Network Security Essentials Chapter 7 Fourth Edition by William Stallings (Based on Lecture slides by Lawrie Brown)

Network Security EssentialsNetwork Security EssentialsChapter 7Chapter 7

Fourth EditionFourth Edition

by William Stallingsby William Stallings

(Based on Lecture slides by (Based on Lecture slides by Lawrie Brown)Lawrie Brown)

Email SecurityEmail Security

Email is one of the most widely used and Email is one of the most widely used and regarded network services regarded network services

Currently message contents are not Currently message contents are not secure secure May be inspected either in transit May be inspected either in transit Or by suitably privileged users on destination Or by suitably privileged users on destination

systemsystem

Email Security EnhancementsEmail Security Enhancements

ConfidentialityConfidentiality Protection from disclosureProtection from disclosure

AuthenticationAuthentication of sender of messageof sender of message

Message integrityMessage integrity Protection from modification Protection from modification

Non-repudiation of originNon-repudiation of origin Protection from denial by senderProtection from denial by sender

Pretty Good Privacy (PGP)Pretty Good Privacy (PGP)

Widely used de facto secure emailWidely used de facto secure email Developed by Phil ZimmermannDeveloped by Phil Zimmermann Selected best available crypto algs to useSelected best available crypto algs to use Integrated into a single programIntegrated into a single program On Unix, PC, Macintosh and other On Unix, PC, Macintosh and other

systems systems Originally free, now also have commercial Originally free, now also have commercial

versions availableversions available

PGP Operation – PGP Operation – AuthenticationAuthentication

1.1. Sender creates messageSender creates message2.2. Make Make SHA-1SHA-1160-bit hash of message 160-bit hash of message 3.3. Attached Attached RSARSA signed hash to message signed hash to message4.4. Receiver decrypts & recovers hash codeReceiver decrypts & recovers hash code5.5. Receiver verifies received message hashReceiver verifies received message hash

PGP Operation – PGP Operation – ConfidentialityConfidentiality

1.1. Sender forms 128-bit random session keySender forms 128-bit random session key2.2. Encrypts message with session keyEncrypts message with session key3.3. Attaches session key encrypted with Attaches session key encrypted with RSARSA4.4. Receiver decrypts & recovers session keyReceiver decrypts & recovers session key5.5. Session key is used to decrypt messageSession key is used to decrypt message

PGP Operation – Confidentiality PGP Operation – Confidentiality & Authentication & Authentication

Can use both services on same messageCan use both services on same message Create signature & attach to messageCreate signature & attach to message Encrypt both message & signatureEncrypt both message & signature Attach RSA/ElGamal encrypted session keyAttach RSA/ElGamal encrypted session key

PGP Operation – PGP Operation – CompressionCompression

By default PGP compresses message By default PGP compresses message after signing but before encryptingafter signing but before encrypting So can store uncompressed message & So can store uncompressed message &

signature for later verificationsignature for later verification & because compression is non deterministic& because compression is non deterministic

Uses ZIP compression algorithmUses ZIP compression algorithm (Appendix G)(Appendix G)

PGP Operation – Email PGP Operation – Email CompatibilityCompatibility

When using PGP will have binary data to send When using PGP will have binary data to send (encrypted message etc)(encrypted message etc) However email was designed only for textHowever email was designed only for text

Hence PGP must encode raw binary data into Hence PGP must encode raw binary data into printable ASCII charactersprintable ASCII characters

Uses Uses radix-64radix-64 algorithm algorithm Maps 3 bytes to 4 printable charsMaps 3 bytes to 4 printable chars Also appends a CRCAlso appends a CRC

PGP also segments messages if too bigPGP also segments messages if too big

PGP Operation – SummaryPGP Operation – Summary

PGP Session KeysPGP Session Keys

Need a session key for each messageNeed a session key for each message Of varying sizes: 56-bit DES, 128-bit CAST or Of varying sizes: 56-bit DES, 128-bit CAST or

IDEA, 168-bit Triple-DESIDEA, 168-bit Triple-DES Generated using ANSI X12.17 modeGenerated using ANSI X12.17 mode Uses random inputs taken from previous Uses random inputs taken from previous

uses and from keystroke timing of useruses and from keystroke timing of user

PGP Public & Private KeysPGP Public & Private Keys

Since many public/private keys may be in use, Since many public/private keys may be in use, need to identify which is actually used to encrypt need to identify which is actually used to encrypt session key in a messagesession key in a message Could send full public-key with every messageCould send full public-key with every message But this is inefficientBut this is inefficient

Rather use a Rather use a key identifier key identifier based on keybased on key Least significant 64-bits of the keyLeast significant 64-bits of the key Will very likely be uniqueWill very likely be unique

Also use key ID in signaturesAlso use key ID in signatures

PGP Message FormatPGP Message Format

PGP Key RingsPGP Key Rings

Each PGP user has a pair of keyrings:Each PGP user has a pair of keyrings: public-key ring public-key ring contains all the public-keys of contains all the public-keys of

other PGP users known to this user, indexed other PGP users known to this user, indexed by key IDby key ID

private-key ring private-key ring contains the public/private contains the public/private key pair(s) for this user, indexed by key ID & key pair(s) for this user, indexed by key ID & encrypted keyed from a hashed passphraseencrypted keyed from a hashed passphrase

Security of private keys thus depends on Security of private keys thus depends on the pass-phrase securitythe pass-phrase security

PGP Key RingsPGP Key Rings

PGP Message GenerationPGP Message Generation

PGP Message ReceptionPGP Message Reception

PGP Key ManagementPGP Key Management

Rather than relying on certificate authoritiesRather than relying on certificate authorities In PGP every user is own CAIn PGP every user is own CA

Can sign keys for users they know directlyCan sign keys for users they know directly

Forms a “web of trust”Forms a “web of trust” Trust keys have signedTrust keys have signed Can trust keys others have signed if have a chain of Can trust keys others have signed if have a chain of

signatures to themsignatures to them

Key ringKey ring includes trust indicators includes trust indicators Users can also revoke their keysUsers can also revoke their keys

PGP Trust Model ExamplePGP Trust Model Example

S/MIME (Secure/Multipurpose S/MIME (Secure/Multipurpose Internet Mail Extensions)Internet Mail Extensions)

Security enhancement to MIME emailSecurity enhancement to MIME email Original Internet RFC822 email was text onlyOriginal Internet RFC822 email was text only MIME provided support for varying content MIME provided support for varying content

types and multi-part messagestypes and multi-part messages With encoding of binary data to textual formWith encoding of binary data to textual form S/MIME added security enhancementsS/MIME added security enhancements

Have S/MIME support in many mail agentsHave S/MIME support in many mail agents eg MS Outlook, Mozilla, Mac Mail etceg MS Outlook, Mozilla, Mac Mail etc

Email Format

Current standard for e-mail format: RFC 822 -> RFC 5322

Standard for e-mail transfer: RFC 821 (Simple Mail Transfer Protocol, SMTP)

Standard for MIME: extension to email format RFC 2045-2049 To address the problems and limitations of

SMTP/RFC5322

Limitations of SMTP/RFC5322

SMTP cannot transmit binary files SMTP cannot transmit text that includes

national language characters SMTP may reject mails over a certain size SMTP might have translation problem in

character codes Some implementations do not adhere

completely to the SMTP standard

Multipurpose Internet Mail Extensions

MIME includes 5 New message header fields

• MIME-Version, Content-Type, Content-Transfer-Encoding, Content-ID, Content-Description

Multimedia content formats• MIME content types: RFC 2045

text, multipart, message, image, video, audio, application

Transfer encodings• 7bit, 8bit, binary, quoted-printable, base64, x-token

MIME Content Types

MIIME Transfer Encodings

A Multipart Example

(See Fig.7.8)

S/MIME FunctionsS/MIME Functions

Enveloped dataEnveloped data Encrypted content and associated keysEncrypted content and associated keys

Signed dataSigned data Encoded message + signed digestEncoded message + signed digest

Clear-signed dataClear-signed data Cleartext message + encoded signed digestCleartext message + encoded signed digest

Signed & enveloped dataSigned & enveloped data Nesting of signed & encrypted entitiesNesting of signed & encrypted entities

S/MIME Cryptographic S/MIME Cryptographic AlgorithmsAlgorithms

Digital signatures: DSS & RSADigital signatures: DSS & RSA Hash functions: SHA-1 & MD5Hash functions: SHA-1 & MD5 Session key encryption: ElGamal & RSASession key encryption: ElGamal & RSA Message encryption: AES, Triple-DES, Message encryption: AES, Triple-DES,

RC2/40 and othersRC2/40 and others MAC: HMAC with SHA-1MAC: HMAC with SHA-1 Have process to decide which algs to useHave process to decide which algs to use

S/MIME MessagesS/MIME Messages

S/MIME secures S/MIME secures a MIME entity with a a MIME entity with a signature, encryption, or bothsignature, encryption, or both

Forming a MIME wrapped PKCS objectForming a MIME wrapped PKCS object Have a range of content-types:Have a range of content-types:

Enveloped dataEnveloped data Signed dataSigned data Clear-signed dataClear-signed data Registration requestRegistration request Certificate only messageCertificate only message

S/MIME Certificate S/MIME Certificate ProcessingProcessing

S/MIME uses X.509 v3 certificates (Ch.4)S/MIME uses X.509 v3 certificates (Ch.4) Managed using a hybrid of a strict X.509 Managed using a hybrid of a strict X.509

CA hierarchy & PGP’s web of trustCA hierarchy & PGP’s web of trust Each client has a list of trusted CA’s certsEach client has a list of trusted CA’s certs And own public/private key pairs & certsAnd own public/private key pairs & certs Certificates must be signed by trusted Certificates must be signed by trusted

CA’sCA’s

Certificate AuthoritiesCertificate Authorities

Have several well-known CA’sHave several well-known CA’s Verisign one of most widely usedVerisign one of most widely used Verisign issues several types of Digital IDsVerisign issues several types of Digital IDs Increasing levels of checks & hence trustIncreasing levels of checks & hence trust

ClassClass Identity ChecksIdentity Checks UsageUsage

11 name/email checkname/email check web browsing/emailweb browsing/email

22 + enroll/addr check+ enroll/addr check email, subs, s/w email, subs, s/w validatevalidate

33 + ID documents+ ID documents e-banking/service e-banking/service accessaccess

S/MIME Enhanced Security S/MIME Enhanced Security ServicesServices

3 proposed enhanced security services:3 proposed enhanced security services: Signed receiptsSigned receipts Security labelsSecurity labels Secure mailing listsSecure mailing lists

Domain Keys Identified MailDomain Keys Identified Mail

A specification for cryptographically A specification for cryptographically signing email messagessigning email messages

So signing domain claims responsibilitySo signing domain claims responsibility Recipients / agents can verify signatureRecipients / agents can verify signature Proposed Internet Standard RFC 4871Proposed Internet Standard RFC 4871 Has been widely adopted: by gmail, Has been widely adopted: by gmail,

yahoo, and many ISPs yahoo, and many ISPs

Internet Mail ArchitectureInternet Mail Architecture

Email ThreatsEmail Threats

See RFC 4684: See RFC 4684: Analysis of Threats Analysis of Threats Motivating DomainKeys Identified MailMotivating DomainKeys Identified Mail

Describes the problem space in terms of:Describes the problem space in terms of: Range: low end, spammers, fraudstersRange: low end, spammers, fraudsters Capabilities in terms of where submitted, Capabilities in terms of where submitted,

signed, volume, routing, naming etcsigned, volume, routing, naming etc Location: outside located attackersLocation: outside located attackers

DKIM DKIM StrategyStrategy

Transparent Transparent to userto user MSA signMSA sign MDA verifyMDA verify

For For pragmatic pragmatic reasonsreasons

DKIM DKIM Functional Functional

FlowFlow

SummarySummary

Have considered:Have considered: Secure emailSecure email PGPPGP S/MIMES/MIME Domain-keys identified emailDomain-keys identified email