week two orientation

8/3/2019 Week Two Orientation

http://slidepdf.com/reader/full/week-two-orientation 1/18

Manjunath Mattam

Security Protocols

Week 2



• Welcome back, after vacation..

• This is week 2, Security protocols

•

Next week new course, Web security.• Did you finish the homework?

– Reading assignment and ZK Proof

–

Text book – Completed TLS?

• Security Foundations course result ready.

Administrative issues



Zero Knowledge proof

• Did you pick scenarios during vacation?discussion

• Objective: Show possession of a secret toanother party without disclosing thatsecret.

• This requires:

– Interactive proofs

– Require complex, bandwidth intense protocols



Example Scenarios:

• All users in the system keep backup filesencrypted with secret key of users. – Alice wants Bob to send a file, Bob can not open

these encrypted files therefore chances of sending a

wrong file is more. – Alice with out sending the secret key how does she

communicate exact file?

• Alice wants to login her bank account – Alice calls her bank, and for authentication she was

asked to disclose 3rd digit and 9th digit of herpassword/debit card.

• Is this Zero Knowledge proof?



Zero Knowledge proof

• Is it possible to prove a statement withoutyielding anything beyond its validity?

• Such proofs are called zero knowledgeproof.

• What is a proof?

– Prover

– Verification process.



ZK Proof

• Features:

– Verifier cannot learn anything from theprotocol

– The prover cannot cheat the verifier

– Verifier cannot cheat the prover

– The verifier cannot pretend to be prover in a

third party.



Demo



Authentication

• Principal: Legitimate owner of a given identity.• Claimant: Entity attempting to be authenticated

as principal.• Authentication factors:

– Claimant demonstrates knowledge of something – Claimant demonstrates possession of something

– Claimant demonstrates some required characteristics(immutable)

–

Claimant provides evidence that he/she is atparticular place. – Claimant provides proof that he/she is authenticated

by trusted third party.



Authentication

• Weak Authentication – PINs, Passwords, Bio metric, One time pads.

• Challenge response authentication – One party sends the challenge, Second party sends a

response in pre-agreed manner that demonstratesidentity.

– If communication is monitored, old responses shouldnot provide useful information for futureidentifications.

– Challenge response with Zero knowledge proof• Use zk proof to allow Alice to demonstrate knowledge of a

secret with out revealing the secret (or any other usefulinformation) to Bob.



Multi-factor authentication

• Reliance on a single factor is ofteninsufficient.

• Multifactor authentication is combination ofmore than one factor.

• Unilateral Authentication: Just one party toa communication activity authenticatesother party (like in TLS).

• Mutual authentication.



How to solve following scenarios?

• Google, MSN, Yahoo.

• Skype, Ebay, Paypal

•

One ecommerce transaction many partiesand many servers.

• Many servers in one network, many

usernames and passwords.• Secure tunnel – proxy server in between.

• How many passwords can you remember?



NT Lan Manager (NTLM)



Kerberos

• One time authentication for multiple networkservices; developed by MIT in 1980s.

• Strong symmetric cryptography.

•

Usage of tickets, and time stamps.• Kerberos Server (Key distribution Center – the

KDC). Divided into 2 services – Authentication Service

– Ticket Granting Service• All network servers treat KDC as trusted third

party.



How it works?



Needham – Schroeder Protocol



Kerberos in detail

• Authentication server has list of all users andtheir passwords.

• Authentication server also has shared secret keywith ticket granting server.

• Client authenticates himself to AS. Serverresponds with ticket.

• When ever client wants to communicate withother servers, he will have to approach TGS first

with ticket given by AS.• TGS server gives another ticket for

corresponding network server.



Reading Assignment

• Improvements in conventional PKI wisdom



Thank you.

week two orientation

Documents