System Security Cryptography Technologies CPE 261403 Operating Systems

System Security: Cryptography Technologies CPE 261403 - Operating Systems http: //www. e-cpe. org/moodle

What does the fish mean?

Ichthys

User name / Password

Threat Ex: Wifi Packet Sniffers

Protection with Cryptography

Encryption and Decryption n Symmetric – Uses a shared key n Asymmetric – Added security with Public and Private keys

Symmetric Encryption Simple example: Add a constant to the ASCII value I LOVE YOU J MPWF ZPV Key = 1

The Enigma Machine German Encryption Machine For WWI

Enigma was cracked by the Allies in WWII Some say this helped shortened WWII by two years

Some Examples n Data Encryption Standard (DES) q n Advanced Encryption Standard (AES) q n 256 bit key for every 128 bit value RC 4 q n 56 bit key for every 64 bit value As used in WEP (Wired Equivalent Privacy) WPA, WPA 2 (Wi-Fi Protected Access) q 256 bit key

Asymmetric Encryption

Algorithm Example Public Key = (kd, N) Private Key = (ke, N) n n n N = p. q (where p, q are prime numbers) Pick kd that is < N Calculate ke where q ke. kd mod (p-1)(q-1) = 1

Example n n If p = 7 and q = 13 N = 7. 13 = 91 Pick Kd = 5 Find Ke q q Ke. 5 mod (7 -1)(13 -1) = 1 Ke = 29 Public Key = (5, 91) Private Key = (29, 91)

Encrypting and Decrypting n n Encrypt message = (input ^ ke ) mod N Decrypt message = (input ^ kd) mod N If we want to send the number 69 Encrypted message = 69 ^ 5 mod 91 = 62 Decrypted message = 62 ^ 29 mod 91 = 69 *Note: number must < N

Notes n In reality p and q can be 512 bits each

Case Study: SSL (Secure Socket Layer Protocol)

An Online Bank Example Request Secure Connection (HTTPS) Sends a Public Key Browser Encrypt & Send Login/Password Is there a problem with this method? Yes. A fake web site can also send a public key SCB Server

SSL Certificate Verification Request SSL Sends key + Certificate Browser Ve rif y SCB Server

SSL Protocol Request SSL Sends key + Certificate Verify Browser Encrypt + send user/password SCB Server Ok. Now the client can send secure info to the server. But how can the bank send secure information to the client?

SSL Protocol Request SSL Sends key + Certificate Verify Browser Sends client’s public key SCB Server Data encrypted with client’s public key Do we need to verify the Server’s second response? Yes. But now it is easier.

SSL Protocol Request SSL Sends key + Certificate Verify Sends client’s public key Browser Encrypt with server’s private key SCB Server Data encrypted with client’s public key If the client can de-crypt the data with the server’s public key It verifies that data is sent from the server.

SSL Protocol Encrypt with server’s private key Data encrypted with client’s public key Browser SCB Server Double encryption is too much work. Can we optimize?

SSL Protocol Encrypt with server’s private key Encrypt with the client’s public key Send a new public key Encrypt with the new public key Secure Data Encrypt with the new private key Secure Data Browser with New (pub/pri) keys Server with New (pub/pri) keys Yes. The server can send a new set of keys for future use

Summary Request SSL Sends key + Certificate Verify Sends client’s public key Browser Send new pub key Secure Data SCB Server

Encryption is a cat & mouse game n n n Encryption is becoming more complex (64 bits, 128 bits, …, 512 bits, …, ? ) Relies on Mathematical Models. Can be cracked. Never fully trust that your data is safe with encryption