comp 3271 chapter 13

Introduction to Computer Network Security

• Information is a valuable asset requiring security measures to protect against attacks.
• Securing information involves confidentiality, integrity, and availability.
  • Confidentiality: Hiding information from unauthorized access.
  • Integrity: Protecting information from unauthorized modification.
  • Availability: Ensuring information is accessible to authorized entities when needed.

Security Goals

• Confidentiality, integrity, and availability are key security goals.

Security Ataacks

• Security attacks threaten confidentiality through snooping and traffic analysis.
• Data integrity is threatened by modification, masquerading, replaying, and repudiation attacks.
• Availability is threatened by denial-of-service attacks.

Secuity Services and Techniques

• ITU-T defines security services for achieving security goals and preventing attacks.
• Implementing security involves techniques like cryptography and steganography.
  • Cryptography is a general technique involving symmetric-key encipherment, asymmetric-key encipherment, and hashing.
  • Steganography is a specific technique that focuses on covered writing, different from cryptography's "secret writing".

Confidentiality and Ciphers

• Confidentiality is achieved using ciphers divided into symmetric-key and asymmetric-key categories.

Symmetric-Key Ciphers

• A symmetric-key cipher uses the same key for encryption and decryption, enabling bidirectional communication.
• Traditional ciphers include substitution and transposition ciphers.

Modern Symmetric-Key Ciphers

• Modern symmetric-key ciphers are bit-oriented and can be block or stream ciphers.
• They address the need to encrypt numbers, graphics, audio, and video data, not just text.
• Using 8 or 16 bits per character increases the number of symbols and security.

Asymmetric-Key Ciphers

• Asymmetric-key ciphers complement symmetric-key, offering advantages that compensate for each other's disadvantages.

RSA Cryptosystem

• The RSA cryptosystem, named after Rivest, Shamir, and Adleman, is a common public-key algorithm.
• RSA uses two exponents, e (public) and d (private).
• Alice creates ciphertext C from plaintext P using: C = Pe mod n.
• Bob retrieves P using: P = Cd mod n.
• Modulus n, a large number, is created during key generation.

Other Aspects of Security

• Modern communication requires considering integrity, message/entity authentication, nonrepudiation, and key management in addition to confidentiality.

Message Integrity

• Message integrity ensures that a message remains unchanged.

Message and Message Digest

• Message integrity can be preserved using a fingerprint.
• A message digest is similar to a fingerprint, which can be compared to ensure it is the same.

Hash Functions

• Cryptographic hash functions produce a fixed-length message digest from a message of arbitrary length.
• Iteration is used, incorporating a fixed-size input function (compression function).

Message Authentication

• Including a secret shared between Alice and Bob that Eve doesn't possess during the process; we need to create a message authentication code (MAC).

Digital Signature vs HMAC

• A MAC uses a secret key to protect the digest, while a digital signature uses a pair of private-public keys.

Digital Signatures

• With digital signatures, the sender uses a signing algorithm; the receiver verifies using a verifying algorithm.

Security Services Through Digital Signatures

• Digital signatures provide message authentication, message integrity, and non-repudiation.
• Confidentiality still requires encryption/decryption.

RSA for Digital Signatures

• RSA can also be used for signing and verifying a message and is known as the RSA digital signature scheme.
• Only the sender's private and public keys are used, unlike during RSA encryption.

Entity Authentication

• Entity authentication is a technique where one party verifies the identity of another.
• The entity to be proven is the claimant; the verifying party is the verifier.

Types of Authetication

• The claimant must identify via something known, possessed, or inherent.

Passwords

• Password is the oldest method of entity authentication that is considered prone to attack.

Challenge-Response Authentication

• Challenge-response authentication involves proving knowledge of a secret without sending it. The verifier either possesses or retrieves the secret.

Key Management

• Secret keys must be handled and distributed with appropriate care.
• Public keys in asymmetric-key cryptography need to be handled in a similar fashion.

Symmetric-Key Distribution

• Symmetric-key cryptography requires a shared secret key between two parties and is more efficient than asymmetric-key methods for large messages.
• Exchanging confidential messages with N people requires N distinct keys.
• Two people are required to use two keys when communicating back and forth.

Public-Key Distribution

• People don’t need to share the same key as they do in symmetric approaches.
• Public keys are open and available to everyone to use.

Network-Layer Security

• Network-layer security is applied between hosts, routers, etc., to protect applications using the network layer.

IPSec Modes

• IPSec operates in transport or tunnel mode.
  • Transport mode protects data delivered from the transport layer.
  • Tunnel mode protects the entire IP packet by applying IPSec security methods to the entire packet then adds a new IP header.

IPSec Security Protocols

• IPSec defines the Authentication Header (AH) and Encapsulating Security Payload (ESP) protocols for authentication for packets at the IP level.

Authentication Header (AH)

• Ensures the integrity of the payload, authenticates the origin of the packet; It uses a hash function and the secret key to create a message digest.
• AH doesn't provide confidentiality.

Encapsulating Security Payload (ESP)

• Provides source authentication, integrity, and confidentiality using both a header and a trailer.

AH and ESP for IPv4 and IPv6

• AH and ESP are part of the extension header for IPv6.

IPSec Provided Services

• AH and ESP protocols provide security services for packets at the network layer.

Services

• Access Control is provided by IPSec using a Security Association Database (SAD).
• Message integrity is preserved in AH and ESP.
• Entity authentication is possible via keyed-hash sent by the sender in both AH and ESP.
• AH doesn't provide confidentiality.
• Replay attacks are prevented through sequence numbers and a sliding receiver window in both protocols.

IPSec: Security Association

• Each IPSec header holds a sequence number when the association is made.
• When that number is maxed out, the association is deleted.
• Window size is fixed at receiver.

Internet Key Exchange (IKE)

• Designed to create inbound and outbound Security Associations as needed to send IP packets; consults the Security Policy Database (SPD).

Virtual Private Network (VPN)

• A virtual private network (VPN) has gained in popularity.

Transport-Layer Security

• It provides security for the application layer and uses the services of TCP or SCTP as a connection-oriented protocol.
• Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocol provide this security at the transport layer.

SSL Security

• SSL provides reliable transport layer protocol
• SSL architecture was developed to provides security and communication services for data from the application layer.
• Developed by Netscape

SSL - Services Provided

• Fragmentation
• Compression
• Message Integrity
• Confidentiality
• Framing

SSL: Four Protocols in Two Layers

• Defines four protocols in two layers for the idea itself.
  • Handles messages
  • SSL defines these protocols in it’s layers, as well as others.

SSL: Handshake Protocol

• Authenticates the server, client, and messages needed to send private data.

SSL: Change Cipher Set Protocol

• Exchange for cryptographic messages
• Send/receive messages during the procedure.

SSL: Alert Protocol

• Alerts used for reporting errors or abnormal activity

SSL: Record Protocol

• Carries messages from the upper layer
• Message is fragmented/compressed.
• Negotiated hash algorithm

E-Mail Security

• The creation of a session is not applicable to e-mails.
• Two protocols provide mail security through Pretty Good Privacy and Secure/Multipurpose Internet Mail Extension (S/MIME).

Security Algorithms

• Agree on cryptographic algorithms to use
• No session to negotiate a hand shake for algorithms.
• Alice includes her system information.
• Identifier for the MD5 message.

Secured Keys Through Crytography

• One time secret key sent with the message.
• Key to protect from interception, secret key encrypted with public key.

Certificates

• Certain algorithms must be used for e-mail key.
• Messages need to be signed to encrypt the secret.

Pretty Good Privacy

• Pretty Good Privacy (PGP) provides e-mail with privacy, integrity, and authentication.
• Is often used to creat secure messages for e-mail.

PGP Authentication

• Alice uses authentication that will need to show private data key and public data key.

Public Key Protection

• Can be made more secure with data compression.

PGP: Key Rings

• Used or needed for many individuals.
• Alice should have public keys
• In addition to PGP’s designer, specified a private /public key.

PGP Algorithms

• A set of asymmetric-key techniques ,cryptography hashing and compressions.

PGP Certificates

• Authentication is a key requirement to PGP
• Public Keys is the security, in all similar steps.

S/MIME

• Extension for e-mail access and secured communication via secured data.
• Uses the MIME protocol.

Cryptograph Message Syntax

• S/MIME defines how security services work.
• Syntax defines the scheme
• Referenced by RFC 3369/3370

Firewalls for Control

• Need firewall to keep out unwanted information.
• Forwards only some packets

Packet-Filter Firewalls

• Packet blocker, to base packets on IP.
• Transport/layer header
• TCP/UDP
• Router uses filtering patterns and discards unwanted content.

Proxy Firewalls

• Based on the layer of transport through the network,
• Can filter data based on message itself.