symmetric key crypto: sender, receiver keys identicalpublic-key crypto: encryption key public, decryption key secret

(private)

http://wp.me/P29YQz-k

12

Symmetric key cryptography

symmetric key crypto: Bob and Alice share known same (symmetric) key: KAB e.g., key is knowing substitution pattern in mono

alphabetic substitution cipher

http://wp.me/P29YQz-k

13

substitution cipher: substituting one thing for another monoalphabetic cipher: substitute one letter for

another

http://wp.me/P29YQz-k

14

Deciphering techniques (attacks on a cryptosystem)

Cipher-text only attack: no clue about contents of message: statistical analysis

Known-plaintext attack: trudy has some plaintext for some ciphertext eg, in monoalphabetic cipher, trudy determines

pairings for a,l,i,c,e,b,oChosen-plaintext attack: trudy can get the

cyphertext for some chosen plaintext Eg, Trudy masquerades as Alice

http://wp.me/P29YQz-k

15

Statistical analysis example

A typical distribution of letters in English language text

http://wp.me/P29YQz-k

16

Suppose we have intercepted the cipher-text below, and it is known to be encrypted using a simple substitution cipher LIVITCSWPIYVEWHEVSRIQMXLEYVEOIEWHRXEXIPFEMVEWHKVSTYLXZIXLIKIIXPIJVSZEYPERRGERIM WQLMGLMXQERIWGPSRIHMXQEREKIETXMJTPRGEVEKEITREWHEXXLEXXMZITWAWSQWXSWEXTVEPMRXRSJ GSTVRIEYVIEXCVMUIMWERGMIWXMJMGCSMWXSJOMIQXLIVIQIVIXQSVSTWHKPEGARCSXRWIEVSWIIBXV IZMXFSJXLIKEGAEWHEPSWYSWIWIEVXLISXLIVXLIRGEPIRQIVIIBGIIHMWYPFLEVHEWHYPSRRFQMXLE PPXLIECCIEVEWGISJKTVWMRLIHYSPHXLIQIMYLXSJXLIMWRIGXQEROIVFVIZEVAEKPIEWHXEAMWYEPP XLMWYRMWXSGSWRMHIVEXMSWMGSTPHLEVHPFKPEZINTCMXIVJSVLMRSCMWMSWVIRCIGXMWYMX

For this example, uppercase letters are used to denote ciphertext, lowercase letters are used to denote plaintext (or guesses at such), and X~t is used to express a guess that ciphertext letter X represents the plaintext letter t.

We could use frequency analysis to help solve the message along the following lines: counts of the letters in the cryptogram show that I is the most common single letter, XL most common bigram, and XLI is the most common trigram. e is the most common letter in the English language, th is the most common bigram, and the is the most common trigram. This strongly suggests that X~t, L~h and I~e. The second most common letter in the cryptogram is E; since the first and second most frequent letters in the English language, e and t are accounted for, We guess that E~a, the third most frequent letter. Tentatively making these assumptions, the following partial decrypted message is obtained.

http://wp.me/P29YQz-k

17 heVeTCSWPeYVaWHaVSReQMthaYVaOeaWHRtatePFaMVaWHKVSTYhtZetheKeetPeJVSZaYPaRRGaReM

WQhMGhMtQaReWGPSReHMtQaRaKeaTtMJTPRGaVaKaeTRaWHatthattMZeTWAWSQWtSWatTVaPMRtRSJ GSTVReaYVeatCVMUeMWaRGMeWtMJMGCSMWtSJOMeQtheVeQeVetQSVSTWHKPaGARCStRWeaVSWeeBtV eZMtFSJtheKaGAaWHaPSWYSWeWeaVtheStheVtheRGaPeRQeVeeBGeeHMWYPFhaVHaWHYPSRRFQMtha PPtheaCCeaVaWGeSJKTVWMRheHYSPHtheQeMYhtSJtheMWReGtQaROeVFVeZaVAaKPeaWHtaAMWYaPP thMWYRMWtSGSWRMHeVatMSWMGSTPHhaVHPFKPaZeNTCMteVJSVhMRSCMWMSWVeRCeGtMWYMt

Using these initial guesses, We can spot patterns that confirm our choices, such as "that". Moreover, other patterns suggest further guesses. "Rtate" might be "state", which would mean R~s. Similarly "atthattMZe" could be guessed as "atthattime", yielding M~i and Z~m. Furthermore, "heVe" might be "here", giving V~r. Filling in these guesses, We get:

hereTCSWPeYraWHarSseQithaYraOeaWHstatePFairaWHKrSTYhtmetheKeetPeJrSmaYPassGasei WQhiGhitQaseWGPSseHitQasaKeaTtiJTPsGaraKaeTsaWHatthattimeTWAWSQWtSWatTraPistsSJ GSTrseaYreatCriUeiWasGieWtiJiGCSiWtSJOieQthereQeretQSrSTWHKPaGAsCStsWearSWeeBtr emitFSJtheKaGAaWHaPSWYSWeWeartheStherthesGaPesQereeBGeeHiWYPFharHaWHYPSssFQitha PPtheaCCearaWGeSJKTrWisheHYSPHtheQeiYhtSJtheiWseGtQasOerFremarAaKPeaWHtaAiWYaPP thiWYsiWtSGSWsiHeratiSWiGSTPHharHPFKPameNTCiterJSrhisSCiWiSWresCeGtiWYit

http://wp.me/P29YQz-k

18Chosen-Plaintext Attack example

18

Penjahat #1 merubahPIN yang dimilikinya (chosen plaintext)

cipher(key,PIN)

PIN di-enkripsi laludikirimkan ke bank

Penjahat #2 melakukanpenyadapan kemudianMempelajari ciphertext dari PIN baru tersebut

… diulangi untuk beberapa nilai PIN

http://wp.me/P29YQz-k

19

Polyalphabetic encryption

The Alberti cipher by Leon Battista Alberti around 1467 was believed to be the first polyalphabetic cipher

But at 750 AD , Abu Yusuf Yaqub ibn Is-haq Al-Kindi, authored a book on cryptology the "Risalah fi Istikhraj al-Mu'amma" (Manuscript for the Deciphering Cryptographic Messages)

Leon Battista Alberti

Abu Yusuf Yaqub ibn Is-haq Al-Kindi

http://wp.me/P29YQz-k

20

n monoalphabetic cyphers, M1,M2,…,MnCycling pattern:

e.g., n=4, M1,M3,M4,M3,M2; M1,M3,M4,M3,M2;For each new plaintext symbol, use

subsequent monoalphabetic pattern in cyclic pattern dog: d from M1, o from M3, g from M4

Key: the n ciphers and the cyclic pattern

http://wp.me/P29YQz-k

21How this Cipher Works? Pick a keyword (for our example, the keyword will be "MEC"). Write your keyword across the top of the text you want to encipher,

repeating it as many times as necessary. For each letter, look at the letter of the keyword above it (if it was 'M',

then you would go to the row that starts with an 'M'), and find that row in the Vigenere table.

Then find the column of your plaintext letter (for example, 'w', so the twenty-third column)

Finally, trace down that column until you reach the row you found before and write down the letter in the cell where they intersect (in this case, you find an 'I' there).Keyword: M E C M E C M E C M E C M E C M E C M E C M

Plaintext: w e n e e d m o r e s u p p l i e s f a s tCiphertext: I I P Q I F Y S T Q W W B T N U I U R E U F

http://wp.me/P29YQz-k

22

Symmetric: Stream Ciphers

Combine each byte of keystream with byte of plaintext to get b of ciphertext

p(i) = ith unit of messageks(i) = ith unit of

keystreamc(i) = ith unit of ciphertextc(i) = ks(i) ⊕ p(i)

(⊕ = exclusive or)p(i) = ks(i) ⊕ c(i)

http://wp.me/P29YQz-k

23

Problems with stream ciphers

Known plain-text attackThere’s often predictable and repetitive

data in communication messagesattacker receives some cipher text c and

correctly guesses corresponding plaintext m

ks = m ⊕ cAttacker now observes c’m’ = (m ⊕ c) ⊕ c’

http://wp.me/P29YQz-k

24

Even easierAttacker obtains two ciphertexts, c and c’,

generating with same key sequencec ⊕ c’ = m ⊕ m’There are well known methods for

decrypting 2 plaintexts given their XOR

http://wp.me/P29YQz-k

25

Integrity problem toosupppose attacker knows m and c;want to change m to m’c’ = c ⊕ (m ⊕ m’)send c’ to destination

http://wp.me/P29YQz-k

26

Example of stream cipher:A5 (for GSM)RC4

http://wp.me/P29YQz-k

27

Symmetric encryption: block ciphers

Message to be encrypted is processed in blocks of bytes (8 or 16).

Block cipher: huge lookup tableExample: 2-bit blocks and 2-bit keys

http://wp.me/P29YQz-k

28

Each column should be a random permutation of all possible output strings

If block is 64 bits and key is 56 bits, have 264 rows, 256 columns, 2120 entries

Table too big: instead use function that simulates a randomly permuted table

c(i) = KAB(m(i)) : encrypt block m(i) using key ABm(i) = KAB(c(i)) : decrypt block c(i) using key ABProblem: if m(i) and m(j) same, c(i) and c(j) same

Attacker may be able to guess m(i) from context of message

http://wp.me/P29YQz-k

29

Block ciphers: cipher block chaining

Don’t want same plaintext giving same ciphertext Have encryption of current block depend on result

of previous block c(i) = KAB( m(i) ⊕ c(i-1) ) m(i) = KAB( c(i) ⊕ c(i-1) )

How do we encrypt first block? Initialization vector (IV): random block = c(0) IVs do not have to be secret

http://wp.me/P29YQz-k

30

Symmetric key crypto: DESDES: Data Encryption Standard

US encryption standard [NIST 1993] 56-bit symmetric key, 64-bit plaintext input Block cipher with cipher block chaining

How secure is DES? DES Challenge: 56-bit-key-encrypted phrase

decrypted (brute force) in less than a day No known good analytic attack

making DES more secure: 3DES: encrypt 3 times with 3 different keys

(actually encrypt, decrypt, encrypt)

http://wp.me/P29YQz-k

31DES operation

initial permutation16 identical “rounds” of function application, each using different 48 bits of keyfinal permutation

http://wp.me/P29YQz-k

32

AES: Advanced Encryption Standard

New (Nov. 2001) symmetric-key NIST standard, replacing DES

processes data in 128 bit blocks128, 192, or 256 bit keysbrute force decryption (try each key)

taking 1 sec on DES, takes 149 trillion years for AES

http://wp.me/P29YQz-k

33

Key Distribution Center (KDC)

http://wp.me/P29YQz-k

34

Alice, Bob need shared symmetric key.KDC: server shares different secret key with

each registered user (many users)Alice, Bob know own symmetric keys, KA-KDC KB-

KDC , for communicating with KDC.

http://wp.me/P29YQz-k

35

Q: How does KDC allow Bob, Alice to determine shared symmetric secret key to communicate with each other?

http://wp.me/P29YQz-k

36

Public Key Cryptography

symmetric key crypto requires sender,

receiver know shared secret key

Q: how to agree on key in first place (particularly if never “met”)?

public key cryptography radically different

approach [Diffie-Hellman76, RSA78]

sender, receiver do not share secret key

public encryption key known to all

private decryption key known only to receiver

http://wp.me/P29YQz-k

37

http://wp.me/P29YQz-k

38

Public key encryption algorithms

http://wp.me/P29YQz-k

39

RSA: Choosing keys

http://wp.me/P29YQz-k

40

RSA: Encryption, decryption

http://wp.me/P29YQz-k

41

RSA example

http://wp.me/P29YQz-k

42

RSA: another important property

http://wp.me/P29YQz-k

43

RSA is slow

Exponentiation is computationally intensive

DES is at least 100 times faster than RSA

Session key, KSBob and Alice use RSA to exchange a

symmetric key KSOnce both have KS, they use DES

http://wp.me/P29YQz-k

44

Message Authentication

Allows communicating parties to verify that received messages are authentic.Verify content of message has not been

altered Source is authenticMessage has not been artificially delayed

(playback attack)Sequence of messages is maintained

http://wp.me/P29YQz-k

45

Why not use encryption?Often overkill, computationally

expensiveBroadcast message

Let’s first talk about message digests

http://wp.me/P29YQz-k

46

Message Digests

Function H( ) that takes as input an arbitrary length message and outputs a fixed-length strength: “message signature”

Note that H( ) is a many to-1 function

H( ) is often called a “hash function”

http://wp.me/P29YQz-k

47

Desirable properties:Easy to calculate Irreversibility: Can’t determine m from

H(m)Collision resistance: Computationally

difficult to produce m and m’ such that H(m) = H(m’)

Seemingly random output

http://wp.me/P29YQz-k

48

Hash Function Algorithms

MD5 hash function widely used (RFC 1321)computes 128-bit message digest in 4-step

process.arbitrary 128-bit string x

appears difficult to construct msg m whose MD5 hash is equal to x.

SHA-1 is also used.US standard [NIST, FIPS PUB 180-1]160-bit message digest

http://wp.me/P29YQz-k

49

Message Authentication Code (MAC)

http://wp.me/P29YQz-k

50

Digital SignaturesCryptographic technique analogous to

handwritten signatures.sender (Bob) digitally signs document,

establishing he is document owner/creator.

verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document

http://wp.me/P29YQz-k

51

http://wp.me/P29YQz-k

52

http://wp.me/P29YQz-k

53

Digital Signature Standard

http://wp.me/P29YQz-k

54

Certification Authorities

Certification authority (CA): binds public key to particular entity, E.

E (person, router) registers its public key with CA. E provides “proof of identity” to CA. CA creates certificate binding E to its public key. certificate containing E’s public key digitally signed by

CA CA says “this is E’s public key”

http://wp.me/P29YQz-k

55

When Alice wants Bob’s public key: gets Bob’s certificate (Bob or elsewhere). apply CA’s public key to Bob’s certificate, get Bob’s

public key

http://wp.me/P29YQz-k

56

Certificates: summary

Primary standard X.509 (RFC 2459)Certificate contains:

Issuer nameEntity name, address, domain name, etc.Entity’s public keyDigital signature (signed with issuer’s

private key)

http://wp.me/P29YQz-k

57

End-point authentication

Goal: Bob wants Alice to “prove” her identity to him

Protocol ap1.0: Alice says “I am Alice”

http://wp.me/P29YQz-k

58

Goal: Bob wants Alice to “prove” her identity to him

Protocol ap1.0: Alice says “I am Alice”

http://wp.me/P29YQz-k

59

End-point authentication: another try

Protocol ap2.0: Alice says “I am Alice” in an IP packet containing her source IP address

http://wp.me/P29YQz-k

60

Protocol ap2.0: Alice says “I am Alice” in an IP packet containing her source IP address

http://wp.me/P29YQz-k

61

End-point authentication: another try

Protocol ap3.0: Alice says “I am Alice” and sends her secret password to “prove” it.

http://wp.me/P29YQz-k

62

Protocol ap3.0: Alice says “I am Alice” and sends her secret password to “prove” it.

http://wp.me/P29YQz-k

63

End-point authentication: yet another try

Protocol ap3.1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it.

http://wp.me/P29YQz-k

64

Protocol ap3.1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it.

http://wp.me/P29YQz-k

65

End-point authentication: yet another try

Goal: avoid playback attackNonce: number (R) used only once-in-a-

lifetimeap4.0: to prove Alice “live”, Bob sends Alice

nonce, R. Alice must return R, encrypted with shared secret key

http://wp.me/P29YQz-k

66

End-point authentication: ap5.0

ap4.0 requires shared symmetric keycan we authenticate using public key

techniques?ap5.0: use nonce, public key cryptography

http://wp.me/P29YQz-k

67

ap5.0: security hole

Man (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice)

http://wp.me/P29YQz-k

68

ap5.0: security hole

Man (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice)