Slide #9-1
Qu n lý khóaả
•
Khóa phiên và khóa trao iđổ
•
Trao i khóađổ
•
H t ng khóa mã hóaạ ầ
•
L u tr và thu h i khóaư ữ ồ
•
Ch ký sữ ố
Slide #9-2
Ký pháp
•
X → Y : { Z || W } k
X,Y
–
X g i cho ử Y b n tin c t o b ng cách ghép ả đượ ạ ằ Z và W
sau ó mã hóa b i khóa đ ở k
X,Y
, là khóa chia s gi a ẻ ữ X và Y
•
A → T : { Z } k
A
|| { W } k
A,T
–
A g i cho ử T m t b n tin bao g m ộ ả ồ Z c mã hóa b ng đượ ằ
khóa k
A

, là khóa c a ủ A, và W c mã hóa b ng khóa đượ ằ
k
A,T
, khóa chia s gi a ẻ ữ A và T
•
r
1
, r
2
nonces (các s ng u nhiên không l p l i)ố ẫ ặ ạ
Slide #9-3
Khóa phiên và khóa trao iđổ
•
Alice mu n g i m t b n tin ố ử ộ ả m cho Bob
–
Assume public key encryption
–
Alice generates a random cryptographic key k
s
and uses
it to encipher m
•
To be used for this message only
•
Called a session key
–
She enciphers k
s
with Bob;s public key k
B

•
k
B
enciphers all session keys Alice uses to communicate with
Bob
•
Called an interchange key
–
Alice sends { m } k
s
{ k
s
} k
B
Slide #9-4
L i ích c a khóa phiênợ ủ
•
H n ch l ng d li u c mã hóa b ng 1 khóa ạ ế ượ ữ ệ đượ ằ
–
Standard practice, to decrease the amount of traffic an
attacker can obtain
•
Ng n ch n m t s t n côngă ặ ộ ố ấ
–
Example: Alice will send Bob message that is either
“BUY” or “SELL”. Eve computes possible ciphertexts
{ “BUY” } k
B
and { “SELL” } k
B

. Eve intercepts
enciphered message, compares, and gets plaintext at
once
Slide #9-5
Các gi i thu t trao i khóaả ậ đổ
•
M c tiêu: Alice, Bob có c khóa chungụ đượ
–
Key cannot be sent in clear
•
Attacker can listen in
•
Key can be sent enciphered, or derived from exchanged data
plus data not known to an eavesdropper
–
Alice, Bob may trust third party
–
All cryptosystems, protocols publicly known
•
Only secret data is the keys, ancillary information known only
to Alice and Bob needed to derive keys
•
Anything transmitted is assumed known to attacker
Slide #9-6
Ph ng pháp truy n th ngươ ề ố
•
V n kh i u: how do Alice, Bob begin?ấ đề ở đầ
–
Alice can’t send it to Bob in the clear!
•

Gi s có bên th 3 tin c y, Cathyả ử ứ ậ
–
Alice and Cathy share secret key k
A
–
Bob and Cathy share secret key k
B
•
S d ng các khóa này trao i khóa ử ụ để đổ
chung k
s
Slide #9-7
Simple Protocol
Alice
Cathy
{ request for session key to Bob } k
A
Alice
Cathy
{ k
s
} k
A
|| { k
s
} k
B
Alice
Bob
{ k

s
} k
B
Slide #9-8
V n ấ đề
•
Làm th nào Bob bi t là ang nói chuy n ế để ế đ ệ
v i Alice?ớ
–
Replay attack: Eve records message from Alice
to Bob, later replays it; Bob may think he’s
talking to Alice, but he isn’t
–
Session key reuse: Eve replays message from
Alice to Bob, so Bob re-uses session key
•
Ph i cung c p ch c n ng xác th c ch ng ả ấ ứ ă ự để ố
l i t n công g i l pạ ấ ử ặ
Slide #9-9
Needham-Schroeder
Alice Cathy
Alice || Bob || r
1
Alice Cathy
{ Alice || Bob || r
1
|| k
s
|| { Alice || k
s

} k
B
} k
A
Alice Bob
{ Alice || k
s
} k
B
Alice Bob
{ r
2
} k
s
Alice Bob
{ r
2
– 1 } k
s
Slide #9-10
Phân tích: Alice talking to Bob
•
B n tin th 2ả ứ
–
Enciphered using key only she, Cathy knows
•
So Cathy enciphered it
–
Response to first message
•

As r
1
in it matches r
1
in first message
•
B n tin th 3ả ứ
–
Alice knows only Bob can read it
•
As only Bob can derive session key from message
–
Any messages enciphered with that key are from Bob
Slide #9-11
Phân tích: Bob talking to Alice
•
B n tin th 3ả ứ
–
Enciphered using key only he, Cathy know
•
So Cathy enciphered it
–
Names Alice, session key
•
Cathy provided session key, says Alice is other party
•
B n tin th 4ả ứ
–
Uses session key to determine if it is replay from Eve
•

If not, Alice will respond correctly in fifth message
•
If so, Eve can’t decipher r
2
and so can’t respond, or responds
incorrectly
Slide #9-12
C i ti n c a Denning-Saccoả ế ủ
•
Gi thi t: T t c khóa u bí m tả ế ấ ả đề ậ
•
Tình hu ng: Gi s Eve có th l y khóa phiên. ố ả ử ể ấ
nh h ng t i giao th c trao i khóa?Ả ưở ớ ứ đổ
–
In what follows, Eve knows k
s
Eve Bob
{ Alice || k
s
} k
B
Eve Bob
{ r
2
} k
s
Eve Bob
{ r
2
– 1 } k

s
Slide #9-13
Gi i phápả
•
Trong giao th c trên, Eve gi m o Aliceứ ả ạ
•
V n : G i l p trong b n tin th 3ấ đề ử ặ ả ứ
–
First in previous slide
•
Gi i pháp: S d ng tr ng th i gian ả ử ụ ườ ờ T phát để
hi n g i l pệ ử ặ
•
i m y u: N ng h không ng b có th t Đ ể ế ếđồ ồ đồ ộ ể ừ
ch i b n tin h p l ho c ch p nh p gói tin l pố ả ợ ệ ặ ấ ậ ặ
–
Parties with either slow or fast clocks vulnerable to
replay
–
Resetting clock does not eliminate vulnerability
Slide #9-14
Needham-Schroeder with
Denning-Sacco Modification
Alice Cathy
Alice || Bob || r
1
Alice Cathy
{ Alice || Bob || r
1
|| k

s
|| { Alice || T || k
s
} k
B
} k
A
Alice Bob
{ Alice || T || k
s
} k
B
Alice Bob
{ r
2
} k
s
Alice Bob
{ r
2
– 1 } k
s
Slide #9-15
Giao th c Otway-Reesứ
•
Kh c ph c v n ắ ụ ấ đề
–
That is, Eve replaying the third message in the
protocol
•

Không dùng tr ng th i gianườ ờ
–
Not vulnerable to the problems that Denning-
Sacco modification has
•
S d ng s nguyên ử ụ ố n k t h p t t c các để ế ợ ấ ả
b n tin trong m t trao i c thả ộ đổ ụ ể
Slide #9-16
The Protocol
Alice Bob
n || Alice || Bob || { r
1
|| n || Alice || Bob } k
A
Cathy Bob
n || Alice || Bob || { r
1
|| n || Alice || Bob } k
A
||
{ r
2
|| n || Alice || Bob } k
B
Cathy Bob
n || { r
1
|| k
s
} k

A
|| { r
2
|| k
s
} k
B
Alice Bob
n || { r
1
|| k
s
} k
A
Slide #9-17
Phân tích: Alice talking to Bob
•
B n tin th 4ả ứ
–
If n matches first message, Alice knows it is
part of this protocol exchange
–
Cathy generated k
s
because only she, Alice
know k
A
–
Enciphered part belongs to exchange as r
1


matches r
1
in encrypted part of first message
Slide #9-18
Phân tích: Bob talking to Alice
•
B n tin th 3ả ứ
–
If n matches second message, Bob knows it is
part of this protocol exchange
–
Cathy generated k
s
because only she, Bob know
k
B
–
Enciphered part belongs to exchange as r
2

matches r
2
in encrypted part of second message
Slide #9-19
T n công g i l pấ ử ặ
•
Eve có khóa c ũk
s
, và b n tin trong b c 3ả ướ

–
n || { r
1
|| k
s
} k
A
|| { r
2
|| k
s
} k
B
•
Eve g i cho Aliceử
–
Alice has no ongoing key exchange with Bob: n
matches nothing, so is rejected
–
Alice has ongoing key exchange with Bob: n does not
match, so is again rejected
•
If replay is for the current key exchange, and Eve sent the
relevant part before Bob did, Eve could simply listen to traffic;
no replay involved
Slide #9-20
Kerberos
•
H th ng xác th cệ ố ự
–

Based on Needham-Schroeder with Denning-Sacco
modification
–
Central server plays role of trusted third party
(“Cathy”)
•
Thẻ
–
Issuer vouches for identity of requester of service
•
Th xác th cẻ ự
–
Identifies sender
Slide #9-21
Ý t ngưở
•
User u xác th c t i Kerberos serverự ạ
–
Obtains ticket T
u,TGS
for ticket granting service (TGS)
•
User u mu n s d ng d ch v ố ử ụ ị ụs:
–
User sends authenticator A
u
, ticket T
u,TGS
to TGS asking
for ticket for service

–
TGS sends ticket T
u,s
to user
–
User sends A
u
, T
u,s
to server as request to use s
•
Details follow
Slide #9-22
Thẻ
•
Gi y xác nh n cho bi t ng i c p th ã nh n di n ấ ậ ế ườ ấ ẻđ ậ ệ
ng i yêu c u thườ ầ ẻ
•
Ví d v th c c p cho ụ ề ẻđượ ấ u dùng d ch v để ị ụs
T
u,s
= s || { u || u’s address || valid time || k
u,s
} k
s
where:
–
k
u,s
is session key for user and service

–
Valid time is interval for which ticket valid
–
u’s address may be IP address or something else
•
Note: more fields, but not relevant here
Slide #9-23
Th xác th cẻ ự
•
Gi y xác nh n ch a nh n di n c a ng i g i thấ ậ ứ ậ ệ ủ ườ ử ẻ
–
Used to confirm sender is entity to which ticket was
issued
•
Example: authenticator user u generates for
service s
A
u,s
= { u || generation time || k
t
} k
u,s
where:
–
k
t
is alternate session key
–
Generation time is when authenticator generated
•

Note: more fields, not relevant here
Slide #9-24
Protocol
user Cathy
user || TGS
Cathy user
{ k
u,TGS
} k
u
|| T
u,TGS
user TGS
service || A
u,TGS
|| T
u,TGS
user TGS
user || { k
u,s
} k
u,TGS
|| T
u,s
user service
A
u,s
|| T
u,s
user service

{ t + 1 } k
u,s
Slide #9-25
Phân tích
•
Hai b c u l y th ng i dùng s d ng ướ đầ ấ ẻ ườ để ử ụ
TGS
–
User u can obtain session key only if u knows
key shared with Cathy
•
B n b c ti p theo chi ra cách ố ướ ế u l y và s ấ ử
d ng th cho d ch v ụ ẻ ị ụs
–
Service s validates request by checking sender
(using A
u,s
) is same as entity ticket issued to
–
Step 6 optional; used when u requests
confirmation