Distributed Systems Topic 3 Security Dr Michael R

Distributed Systems Topic 3: Security Dr. Michael R. Lyu Computer Science & Engineering Department The Chinese University of Hong Kong © Chinese University, CSE Dept. Distributed Systems / 3 - 1

Outline 1 Motivation 2 Styles of Attacks 3 Cryptography 4 Authentication, Security Protocols and Systems 5 Summary © Chinese University, CSE Dept. Distributed Systems / 3 - 2

1 Motivation ¨ More vital/secret data handled by distributed components within network systems and Internet. ¨ Security: protecting data stored in and transferred between distributed components from unauthorized access. ¨ Insecurity effect: Confidential Data may be stolen, e. g. : – corporate plans. – new product designs. – medical/financial records (e. g. Access bills…) ¨ Insecurity effect: Data may be altered, e. g. : – finances made to seem better than they are. – results of tests, e. g. on drugs, altered. – examination results amended (up or down). © Chinese University, CSE Dept. Distributed Systems / 3 - 3

2 Security Threats ¨ Categorization of attacks (and goals of attacks) that may be made on system. ¨ Three broad classes: – leakage: information leaving system. – tampering: unauthorized information altering. – vandalism: disturbing correct system operation. ¨ Used to specify what the system is proof, or secure, against. ¨ Attacks: Passive and Active © Chinese University, CSE Dept. Distributed Systems / 3 - 4

2 Passive Attacks ¨ Eavesdropping on transmissions – Receive message copies without authority. ¨ To obtain information ¨ Release of message contents – Outsider learns content of transmission ¨ Traffic analysis – By monitoring frequency and length of messages, even encrypted, nature of communication may be guessed ¨ Difficult to detect ¨ Can be prevented © Chinese University, CSE Dept. Distributed Systems / 3 - 5

2 Active Attacks u u u Masquerading: Pretending to be a different entity without authority. Message tampering: Intercepting and altering messages. Replaying: Storing messages and sending them later. Denial of service: Flooding server resources with messages in order to deny other’s access. Hard to prevent Easy to detect – Detection may lead to deterrent © Chinese University, CSE Dept. Distributed Systems / 3 - 6

2 Security Attack Scenarios Eavesdropping: Bob “Let’s meet at 5 pm, old place” Tom Tampering: Bob Replaying: Bob “Let’s meet at 5 pm today” Tom © Chinese University, CSE Dept. “hee hee…” “Let’s meet at 5 pm, old place” Tom Alice “Let’s meet at 3 pm, old place” Alice One day later: “Let’s meet at 5 pm today” Distributed Systems / 3 - 7

3 Cryptography 1 Introduction 2 Terminology 3 Encryption 4 Secret Keys 5 Public Keys 6 RSA Encryption Algorithm © Chinese University, CSE Dept. Distributed Systems / 3 - 8

3. 1 Introduction ¨ Cryptography: encode message data so that it can only be understood by intended recipient. ¨ Romans used it in military communication. ¨ Given knowledge of encryption algorithm, a brute force attempt is to try every possible decoding until a valid message is produced. ¨ Computers are good at this! ¨ Modern schemes must be computationally hard to solve to remain secure. © Chinese University, CSE Dept. Distributed Systems / 3 - 9

3. 2 Cryptographic Terminology ¨ Plain text: the message before encoding (by encryption). ¨ Cipher text: the message after encoding. ¨ Key: information needed to convert from plain text to cipher text (or vice-versa). ¨ Function: the encryption or decryption algorithm used, in conjunction with key, to encode or decode message. ¨ Key distribution service: trusted service which hands out keys. © Chinese University, CSE Dept. Distributed Systems / 3 - 10

3. 3 Encryption ¨ Encrypting data prevents unauthorized access to the data (i. e. , prevents eavesdropping). ¨ If encrypted data can only be encrypted with a matching key, this can be used to prove sender’s identity (i. e. , prevents masquerading). ¨ Likewise, it can be used to ensure that only intended recipients can use the data. ¨ Two main ways: secret key and public key. © Chinese University, CSE Dept. Distributed Systems / 3 - 11

3. 4 Secret Keys ¨ One key is used to both encrypt and decrypt data ¨ Encryption and decryption functions are often chosen to be the same type ¨ Security should not be compromised by making function well-known as security comes from secret keys ¨ Example: Enigma Encription Machine © Chinese University, CSE Dept. Distributed Systems / 3 - 12

3. 4 Enigma Encryption Machine © Chinese University, CSE Dept. Distributed Systems / 3 - 13

3. 4 Using Secret Keys ¨ Sender and recipient exchange keys through some secure, trusted, non-network based means. ¨ Sender encodes message using encryption function and sends the message, knowing that only the holder of key (the intended recipient) can understand it. ¨ Recipient decodes message, and knows that only intended sender could generate it. ¨ Message can be captured but is of no use. © Chinese University, CSE Dept. Distributed Systems / 3 - 14

3. 4 Simplified Model of Secret Key (Symmetric Key) Encryption © Chinese University, CSE Dept. Distributed Systems / 3 - 15

3. 4 Secret Key Encryption Algorithms ¨ Historical cipher – Caesar Cipher – Monoalphabetic Cipher – Polyalphabetic Cipher ¨ Block cipher – Process plain text in fixed block sizes producing block of cipher text of equal size – Data encryption standard (DES) – Triple DES (3 DES) – Advanced Encryption Standard (AES) © Chinese University, CSE Dept. Distributed Systems / 3 - 16

3. 4. 1 Caesar Cipher u u u Each letter in plaintext is substituted with letter that is K letters later Wrap around is allowed (i. e. , z followed by letter a) If K = 3, a in plaintext becomes d in cipher text b in plaintext becomes e in cipher text —Participation Exercise: “Dolfh, L oryh brx. Ere” —Once it is known that Caesar cipher is being used, it is easy to break the code (only 25 possible key values). © Chinese University, CSE Dept. Distributed Systems / 3 - 17

3. 4. 1 Attacking Caesar Cipher: Brute-Force ¨ Brute-Force attack is based on the making sense feature of the data by trying every possible key. ¨ Suppose that the cipher “mrsxocoexsfobcsdi” is the result of a Caesar shift cipher. ¨ Since the key space is {0, 1, …, 25}, then the possible plaintexts are: mrsxocoexsfobcsdi, nstypdpfytgpcdtej, otuzqeqgzuhqdeufk, puvarfrhavirefvgl, qvwbsgsibwjsfgwhm, rwxcthtjcxktghxin, sxyduiukdyluhiyjo, tyzevjvlezmvijzkp, uzafwkwmfanwjkalq, vabgxlxngboxklbmr, wbchymyohcpylmcns, xcdiznzpidqzmndot, ydejaoaqjeranoepu, zefkbpbrkfsbopfqv, afglcqcslgtcpqgrw, bghmdrdtmhudqrhsx, chineseuniversity, dijoftfvojwfstjuz, ejkpgugwpkxgtukva, fklqhvhxqlyhuvlwb, glmriwiyrmzivwmxc, hmnsjxjzsnajwxnyd, inotkykatobkxyoze, jopulzlbupclyzpaf, kpqvmamcvqdmzaqbg, lqrwnbndwrenabrch © Chinese University, CSE Dept. Distributed Systems / 3 - 18

3. 4. 2 Monoalphabetic Cipher u u Improvement on Caesar Cipher Rather than substituting according to a regular pattern – any letter can be substituted for any other letter, as long as each letter has a unique substitute letter, and vice versa. Example of a monoalphabetic cipher u Plain Text: abcdefghijklmnopqrstuvwxyz u Cipher Text: m n b v c x z a s d f g h j k l p o i u y t r e w q Complexity: – _______ Possible pairings of letters – so breaking code is not as easy as in the case of Caesar cipher. Distributed Systems / 3 - 19 © Chinese University, CSE Dept.

3. 4. 2 Cryptanalysis: Simple Example ¨ Mono-alphabetic substitution ciphers can be broken by simple frequency analysis ¨ The relative frequency of letters in English text is distinct (shown in table) Letter: a b c d e f g h i Frequency: 7 1 3 4 13 3 2 3 8 Letter: n o p q r s t u Frequency: 8 7 3 <1 8 6 9 3 j k l m <1 <1 4 3 v w x y z 1 1 <1 2 <1 ¨ Ciphertext frequencies can be used to guess plaintext letters © Chinese University, CSE Dept. Distributed Systems / 3 - 20

3. 4. 2 Deducing the Keyword © Chinese University, CSE Dept. Distributed Systems / 3 - 21

3. 4. 2 Cryptanalysis ¨It is the art and science of breaking ciphers, ciphertexts, or keys. ¨Brute-force: A cryptanalysis where all possible keys are tested, and then the result possible plaintext are analyzed. ¨Statistical analysis: single-letter appearance frequency; “q” is mostly followed by “u”; multi-letter frequency. ¨Known plaintext-ciphertext combination. © Chinese University, CSE Dept. Distributed Systems / 3 - 22

3. 4. 3 Polyalphabetic Encryption • Use multiple monoalphabetic/Caesar ciphers • Use a specific monoalphabetic/Caesar cipher to encode a letter in a specific position in the plain text message • This implies that same letter appearing in different positions in the plaintext might be encoded differently. Example: 2 Caesar ciphers; K = 5, K = 19 For every 5 bits in the plain text use the 2 Caesar ciphers in the following pattern: C 1, C 2, C 1, C 2 © Chinese University, CSE Dept. Distributed Systems / 3 - 23

3. 4. 3 Example: Vigenere Cipher ¨ In the Vigenere cipher, the character in the ciphertext is chosen from a two-dimensional table (26 x 26), in which each row is a permutation of 26 characters (A to Z). © Chinese University, CSE Dept. Distributed Systems / 3 - 24

3. 5 Public Key Cryptography symmetric key crypto ¨ requires sender, receiver know shared secret key ¨ Q: how to agree on key in first place (particularly if never “met”)? © Chinese University, CSE Dept. public key cryptography ¨ radically different approach ¨ sender, receiver do not share secret key ¨ public encryption key known to all ¨ private decryption key known only to receiver Distributed Systems / 3 - 25

3. 5 Public Key Cryptography + Bob’s public B key K K plaintext message, m encryption algorithm © Chinese University, CSE Dept. ciphertext + B K (m) - Bob’s private B key decryption algorithm plaintext message + m = K B(K (m)) B Distributed Systems / 3 - 26

3. 5 Using Public Keys ¨ Recipient generates key pair. ¨ Public key is published by trusted service. ¨ Sender gets public key, and uses this to encode a message. ¨ Recipient decodes the message. ¨ Replies can be encoded using sender’s public key from the trusted distribution service if twoway security is needed. ¨ Message can be captured but is of no use. © Chinese University, CSE Dept. Distributed Systems / 3 - 27

3. 5 Public Keys ¨ Gives 'one-way' security. ¨ Two keys generated, one used with decryption algorithm (private key) and one with encryption algorithm (public key). ¨ Generation of the private key, given only the public key, is computationally hard. ¨ Do not need secure key transmission mechanism for key distribution. © Chinese University, CSE Dept. Distributed Systems / 3 - 28

3. 5 Public Key Cryptosystems Some examples of public-key cryptosystems are: ¨ Elgamal (named for its inventor, Taher Elgamal) ¨ RSA (named for its inventors, Ron Rivest, Adi Shamir, and Leonard Adleman) ¨ Diffie-Hellman (named, you guessed it, for its inventors) ¨ DSA, the Digital Signature Algorithm, (invented by David Kravitz). © Chinese University, CSE Dept. Distributed Systems / 3 - 29

3. 5 RSA Public Key Encryption Algorithm Requirements: 1 2 need + KB ( ) and KB ( ) such + K (K (m)) = m B B . . that + KB given public key , it should be impossible to compute private key KB RSA: Rivest, Shamir, Adelson algorithm © Chinese University, CSE Dept. Distributed Systems / 3 - 30

3. 6 RSA: Choosing Keys 1. Choose two large prime numbers p, q. (e. g. , 1024 bits each) 2. Compute n = pq, z = (p-1)(q-1) 3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”). 4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5. Public key is (e, n). + KB © Chinese University, CSE Dept. Private key is (d, n). - KB Distributed Systems / 3 - 31

3. 6 RSA: Encryption, Decryption 0. Given (e, n) and (d, n) as computed above 1. To encrypt bit pattern, m, compute e e (i. e. , remainder when m is divided by n) c = m mod n 2. To decrypt received bit pattern, c, compute (i. e. , remainder when cd is divided by n) m = cd mod n Magic happens! © Chinese University, CSE Dept. m = (m e mod n) d mod n c Distributed Systems / 3 - 32

3. 6 RSA: Why is that m = (m e mod n) d mod n Useful number theory result: If p, q prime and n = pq, then: y mod (p-1)(q-1) y x mod n = x mod n e (m mod n) d mod n = med mod n = m ed mod (p-1)(q-1) mod n (using number theory result above) 1 = m mod n (since we chose ed to be divisible by (p-1)(q-1) with remainder 1 ) = m © Chinese University, CSE Dept. Distributed Systems / 3 - 33

3. 6 An RSA Example Bob chooses p=5, q=7. Then n=35, z=24. e=5 (so e, (p-1)(q-1) relatively prime). d=29 (so ed-1 exactly divisible by (p-1)(q-1)). encrypt: decrypt: letter m me k 12 248832 c 17 © Chinese University, CSE Dept. c d 48196857210675091411825223071697 c = me mod n 17 m = cd mod n 12 letter k Distributed Systems / 3 - 34

3. 6 Public Key Security ¨ It is based on mathematically well-known hard problems. ¨ So deducing the private key from the public key is as hard as the equivalent problem. ¨ For instance, RSA is based on “integer multiplication and factoring” as a One Way Function (1589762001 69873203 = 110872143408559203). p, q © Chinese University, CSE Dept. N (=pq) Distributed Systems / 3 - 35

3. 6 RSA: Another Important Property The following property will be very useful later: - + B B K (K (m)) = m = use public key first, followed by private key + K (K (m)) B B use private key first, followed by public key Result is the same! © Chinese University, CSE Dept. Distributed Systems / 3 - 36

3. 6 Public-Key Cryptography © Chinese University, CSE Dept. Distributed Systems / 3 - 37

4 Authentication 1. 2. 3. 4. Motivation Overall of Authentication Key Distribution Authentication and Key Distribution: Needham/Schroeder Protocol © Chinese University, CSE Dept. Distributed Systems / 3 - 38

4. 1 What is Authentication? Authentication: Proving you are who you claim to be. ¨ In centralized systems: Password check at session start. ¨ In distributed systems: – Ensuring that each message came from claimed source. – Ensuring that each message has not been altered. – Ensuring that each message has not been replayed. © Chinese University, CSE Dept. Distributed Systems / 3 - 39

4. 2 Overall of Authentication ¨ Securing communication from eavesdropping. ¨ Authentication will usually involve encrypting data. ¨ This can be used just at the start to prove the identity of both ends of the communication link. ¨ Using secure key distribution. © Chinese University, CSE Dept. Distributed Systems / 3 - 40

4. 3 Key Distribution Options: ¨ Key selected by A and delivered to B ¨ Third party selects key and delivers to A and B ¨ Use old key to encrypt and transmit new key from A to B ¨ Use old key to transmit new key from third party to A and B © Chinese University, CSE Dept. Distributed Systems / 3 - 41

4. 3 Automatic Key Distribution for Connection-Oriented Protocols © Chinese University, CSE Dept. Distributed Systems / 3 - 42

4. 4 Needham/Schroeder Protocol: Authentication & Key Distribution ¨ Provides a secure way for pairs of components to obtain keys to be used during communication. ¨ Based on an authentication server (key distribution center): – maintains a name and a secret key for each component. – can generate keys for peer-to-peer communications. ¨ Secret keys are used for communication with authentication server. © Chinese University, CSE Dept. Distributed Systems / 3 - 43

4. 4 Needham/Schroeder Protocol CS , { K CS , C N , C S , K 2: { 1: C, S, N C }K } S K C Authentication Server C © Chinese University, CSE Dept. 3: {KCS, C}KS 4: {NS}KCS 5: {NS-1}KCS S C: S: KC : KS: KCS: Client Name Server Name Client´s secret key Server´s secret key Secret key for client/server communication Nx: Nonce generated by x {M}K: Message encrypted in key K Distributed Systems / 3 - 44

5 Summary ¨ Threats, Methods of Attack, Infiltration ¨ Cryptology: – Secret Keys – Public Keys ¨ RSA Algorithm ¨ Authentication ¨ Needham/Schroeder Protocol for Authentication and Key Distribution ¨ Read Textbook Chapter 11 © Chinese University, CSE Dept. Distributed Systems / 3 - 45