Network Security
Network Entities: Friends and Enemies
Insecure
medium
 well-known in network security world
 Bob, Alice want to communicate 'securely'
 Trudy, the intruder may intercept, delete, add messages
Routers – exchange tables
Email applications – exchange secure emails
Client-server – establish secure transport connection
What is network security?
DESIRABLE PROPERTIES OF SECURE CONNECTION
1
Secrecy: only sender, intended receiver
should understand message contents
– sender encrypts messages
– receiver decrypts messages
2
3
Authentication: sender, receiver want to
confirm identity of each other
Message Integrity: sender, receiver want to
be sure message did not get altered (in
transit), or get altered without detection
What is network security?
DESIRABLE PROPERTIES OF SECURE CONNECTION
4
Availability and Access Control:
• communication can occur in the first place
– Prevent Denial-of-Service attacks (DoS)
• ensures network entities can gain access to
resources if they have access rights and
perform accesses in a well-defined manner
– Firewall – controls access to and from the
network by regulating which packet can pass
into and out of the network
Network Security
CYCLE IN ACHIEVING NETWORK SECURITY
1
2
Protect: network communication and
network resources
Detect: breaches of secure communication &
attacks on infrastructure
3
Respond: deployment of additional
protection mechanisms
Public Key Cryptography
Is it possible to communicate with encryption without having a shared secret
key known in advance?
symmetric key crypto
• requires sender,
receiver know
shared secret key
• Q: how to agree on
key in first place
(particularly if never
met)?
• Typical problem in
the Internet
public key cryptography
 radically different approach
[Diffie-Hellman76, RSA78]
 sender, receiver do not share
a secret key
 encryption key is public
(it is known to all)
 decryption key private
(known only to receiver)
Public key cryptography
Figure 7.7 goes here
Public key encryption algorithms
Two inter-related requirements:
.
.
1 need d B( ) and e ( ) such that
B
d B (eB (m)) = m
2 need public and private keys
for d B ( ) and e B ( )
.
.
RSA: Rivest, Shamir, Adleman algorithm
RSA: Choosing keys
1. Choose two large prime numbers p, q.
(e.g., 1024 bits each)
2. Compute n = pq, z = (p -1)(q -1)
3. Choose e (with e < n) that has no common factors
with z. (e, z are 'relatively prime').
4. Choose d such that ed -1 is exactly divisible by z.
(in other words: ed mod z = 1 ).
5. Public key is (n, e). Private key is (n, d).
In mathematics, a prime number (or a prime) is a natural number
that has exactly two (distinct) natural number divisors, which are 1
and the prime number itself. The first 30 prime numbers are 2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37,
41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, and 113
RSA: Encryption, decryption
0. Given (n,e) and (n,d) as computed above
1. To encrypt bit pattern, m, compute
e
c = m mod n
(i.e., remainder when me is divided by n)
2. To decrypt received bit pattern, c, compute
d
m = c mod n
Magic
happens!
d
(i.e., remainder when c is divided by n)
e
m = (m mod n)
d
mod n
RSA example:
Bob chooses p=5, q=7. Then n=35, z=24.
e=5 (so e, z relatively prime).
d=29 (so ed-1 exactly divisible by z)
(equivalently, ed mod z = 1).
letter
encrypt:
decrypt:
c
d
l
c
17
e
m
m
12
248832
c
d
e
c = m mod n
17
d
m = c mod n
12
letter
l
= 481968572106750915091411825223072000 - too big !! (int type)
How to solve this problem:
Cd=1729: break it into powers that are multiples of 2.
1729=1716 .178 .174. 17
174 mod 35 = 11 ;hence, 174 mod 35 = 11 mod 35,
So 11 can substitute 174, 178, and 1716 in the expression:
1729 mod 35 = 114 . 112 . 11 . 17 mod 35
Also 112 mod 35 = 16
1729 mod 35 = 162 . 16 . 11 . 17 mod 35
This is equivalent to calculating x, y and z as follows:
x = n4 mod 35
y = x2 mod 35
z = y2 mod 35
m = z . y . x . c mod 35 (smaller !!)
Alternatively: use a similar method to the one used in CRC.
Remember that (c.c.c) mod n = (c.c) (c mod n) ….
How to solve this problem:
Repeated Squaring: calculate y = x e mod n
int repeatSquare( int x, int e, int n) {
y=1;//initialize y to 1, very important
while (e > 0) {
if (( e % 2 ) == 0) {
x = (x*x) % n;
e = e/2;
}
else {
y = (x*y) % n;
e = e-1;
}
}
return y; //the result is stored in y
}
Let’s see the program
in action!
Real example of RSA keys
1024-bit RSA encryption key (in hex format):
n=
A9E167983F39D55FF2A093415EA6798985C8355D9A915BFB1D01DA197026170F
BDA522D035856D7A986614415CCFB7B7083B09C991B81969376DF9651E7BD9A9
3324A37F3BBBAF460186363432CB07035952FC858B3104B8CC18081448E64F1C
FB5D60C4E05C1F53D37F53D86901F105F87A70D1BE83C65F38CF1C2CAA6AA7EB
e=010001
d=
67CD484C9A0D8F98C21B65FF22839C6DF0A6061DBCEDA7038894F21C6B0F8B35
DE0E827830CBE7BA6A56AD77C6EB517970790AA0F4FE45E0A9B2F419DA8798D6
308474E4FC596CC1C677DCA991D07C30A0A2C5085E217143FC0D073DF0FA6D14
9E4E63F01758791C4B981C3D3DB01BDFFA253BA3C02C9805F61009D887DB0319
http://www.di-mgt.com.au/rsa_alg.html#realexample
This is the
real thing!
Sample Keys
N=77
e = 7;
d = 43;
e = 13;
d = 37;
e = 17;
d = 53;
e = 19;
d = 79;
RSA: Why:
d
e
m = (m mod n) mod n
Given: Number theory result: If p,q prime, n = pq, then
y
x mod n = x
e
d
(m mod n)
y mod (p-1)(q-1)
mod n
ed
mod n = m mod n
ed mod (p-1)(q-1)
= m
mod n
Recall:
Z = (p-1)(q-1)
We choose a value for d
so that:
ed-1 exactly divisible by z
(equivalently, ed mod z = 1).
(using number theory result above)
1
= m mod n
(since we chose ed to be divisible by
(p-1)(q-1) with remainder 1 )
= m
RSA: how strong is it??
RSA Challenges:
• Prize offered to anyone who can break an RSA key of a
certain size
• (See www.rsasecurity.com/rsalabs )
• US$200,000.00 for whoever solves a 2048 bits factorization
problem. No one claimed the prize so far... (no longer offered)
• Last challenge solved:
– RSA-576 $10,000 Factored in 2003 by J. Franke et al.
– Using a powerful parallel machine and very clever
algorithms
• Currently RSA-1024 is commonly used in practice
• RSA key's size matters, see next...
RSA: how strong is it??
Common sense calculation:
• Brute force factorization
– Try all the prime number P that are smaller than the Key
– When Key mod P = 0 , then we have found the factors
• How long can it take depends on the RSA key size
• Suppose we have a key of 200 bits and the factors are approximately of
the same order of digits
• Each key will have ~10100 trial divisions to do
• A 1Gflops machine could do 109 trials per second
• Say we have 109 machines in a cluster (massively parallel mach.)
• As we have only ~108 seconds/year, it would take
– 1074 years !!!
– Remember that the Earth is ~109 years old
RSA:how to implement it?
A simplistic approach:
• Translate each byte to a decimal number
• Use the RSA algorithm for each character
– Problem 1: only a few possible numbers will be used
• e.g., 256 possible characters may be mapped into non-existing
character if the key is large
– Problem 2: easy to break encryption due to language characteristics
• e.g., English uses double character such as 'll', 'rr' etc.
• A 'dictionary' attack could decrypt the message without ever
finding the factorization
• In practice the string becomes a large binary number...
RSA: Applications
- Very slow if the message is long
- Useful for short messages (e.g. Small message digest)
- Useful for sending a symmetric key to be used for a
symmetric-key cryptosystem
- In practice, RSA is used in digital signatures and
authentication purposes
RSA
IMPLEMENTATION TIPS
Client - Server
clientWindows.cpp
serverWindows.cpp
CLIENT
SERVER
Encrypted message
Decrypted message
Uses its
private key to
decrypt the
message
Uses the public
key for
encryption
socket
TCP (Transport Control Protocol)
–requires connection establishment
- server uses the listen() function
- server uses the accept() function
socket
Client - Server
clientWindows.cpp
serverWindows.cpp
CLIENT
SERVER
Encrypted message
Decrypted message
Uses its
private key to
decrypt the
message
Uses the public
key for
encryption
socket
Sample run:
Client 127.0.0.1 1234
Server’s Port number for listening
socket
Port: 1234
Server 1234
listening at Port 1234
You should run the server first, before running the client. You can
test your client and server using the same machine by using the
example run above.
Reading characters from stdin
get string from stdin
CLIENT
char* gets(char* send_buffer)
• stops reading characters when it encounters:
• a new line character (not copied into send_buffer)
• a NULL-termination character (‘\0’) is automatically appended
• if an error occurs, a NULL pointer is returned
strlen() – counts the number of characters excluding the NULL-character
A
0
A
0
B
1
B
1
C
2
C
2
‘\n’
3
4
‘\0’
3
4
‘\0’
User entry from keyboard
‘\0’
send_buffer
strlen()=3
Define your own encryption, decryption keys
• What are the values for p, q ?
• Keep in mind that the result of the encryption and
decryption operations is bounded by the computed
variable n.
ENCRYPTION: c = me mod n
DECRYPTION:
m = cd mod n
e.g. Try this: e = 17, n = 253, d = 13
Define your own encryption, decryption keys
• What are the values for p, q ?
• Keep in mind that the result of the encryption and decryption operations is
bounded by the computed variable n.
ENCRYPTION: c = me mod n
DECRYPTION:
m = cd mod n
• n affects the size of your valid character set.
• Therefore, you might want to perform some character
mapping to suit the range of values returned by the
encryption and decryption operations.
3 Sets of encryption, decryption keys
• What are the values for p, q ?
• Keep in mind that the result of the encryption and decryption
operations is bounded by the computed variable n.
ENCRYPTION: c = me mod n
DECRYPTION:
m = cd mod n
• Note: The assignment requires at least 3 sets of
encryption and decryption keys.
Encryption Operation
Keep in mind that the result of the encryption and decryption operations is bounded by
the computed variable n.
ENCRYPTION:
e
c = m mod n
DECRYPTION:
m = cd mod n
User-defined Character Set
a
b
c
...
0
1
2
...
space
^
#
7
62
9
...
100
210
25
...
253
199
255
RSA
The encryption algorithm
will assign a new index
number to any given
character
We would prefer
indexes to be
jumbled
Character Mapping
• You should be able to map a character to its equivalent userdefined index number and vice-versa.
• Character-to-index mapping and vice-versa is required in both
client and server applications.
User-defined Character Set
a
b
c
...
range
0
1
2
...
space
^
#
7
62
9
...
100
210
25
...
253
199
255
RSA
The encryption algorithm will
assign a new index number to any
given character
RSA Encryption
CLIENT
• Encryption is performed on the index of the character, and not on
the character itself.
• Note that we are doing this to simplify the problem.
ENCRYPTION: c = m e mod n
User entry
A
0
101
22
B
1
61
244
C
2
200
17
‘\0’
3
4
User-defined
mapping
RSA-encrypted
number
‘\0’
send_buffer
RSA Encryption
• Therefore, we need to perform character mapping
CLIENT
on the result of the encryption operation (new index
number of the character).
ENCRYPTION: c = m e mod n
• This is done character by character.
User-defined
mapping
User entry
A
0
101
22
$
0
B
1
61
244
¥
1
C
2
200
17
§
2
‘\0’
3
4
User-defined
mapping
RSA-encrypted
number
‘\r’
3
4
‘\0’
send_buffer
‘\n’
send_buffer
RSA
SERVER
CLIENT
Port
1024
Passive open
Port
1120
Active open
TCP connection
to Port 1024 established
Determine which key set to
use from predefined 3 key
sets
time
time
RSA
SERVER
CLIENT
Port
1024
Passive open
Port
1120
Active open
TCP connection
to Port 1024 established
Determine which key set to
use from predefined 3 key
sets
Send public key: e, and n
time
time
RSA
SERVER
CLIENT
Port
1024
Passive open
Port
1120
Active open
TCP connection
to Port 1024 established
Determine which key set to
use from predefined 3 key
sets
Send public key: e, and n
• Receive public key: e, and n
• Get user input
• Use public key to encrypt
message.
time
time
RSA
SERVER
CLIENT
Port
1024
Passive open
Port
1120
Active open
TCP connection
to Port 1024 established
Determine which key set to
use from predefined 3 key
sets
Send public key: e, and n
• Receive public key: e, and n
• Get user input
• Use public key to encrypt
message.
• Send encrypted message
time
time
RSA
SERVER
CLIENT
Port
1024
Passive open
Port
1120
Active open
TCP connection
to Port 1024 established
Determine which key set to
use from predefined 3 key
sets
Send public key: e, and n
• Receive public key: e, and n
• Get user input
• Use public key to encrypt
message.
• Send encrypted message
Receive encrypted message
Check validity of characters
Decrypt message
time
time
RSA
SERVER
CLIENT
Port
1024
Passive open
Port
1120
Active open
TCP connection
to Port 1024 established
Determine which key set to
use from predefined 3 key
sets
Send public key: e, and n
• Receive public key: e, and n
• Get user input
• Use public key to encrypt
message.
• Send encrypted message
• Receive encrypted message
• Check validity of characters
• Decrypt message
• display original message
• display decrypted message
time
time