PA160: Net-Centric Computing II. Network Security Luděk Matýska Slides by: Tomáš Rebok Faculty of Informatics Masaryk University Spring 2014 Luděk Matýska (Fl MU) 1. Network Security Spring 2014 1 / 125 Course Introduction PA160 - Course Introduction Luděk Matýska (Fl MU) 1. Network Security Spring 2014 2 / 125 Course Organization • attending the lectures is optional • the knowledge acquired during PB156 & PA159 courses is assumed • course materials will be published on the course webpage (more or less in time ;-) ) • assessment methodology: • final exam (written form) • course literature: • slides, RFCs, . .. • literature being announced in relevant course parts Luděk Matýska (Fl MU) 1. Network Security Spring 2014 3 / 125 Course Overview • the course goal: • to provide an advanced insight into the area of computer networks and their applications • discussed topics: • network security • network management and monitoring • parallel and distributed applications, grids • service-oriented architectures • specification and verification of communication protocols • network simulators and emulators • etc. Luděk Matýska (Fl MU) 1. Network Security Spring 2014 4 / 125 1. Network Security 1. Network Security 1. Network Security Luděk Matýska (Fl MU) 1. Network Security Spring 2014 5 / 125 Lecture overview Introduction 0 Motivation 0 Network Security Elements ^J}f Cryptography Introduction 0 Symmetric Cryptography 0 Asymmetric Cryptography Network Security Mechanisms 0 Entity Authentication 0 Message Confidentiality (Security) 0 Message Integrity 0 Message Authentication 0 Digital Signature 0 Key Management and Distribution Example Protocols Ensuring Network Security in the Internet 0 Application-layer Security 0 Transport-layer Security 0 Network-layer Security 0 Link-layer Security Network &i Data Protection - Maintaining the Availability 0 Firewalls 0 Intrusion Detection Systems 0 Denial of Service (DoS) &i Distributed Denial of Service (DDoS) attacks 0 Virusses &i Worms 0 Network &i Data Protection - Concluding Remarks Conclusion Luděk Matýska (Fl MU) 1. Network Security Lecture overview Introduction 0 Motivation 0 Network Security Elements fj^l Cryptography Introduction 0 Symmetric Cryptography 0 Asymmetric Cryptography ^j^f Network Security Mechanisms 0 Entity Authentication 0 Message Confidentiality (Security) 9 Message Integrity 9 Message Authentication 0 Digital Signature 0 Key Management and Distribution Example Protocols Ensuring Network Security in the Internet 0 Application-layer Security 0 Transport-layer Security 0 Network-layer Security 0 Link-layer Security Network &i Data Protection - Maintaining the Availability 0 Firewalls 0 Intrusion Detection Systems 0 Denial of Service (DoS) &i Distributed Denial of Service (DDoS) attacks 0 Virusses &i Worms 0 Network &i Data Protection - Concluding Remarks Luděk Matýska (Fl MU) 1. Network Security Security • most of computer science is concerned with achieving desired behavior • in some sense, security is concerned with preventing undesired behavior • different way of thinking! • an enemy/opponent/hacker/adversary may be actively and maliciously trying to circumvent any protective measures one put in place • computer vs. network security • computer security - focuses on security aspects of systems in isolation • viruses, secure data storage, OS security, etc. • network security - focuses on security of data as it is transmitted between networked systems • authentication protocols, encryption of transmitted data, firewalls, etc. • not always a clear-cut dividing line.. . Luděk Matýska (Fl MU) 1. Network Security Spring 2014 8 / 125 Introduction Motivation What can go wrong? o when your computer y receives or is waiting for a message ml Luděk Matýska (Fl MU) 1. Network Security Spring 2014 9 / 125 Introduction Motivation What can go wrong? Message loss Luděk Matýska (Fl MU) 1. Network Security Spring 2014 10 / 125 Introduction Motivation What can go wrong? Message interception o adversary A can get a copy of m when m passes by Luděk Matýska (Fl MU) 1. Network Security Spring 2014 11 / 125 Introduction Motivation What can go wrong'i lessage modification o adversary A can arbitrarily modify the content of m to become Luděk Matýska (Fl MU) 1. Network Security Introduction Motivation What can go wrong? Message insertion o adversary A can arbitrarily fabricate a message m, pretending that m was sent by x Luděk Matýska (Fl MU) 1. Network Security Spring 2014 13 / 125 Introduction Motivation What can go wrong? Message replay o adversary A can replay a message m that has been sent earlier by x and received by y Luděk Matýska (Fl MU) 1. Network Security Spring 2014 14 / 125 Introduction Motivation What can go wrong? Denial-of-Service attack © adversary A can send huge amount of messages to y to block m from arriving at y o in the case of botnet attack, the adversary instructs many bots to send messages to y simultaneously Luděk Matýska (Fl MU) 1. Network Security Spring 2014 15 / 125 Introduction Motivation What is needed? Reliable transmission I o y wants to receive all messages sent by x to her o both x and y want to make sure the message is not tampered with o eventually they both want the message not to be overheard by any third party Luděk Matýska (Fl MU) 1. Network Security Spring 2014 16 / 125 What is needed? Sender verification Luděk Matýska (Fl MU) 1. Network Security Spring 2014 17 / 125 What is needed? Message non-repudiation • x wants to be able to prove to third party z that y has received message m from x • y wants to be able to prove to third party z that x has sent a message m to y Network Security Network Security is great... • protects messages from interception in their transit a provides desired level of privacy for users or data • detects and discards messages that had been modified, inserted, or replayed • disallows unauthorized access to local system resources and sensitive data . .. but hard to achieve • many layers in network architecture • many different media of network connection • adversary's location hard to determine • new attacks keep emerging a cryptographic overhead Ludek Matyska (Fl MU) 1. Network Security Spring 2014 19 / 125 Introduction Network Security Elements Network Security - Basic Elements A secure communication network should provide the following mechanisms/services: • AAA • Authentication • Authorization • Accounting • + secured communication • Confidentiality • Integrity • Non-repudiation a + Availability Luděk Matýska (Fl MU) 1. Network Security Spring 2014 20 / 125 Introduction Network Security Elements Network Security - Basic Elements Authentication Authentication • in Czech: autentizace • NOT autentikace, autentifikace, . . . • several perspectives: • a process verifying that someone is who they claim they are (= entity authentication) • a process assuring the recipient that the message is from the source that it claims to be from (= message authentication) • requires a determination of the entity's identity • several methods for identity determination exist: • based on what a user knows - a proper pair of username and password/PIN • based on what a user has - a tool which a user owns (USB dongle, smart card, private key, etc.) • based on what a user is - a user has characteristics, which can be verified (fingerprint, retinal images, etc.) • based on what a user can - a user is able to answer particular verifying questions Ludek Matyska (Fl MU) 1. Network Security Spring 2014 21 / 125 Introduction Network Security Elements Network Security - Basic Elements Authorization and Accounting Authorization • process of granting the user access to specific system resources • based on user's profile and the local/global policy controlling the resource access • follows the authentication process • ensured by access control lists (ACLs) • define permissions to perform particular operation or to access particular resources Accounting • monitoring the users' usage of network services • the information can be used for management, planning, billing, or any other purposes Luděk Matýska (Fl MU) 1. Network Security Spring 2014 22 / 125 Introduction Network Security Elements Network Security - Basic Elements Confidentiality, Integrity, and Non-repudiation Confidentiality • protects data and information from unauthorized disclosure (sniffers) • data during transmission cannot be read by any unauthorized user • just the sender and receiver understand the content of the transferred message • ensured by message encryption Integrity • protects data from unauthorized modification • data during transmission cannot be modified or fabricated by any unauthorized user • usually based on encryption and hashing algorithms Non-repudiation • sender nonrepudiation and receiver nonrepudiation serves the receiver/sender for the purposes of proving origin/delivery of the message • neither the sender of a message can deny the transmission of the message nor the receiver of a message is able to deny the reception of the message • ensured by digital signatures Ludek Matyska (Fl MU) 1. Network Security Spring 2014 23 / 125 Introduction Network Security Elements Network Security - Basic Elements Availability Availability • property of a system, network, or a resource being accessible and usable any time upon demand by an authorized system entity • i.e., a system is available if it provides services according to the system design whenever users require them • has to be associated with various security services • such as services protecting from denial of service (DoS) attacks Luděk Matýska (Fl MU) 1. Network Security Spring 2014 24 / 125 Cryptography Introduction Lecture overview O Introduction 0 Motivation 0 Network Security Elements ^J}f Cryptography Introduction 0 Symmetric Cryptography 0 Asymmetric Cryptography ^j^f Network Security Mechanisms 9 Entity Authentication 0 Message Confidentiality (Security) 9 Message Integrity 0 Message Authentication 0 Digital Signature 9 Key Management and Distribution Example Protocols Ensuring Network Security in the Internet 0 Application-layer Security 0 Transport-layer Security 0 Network-layer Security 0 Link-layer Security Network &i Data Protection - Maintaining the Availability 0 Firewalls 0 Intrusion Detection Systems 0 Denial of Service (DoS) &i Distributed Denial of Service (DDoS) attacks 0 Virusses &i Worms 0 Network &i Data Protection - Concluding Remarks Luděk Matýska (Fl MU) 1. Network Security Cryptography Introduction Cryptography Introduction o network security is mostly achieved through the use of Cryptography Cryptography: o the science and art of transforming messages to make them secure and immune to attacks o basic cryptography mechanisms: o symmetric (secret-key) cryptography Luděk Matýska (Fl MU) 1. Network Security Spring 2014 26 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography o the same key is used by both parties for both encryption and decryption o advantages: o low computational demands o suitable for encryption of large messages o drawbacks: o a necessity to share the secret key (—>• a mechanism for key distribution is required) o can lead to many keys required to be maintained (e.g., many-to-one communication in distributed environment) )ES, 3DES, IDEA, Blowfish, Rivest Cipher 4 (RC4), AES, etc. Shared secret key Luděk Matýska (Fl MU) 1. Network Security Spring 2014 27 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography Simple Symmetric Ciphers Character-oriented • operate on characters of an alphabet • substitution ciphers - substitutes one symbol with another • monoalphabetic - a character/symbol in the plaintext is always changed to the same character/symbol in the ciphertext (e.g., Caesar cipher) • polyalphabetic - each occurrence of a character can have a different substitute • transposition ciphers - reorders (permutes) symbols in a block of symbols • instead of substitutions, locations of characters change Bit-oriented • operate on blocks of bits • e.g., XOR cipher, rotation cipher, etc. Ludek Matyska (Fl MU) 1. Network Security Spring 2014 28 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography DES (Data Encryption Standard) DES (Data Encryption Standard) • designed by IBM and adopted by the U.S. government as the standard encryption method for nonmilitary and nonclassified use • the algorithm encrypts a 64-bit plaintext blocks using a 64-bit key • in fact, the key is just 56-bits long (every eighth bit is used for parity checking and is ignored) • DES has two transposition blocks (so-called P-boxes) and 16 complex round ciphers • although the 16 iteration round ciphers are conceptually the same, each uses a different key derived from the original key • not considered to be secure any more • because of the key length (too short) • see details in the animation: http://www.cs.bham.ac.uk/ research/projects/lemsys/DES/DESPage.j sp Ludek Matyska (Fl MU) 1. Network Security Spring 2014 29 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography DES (Data Encryption Standard) - Algorithm outline I. Cryptography Introductioi in Symmetric Cryptography Symmetric Cryptography DES (Data Encryption Standard) - Algorithm outline II. (single round) Luděk Matýska (Fl MU) 1. Network Security Spring 2014 31 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography Triple DES (3DES) Triple DES (3DES) • has been proposed and implemented to lengthen the DES key • uses three DES blocks • encryption: DES encryption-decryption-encryption • decryption: DES decryption-encryption-decryption • different variants: » 3DES with three keys —>• the size of the key is increased to 168 bits • 3DES with two keys (Keyi — Keys) the size of the key is 112 bits • if (Keyi — Key2 — Keys) standard DES Luděk Matýska (Fl MU) 1. Network Security Spring 2014 32 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography Triple DES (3DES) 64-bit plaintext Encrypt DES Q a Decrypt DES Encrypt DES I Key, 'Key, !Key3 64-bit ciphertext Encryption Triple DES 64-bit plaintext Decrypt DES Encrypt DES Decrypt DES I Key, iKey2 iKey3 f 64-bit ciphertext b. DecryptionTriple DES Luděk Matýska (Fl MU) 1. Network Security Spring 2014 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography AES (Advanced Encryption Standard) AES (Advanced Encryption Standard) 9 proposed as a reaction to competition for selecting a successor to DES (1997) • originally called Rijndael • standardized in 2001 • three variants: AES-128, AES-192 and AES-256 • the number indicates the key length a the keysize has no theoretical maximum • operates on a 4 x 4 array of bytes (= 128 bits) • AES performs a number of repetitions of transformation rounds that convert the input plaintext into the final output of ciphertext • each round consists of several processing steps, including one that depends on the encryption key • can be effectively implemented in HW • see details in the animation: http://www.formaestudio.com/rijndaelinspector/ Luděk Matýska (Fl MU) 1. Network Security Spring 2014 34 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography AES (Advanced Encryption Standard) - Algorithm outline I. Luděk Matýska (Fl MU) 1. Network Security Spring 2014 35 / 125 Cryptography Introduction Symmetric Cryptography Symmetric Cryptography AES (Advanced Encryption Standard) - Algorithm outline II. (single round) Round i 128-bit data SubByte i Byte substitution ShiftRow I MixColumn Byte permutation Complex operation (missing in round 10) Add RoundKey I Luděk Matýska (Fl MU) 128-bit data 1. Network Security Cryptography Introduction Asymmetric Cryptography Asymmetric Cryptography • also known as Public-key Cryptography • uses different keys for encryption and decryption • both keys are denoted as keypair • the public key is used for encryption, while the private key is used for decryption • the message encrypted by a public key can be decrypted only by the appropriate private key • advantages: • no secret key is passed between two communicating parties =^> lowers the risk of its disclosure • the public key can be published a drawbacks: • the speed =^> asymmetric ciphers are suitable for small messages • for example, for a symmetric key exchange • suffer from the man-in-the-middle attack • the public keys have to be provided by a trusted party a e.g., RSA, Diffie-Hellman (key exchange), etc. Ludek Matyska (Fl MU) 1. Network Security Spring 2014 37 / 125 Cryptography Introduction Asymmetric Cryptography Asymmetric Cryptography Illustration Luděk Matýska (Fl MU) 1. Network Security Spring 2014 38 / 125 Cryptography Introduction Asymmetric Cryptography Asymmetric Cryptography RSA (Rivest, Shamir, and Adleman algorithm) I. RSA (Rivest, Shamir, and Adleman algorithm) • the most common and popular public key algorithm • RSA gets its security from the difficulty of factoring large numbers • uses two (large) numbers, e and d, as the encryption and decryption keys • public/private keys generation: • choose two random large prime numbers, p and q (ideally of equal length, e.g., 200 digits) • compute the product N = p ■ q • then randomly choose the encryption key, e (between 1 and N — 1), such that e and (p — l)(q — 1) are relatively prime » then compute the decryption key, d. d = e_1 mod ((p — l)(q — 1)) • i.e., d ■ e — 1 mod ((p - l)(q - 1)) • p and q are no longer needed • public key: (e, N) • private key: (d, N) Luděk Matýska (Fl MU) 1. Network Security Spring 2014 39 / 125 Cryptography Introduction Asymmetric Cryptography Asymmetric Cryptography RSA (Rivest, Shamir, and Adleman algorithm) II. RSA (Rivest, Shamir, and Adleman algorithm) cont'd • message encryption • to encrypt a message m, it has to be divided into numerical blocks smaller than N • each block is then individually encrypted: c — me mod N 9 message decryption • decrypt every block by: m — cd mod N • see all the details in the RSA animation: http://cryptool.org/media/RSA/RSA-Flash-en/player.html Luděk Matýska (Fl MU) 1. Network Security Spring 2014 Network Security Mechanism Lecture overview ■Jf Introduction • Motivation • Network Security Elements ■Ev Cryptography Introduction 9 Symmetric Cryptography Network Security Mechanisms 9 Entity Authentication 9 Message Confidentiality (Security) 9 Message Integrity 9 Message Authentication 9 Digital Signature 9 Key Management and Distribution ark Security in the Internet • Transport-layer Security • Network-layer Security • Link-layer Security Network & Data Protection - Maintaining the Availal 0 Tirewalls 9 Intrusion Detection Systems • Denial of Service (DoS) &i Distributed Denial of Se 9 Virusses &i Worms 9 Network & Data Protection - Concluding Remarks Network Security Mechanisms Entity Authentication Entity Authentication Passwords Password authentication: • the simplest and the oldest method • Alice authenticates to Bob by sending a password • fixed passwords - subjects to several attacks: • eavesdropping, stealing a password, accessing a file with passwords, guessing (dictionary attacks), etc. • can be (partially) solved by: • hashing the passwords • hashing salted passwords • e.g., PAP (Password Authentication Protocol) - transmits unencrypted ASCII passwords (assumes out-of-band control channel) • one-time passwords - passwords valid just for only one login session • new password generated based on previous password • new password generated based on a challenge • specialized electronic tokens, out-of-band channels (SMS), etc. Ludek Matyska (Fl MU) 1. Network Security Spring 2014 42 / 125 Network Security Mechanisms Entity Authentication Entity Authentication Challenge-Response Authentication • in password authentication, the claimant proves her identity by demonstrating that she knows a secret (the password) • however, since the claimant reveals this secret, the secret is susceptible to interception by the adversary a in challenge-response authentication, the claimant proves that she knows a secret without revealing it • the challenge is a time-varying value (a random number or a timestamp) sent by the verifier • the claimant applies a function to the challenge and sends the result (response) to the verifier • the response shows that the claimant knows the secret Luděk Matýska (Fl MU) 1. Network Security Spring 2014 43 / 125 Network Security Mechanisms Entity Authentication Entity Authentication Challenge-Response Authentication - Symmetric keys using a nonce • Alice asks Bob for sending a nonce (a random number, timestamp etc.) • Alice encrypts the nonce by shared secret key (the password) and sends it back to Bob Alice Bob IT" Alice Kab'-. -|_J Alice sends data to Bob using KAB Luděk Matýska (Fl MU) 1. Network Security Spring 2014 Network Security Mechanisms Entity Authentication Entity Authentication Challenge-Response Authentication - Symmetric keys using a nonce (mutual auth. same as the previous one, but with the mutual authentication Alice n. Bob lr" -| Alice, RA~Y K, rb, I RA K.J-, I rbH Alice sends data to Bob using KAB Luděk Matýska (Fl MU) 1. Network Security Spring 2014 Network Security Mechanisms Entity Authentication Entity Authentication Challenge-Response Authentication - Hash functions usage • instead of encryption/decryption, one can also use a hash function for entity authentication • hash function - a one-way function generating a message digest • details on hash functions - see Message Integrity part • e.g., MS CHAP (Challenge-Handshake Authentication Protocol) Alice (user) Bob (server) Alice, T Hash Luděk Matýska (Fl MU) 1. Network Security Spring 2014 46 / 125 Network Security Mechanisms Entity Authentication Entity Authentication Asymmetric keys - Public key usage • instead of symmetric-key ciphers, asymmetric-key ciphers can be also used for entity authentication • the secret is the private key of the claimant • she must show that she owns the private key related to the public key • the nonce can be encrypted either by the claimant's public key Bob Alice -► °J_J