10. Key Management

Contents

Key Management Public-key distribution Secret-key distribution via public-key cryptography

Key Management

Public-key distribution Public announcement Public available directory Public-key authority Public-key certificates

Public Announcement

Public announcement of public keys

Any participant can send his/her public key to any participants or broadcast to the community.

Weakness

Anyone can forge a public announcement Some user could pretend to be user A and send a public key to

another participant or broadcast such a public key.

C

Public Announcement

Public Available Directory

Publicly available directory1. A trusted authority maintains a directory with a {name,

public key} entry for each participants.

2. Each participant registers a public key with the directory authority.

3. A participant may replace the existing key with a new some at any time.

4. Periodically, the authority publishes the entire directory or updates to the directory.

Public Available Directory

5. Participants could also access the directory electrically. For this purpose, secure, authenticated communication from the authority to the participant is mandatory.

Public Available Directory

This scheme is more secure, but still has vulnerabilities. If an opponent get the private key of the directory authority,

the opponent could counterfeit public keys in the directory.

Public Available Directory

Public-key Authority

Public-key Authority Stronger security for public-key distribution can be

achieved by providing tighter control over the distribution of public keys from the directory.

1. A sends a timestamped message to the public-key authority containing a request for the current public key of B.

Public-key Authority

2. The authority responds with a message that is encrypted using the authority’s private key, KRauth.

Public-key Authority

3. A stores B’s public key and also use it to encrypt a message to B containing an identifier of A(IDA) and a nonce(N1).

Public-key Authority

4,5 B retrieves A’s public key from the authority in the same manner as A retrieved B’s public key.

Public-key Authority

6. B sends a message to A encrypted with KUa and containing A’s nonce(N1) as well as a new nonce generated by B(N

2).

Public-key Authority

7. A returns N2, encrypted using B’s public key, to assure B that is correspondent is A.

Public-key Authority

Drawbacks

A total of seven messages are required. However, the initial four messages need be used only infrequently

because both A and B can save the other’s public key for future use.

Public-key authority could be a bottleneck in the system, because a user must access the authority for the public key for every other user that it wishes to contact.

As before, the directory is vulnerable to tampering.

Public-key Authority

Public-key Certificates

Public-key certificates

Certificates are used to exchange keys without contacting a public-key authority.

A certificate consists of a public key, an identifier of the key owner, and more information with the signature of the whole block signed by a trusted third party.

Public-key Certificates

Certificate generation Each user sends his/her public key to a certificate authority

(CA) in a secure manner. The CA generates a certificate for the user using his/her

private key.

Public-key Certificates

Public-key exchange A and B sends their certificates to each other. Each verify the certificate using the CA’s public key.

Secret-Key Distribution

Secret-key distribution via public-key cryptography Simple secret key distribution Secret key distribution with confidentiality and

authentication A hybrid scheme

Simple Secret Key Distribution

Simple Secret Key Distribution If A wishes to communicate with B,

1. A generates a public/private key pair {KUa, KRa} and transmits a message to B consisting of KUa and an identifier of A, IDA.

2. B generates a secret key, Ks, and transmits it to A, encrypted with A’s public key.

3. A computes DKRa[EKUa[Ks]] to recover the secret key.

4. A discards KUa and KRa and B discards KUa.

A and B can now securely communicate using conventional encryption and the session key Ks.

However, this protocol is vulnerable to an active attack.

Man-in-the-middle attack An opponent E can compromise the communication without being

detected.

Simple Secret Key Distribution

Man-in-the-middle attack1. A generates a public/private key pair {KUa, KRa} and transmits a m

essage intended for B consisting of KUa and IDA.

2. E intercepts the message, creates its own public/private key pair {KUe, KRe} and transmits KUe||IDA to B.

A E B

(1) KUa||IDA (2) KUe||IDA

(3) EKUe[Ks](4) EKUa[Ks]

Simple Secret Key Distribution

Man-in-the-middle attack4. B generates a secret key Ks, and transmits EKUe[Ks].

5. E intercepts the message and learns Ks by computing DKRe[EKUe[Ks]].

6. E transmits EKUa[Ks] to A.

Simple Secret Key Distribution

A E B

(1) KUa||IDA (2) KUe||IDA

(3) EKUe[Ks](4) EKUa[Ks]

Man-in-the-middle attack

Both A and B know Ks and are unaware that E knows Ks.

Knowing Ks, E can decrypt all encrypted messages between A and B.

Simple Secret Key Distribution

Secret Key distribution with Confidentiality and Authentication

Secret Key Distribution with Confidentiality and Authentication Assume that A and B have exchanged public key

1. A uses B’s public key to encrypt a message to B obtaining an identifier of A (IDA) and a nonce (N1), used to identify this transaction uniquely.

2. B sends a message to A encrypted with KUa and obtaining A’s nonce(N1) as well as a now nonce generated by B(N2).

Secret Key distribution with Confidentiality and Authentication

3. A returns N2, encrypted using B’s public key, to assure B that its correspondent is A.

4. A selects a secret key Ks and sends M = EKUb[EKRa[Ks]] to B. Encryption of this message with B’s public key ensures that only B can read it; Encryption with A’s private key ensures that only A could have sent it.

5. B computes DKUa[DKRb[M]] to recover the secret key.

Secret Key distribution with Confidentiality and Authentication

This approach provides protection against both active and passive attacks.

Note that the first 3 step of this scheme are the same as that last 3 steps of Public-key authority scheme.

This scheme ensures both confidentiality and authentication in the exchange of a secret key.

Secret Key distribution with Confidentiality and Authentication

Hybrid Scheme

A Hybrid Scheme

The use of a key distribution center (KDC) that shares a secret master key with each user and distributes secret session keys encrypted with the master key.

A public key scheme is used to distribute the master keys.

Performance Distribution of session key by public-key encryption could degrade

overall system performance. With a 3-level hierarchy, public-key encryption is used only

occasionally to update the master key between a user and the KDC.

Backward Compatibility The hybrid scheme is easily overlaid on an existing KDC scheme,

with minimal disruption or software changes.

Hybrid Scheme