18-733 spring 2016 homework 4 reviewΒ Β· session key from shared secret β’ adversary guesses...
TRANSCRIPT
18-733 Spring 2016 Homework 4 Review
Kyle Soska
April 1, 2016
0
0.5
1
1.5
2
2.5
3
3.5
10 10.5 11 11.5 12 12.5 13 13.5 14 14.5 15 15.5 16 16.5 17 17.5 18 18.5 19 19.5 20
HW 4 Grade Distribution - Overall
0
0.5
1
1.5
2
2.5
10 10.5 11 11.5 12 12.5 13 13.5 14 14.5 15 15.5 16 16.5 17 17.5 18 18.5 19 19.5 20
HW 4 Grade Distribution - By Lateness
On Time
Late
Key Exchange Protocols
β’ Pretty strait forward
β’ Confusion about what does it mean to be Complete vs Secure
β’ π₯ βπ β€π means randomly sample π₯ from β€π
Key Exchange Protocols
β’ Is it possible to simultaneously satisfy receiver authentication, client authentication, and client privacy in two messages? β Tricky part is client authentication and privacy
β The material for authenticating the client needs to be encrypted
β Can use server public key, but then there are replay attacks
β Can use nonce but then the server needs to keep state about nonces it has seen, gets messy
Key Exchange Protocols
Question: What is the deal with the ππΌβ², ππΌ?
Answer: Donβt want an adversary to send messages in step 3 that cause the server to do lots of work without the adversary doing work. Need some βcheckβ that is cheap that can prevent the server from doing modular exponentiation
Key Exchange Protocols
β’ Generically, how do you mitigate against DDOS?
β If it is network DDOS, you add network filters, flow detection, etc
β If it is resource DDOS, you can use computational puzzles and proof of work / proof of storage
SSL / TLS Part 1
β’ Carry out the attack by pinning fake certificate into H1βs web browser
β’ Canβt detect the attack if using server authentication only since the server is exactly who it should be
β’ Can detect the attack if using client authentication
β’ Can detect the attack if you get a point of view outside of the company network β’ Notary servers provide a way for doing this. These
servers exist on the web and just request the certificates of websites that you can lookup and compare against your own view
β’ If TLS allowed you to resume your old session by providing
a hash of the old session id and the server public key, it would be useless since the attacker wouldnβt know the session key
SSL / TLS Part 2
β’ Anonymous Diffie-Hellman (128-bit AES, MD5) β Broken due to MitM attack
β’ Ephemeral Diffie-Hellman (128-bit AES, MD5) β Secure
β’ Ephemeral Diffie-Hellman (40-bit DES) β Insecure due to weak symmetric key
β’ Fixed Diffie-Hellman (128-bit AES, MD5) β Insecure due to broken PFS
β’ Fixed Diffie-Hellman (40-bit DES) β Broken due to weak symmetric key and PFS
Session Key From Shared Secret
β’ Typically:
β Let π βπ 0, 1 128 be some random session key
β Encrypt with password: π(π)
β Attacker now has to guess the password
β’ πβ²β1 π π = π? Check: π·πππ πΈπππ ππππ€π
β’ Passwords are bad, can guess easiest 25% rapidly
Session Key From Shared Secret
β’ Better:
β π πΈπ΄ where πΈπ΄ is a randomly generated public key, with a corresponding decryption key
β Server gets π πΈπ΄ , computes πΈπ΄ and sends back π πΈπ΄ π
β Client computes DA πβ1 π πΈπ΄ π , gets π
β Adversary guesses πβ², computes πβ²β1 π πΈπ΄
Session Key From Shared Secret
β’ Adversary guesses πβ², computes πβ²β1 π πΈπ΄ β If πβ² β π, it will look like random bits β If πβ² = π, still not clear that the adversary is correct
β’ Problem: πΈπ΄ is a public key, and looks different from the failed attempts that look like random bits, adversary can efficiently test if the result is a valid public key
β’ Solution: For RSA, only encrypt the encryption exponent π, and do some tricks so that it looks like a random string
Session Key From Shared Secret
β’ Major Problem
β Keys are stored in plaintext on the server !
β Password databases get stolen all the time, the current standard is to only store a hash of the passwords which is less bad
β Employees could be corrupt or want to steal passwords
Discrete Log Meet In Middle Attack
β’ Not really a problem in practice, typical discrete log instantiations are ~2048 bits, attack reduces complexity to 1024 bits
β’ There are ways to tradeoff the size of the table and the number of computations to minimize cost, not super important since this attack is not that strong