Security Handshake Pitfalls

Transkript

1 handshake 1 Security Handshake Pitfalls Slide 1 Login with Shared Secret: Variant 1 B: R, A:K AB frg, wherekfg can be hash ffl authentication not mutual ffl connection hijacking ffl off-line password attack ffl compromise of database at Bob impersonate Alice Slide 2

2 handshake 2 Login with Shared Secret: Variant 2 B: K AB frg, A:R where Kfg is reversible (DES) ffl T: get K without eavesdropping off-line guessing ffl weakness of Kerberos 4 ffl if R has non-random part (e.g., timestamp), Alice can authenticate Bob Slide 3 Login with Shared Secret: One Way A: K Alice Bob ftimestampg ffl requires synchronized clocks ffl piggyback on password scheme ffl stateless ffl replay attacks remember messages within clock skew window ffl replay attack: several servers with same secret include server name ffl need to protect Bob s clock from being set back secure NTP use MD instead of encryption include timestamp in the clear Slide 4

3 handshake 3 One-Way Public Key A: hi; B: R;A:[R] Alice A signs R A: hi; B: frg Alice ;A:R A signs R ffl database at B only write-locked, not read-locked ffl either signature (DSS, RSA) or encryption (RSA) ffl can trick Alice into signing or decrypting message ffl new protocol can compromise old! ffl impose structure on message for different uses PKCS Slide 5 Lamport s Hash ffl safe from eavesdropping, database reading ffl no public key cryptography ffl Alice (human + workstation): password ffl Bob (server): username, n (decremented on login), hash n (pw) Authentication: ffl Alice: name! Bob; Bob: n! Alice ffl Alice: send x =hash n 1 (pw) ffl Bob: compare hash(x) with database ffl Bob: store new value ffl new password: transmit unencrypted Slide 6

4 handshake 4 Lamport s Hash, Salted ffl random number r (seed, salt), stored at Bob ffl transmit hash n (pjr) ffl different r for differentservers ffl re-install with different seed value ffl avoids precomputation of hashes from dictionary, comparing with database Slide 7 Lamport s Hash Small n Attack ffl no mutual authentication ffl Bob sends small n, say,50 ffl Alice sends hash 50 ffl Bob can generate hash 51 ; hash 52 ;::: ffl Alice has to check if next lower n pencil-and-paper Slide 8

5 handshake 5 S/KEY and OTP ffl Karn (Bellcore): S/KEY ffl RFC 2289 (Feb. 1998) Lamport with alphanumeric salt hash: MD4, MD5, SHA1 challenge: otp-md5 n seed 64-bit hash: MD5(pw j seed) XOR! 64-bits use either 16 hex digits or six words (1 to 4 letters, 11 bits) for key race condition: finish before legitimate user Slide 9 Mutual Authentication: Shared Secret (simplified) A! B I m Alice, R 2 B! A R 1, K AB fr 2 g A! B K AB fr 1 g Slide 10

6 handshake 6 Mutual Authentication Reflection attack T! B I m Alice, R 2 B! T R 1, K AB fr 2 g Second login by Trudy: T! B I m Alice, R 1 B! T R 3, K AB fr 1 g Fixes: ffl different keys for Alice, Bob (derived key) T can t get B to encrypt something using A s key ffl different-type challenges for initiator and responder ffl initiator first to prove identity ffl password guessing: don t reveal K(R), R chosen by T Slide 11 Mutual Authentication: Public Keys A! B B! A I m Alice, fr 2 g B R 2, fr 1 g A A! B R 1 variant: sign instead of encrypt ffl get signed public key (third party, Alice) from Bob ffl Bob stores his public key encrypted with Alice s password Slide 12

7 handshake 7 Mutual Authentication: Timestamps (Shared Secret) A! B I m Alice, K AB ftg B! A K AB ft +1g t +1 Trudy can impersonate Alice include direction flag Slide 13 Session Keys ffl limits exposure of secrets to semi-trusted components shared secrets public keys Bob knows Alice s public key, Alice knows private key Alice knows password, Bob knows n and hash n (pw) Slide 14

8 handshake 8 Session Key: Shared Secret A! B B! A A! B I m Alice R K AB frg ffl use (K AB +1)fRg as session key or f (K AB )frg ffl K AB (R +1)bad Trudy can record and then challenge with R +1 ffl not quantity encrypted with K AB Slide 15 Session Key: Two-Way Public Key A! B: frg B ffl weakness: T can send own frg to B A! B: [frg B ] A ffl can record conversation, break into B, decrypt ffl Alice forgets R overrunning A doesn t help A: R 1,B:R 2 A! B: fr 1 g B ; B! A: fr 2 g A key R1 Φ R2 ffl T needs to overrun both ffl T needs to decrypt one no need to sign Diffie-Hellman with signing no bucket-brigade attack Slide 16

9 handshake 9 Privacy and Integrity ffl replay attack long sequence numbers ffl sequence number space rollover key rollover Slide 17 Mediated Authentication ffl KDC sends shared session key encrypted with destination key ffl avoid race conditions: KDC sends ticket to A AwantsB KAfKABg KDC KBfKABg Slide 18

10 handshake 10 Needham-Schroeder ffl nonce: number used once seq. no., random number 1. A! KDC: N 1, Alice wants Bob 2. K A fn 1 ; Bob ; ticketg N 1 to authenticate KDC ticket = K B fk AB ; Alice g KDC ensures Bob that it s Alice 3. A! B: challenge Bob with K AB fn 2 g, send ticket 4. B! A: K AB fn 2 1;N 3 g B proves knowledge of K AB 5. A! B: K AB fn 3 1g A proves knowledge of K AB Slide 19 Needham-Schroeder: Reflection Attack B! A: K AB fn 2 1;N 3 g ffl assume: N i multiple of encryption blocksize ffl ECB message splicing: put together own plus revealed ffl with CBC, no need to decrement N 2 ;N 3 Slide 20

11 handshake 11 Needham-Schroeder: Limit Compromise ffl Trudy steals Alice s key can impersonate Alice until key change. ffl Alice changes key ticket to Bob stays valid ffl also: T steals old key of Alice ffl fix: 1. A! B: hello!? 2. B! A: K B fn B g, N B made part of ticket B knows Slide 21 Otway-Rees ffl 5 messages, no use of stale tickets ffl suspicious party should generate challenge 1. nonce N C 2. KDC checks if N C the same in both Bob p 3. give ticket; ensures that KDC and Bob are legit 4. B hands (unreadable to B) ticket to A 5. A proves knowledge of K AB ; A trusts KDC to authenticate B Slide 22

12 handshake 12 Kerberos V4 ffl based on Needham-Schroeder, but with timestamps ffl save exchange of nonces Slide 23 Bellovin-Merritt ffl prevent password guessing when T has R, KfRg ffl eavesdropping or address faking of A, B ffl Diffie-Hellman exchange, encrypted with shared secret ffl agreeoncommonkey ffl finally, prove possession of common key ffl can t guess key from D-H: random numbers! ffl K is just session key ffl avoid reflection attack Slide 24

13 handshake 13 Bellovin-Merritt, with Hash ffl Bob only stores hash of A s password and private key encrypted with password ffl K AB = hash(pw) ffl D-H shared secret K based on hash ffl Alice proves knowledge of K (=hash) by encrypting R ffl Bob encrypts Alice s encrypted private key ffl Alice signs R, Bob verifies using public key ffl Bob needs to keep encrypted password secret! Slide 25 Avoiding Password Guessing ffl Don t send encrypted version and plaintext ffl protection against active and passive attacks ffl another attack: impersonate Bob 1. send to anyone active attack 2. prove knowledge of Alice s secret 3. encrypt (2) via session key 4. encrypt (2) with secret or public key for Bob 5. use Bellovin-Merritt, then (1) or (2) Slide 26

14 handshake 14 Nonce Types ffl timestamp synchronized clocks ffl large random number cannot predict, guess ffl sequence number non-volatile state Slide 27 Nonce Types: Sequence Numbers A! B B! A B! A I m Alice K AB frg (K AB +1)fRg R just has to be non-repeating Slide 28

15 handshake 15 Random Numbers needed for: ffl cryptographic keys ffl challenges ffl IVs ffl per-message secrets for El-Gamal/DSS random: unpredictable (ß) or unguessable pseudorandom: deterministic algorithm ffl thermal (noise diode), video, audio noise ffl keyboard timing, disk seek times ffl current clock bits Slide 29 ffl process number, system load, number of users,... ffl packets seen, sent ffl hardware id Slide 30

16 handshake 16 Generating Random Numbers ffl start with random seed, then hash ffl pseudorandom number generator: 1. hash of seed 2. hash of (previous output j seed) Slide 31 Performance Computation: bytes hashed, private key > public key; parallelization? Delay: message exchanges Cacheability: for repeated authentication Slide 32