\PassOptionsToPackage{bookmarks=false}{hyperref}

\documentclass[dvipsnames,14pt,t,hyperref={bookmarks=false}]{beamer}

\usepackage{../style}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usepackage{../data}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\renewcommand{\slidecaption}{SEN 05, King's College London}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (5)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

  \normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & N7.07 (North Wing, Bush House)\\

  Slides: & KEATS (also homework is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Protocols}

\begin{center}

\includegraphics[scale=0.11]{../pics/keyfob.jpg}

\quad

\includegraphics[scale=0.3025]{../pics/startstop.jpg}

\end{center}

\begin{itemize}

\item Other examples: Wifi, Http-request, TCP-request,

card readers, RFID (passports)\ldots\medskip\pause

\item The point is that we cannot control the network: An attacker

can install a packet sniffer, inject packets, modify packets,

replay messages\ldots{}fake pretty much everything.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Keyless Car Transponders}

\begin{center}

\includegraphics[scale=0.1]{../pics/keyfob.jpg}

\quad

\includegraphics[scale=0.27]{../pics/startstop.jpg}

\end{center}

\begin{itemize}

\item There are two security mechanisms: one remote central 

locking system and one passive RFID tag (engine immobiliser).

\item How can I get in? How can thieves be kept out? 

How to avoid MITM attacks?

\end{itemize}\medskip

\footnotesize

\hfill Papers: Gone in 360 Seconds: Hijacking with Hitag2,\\

\hfill Dismantling Megamos Crypto: Wirelessly Lockpicking\\

\hfill a Vehicle Immobilizer

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Problems with Key Fobs}

\begin{columns}

\begin{column}[T]{4cm}

\includegraphics[scale=0.4]{../pics/car-standard.jpg}

\end{column}

\begin{column}[T]{6cm}\small 

Circumventing the ignition protection:

\begin{itemize}

\item either dismantling Megamos crypto,

\item or use the diagnostic port to program 

  blank keys 

\end{itemize}

\hspace{14mm}

\includegraphics[scale=0.16]{../pics/Dismantling_Megamos_Crypto.png}

\end{column}

\end{columns}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{HTTPS / GSM}

\begin{center}

\includegraphics[scale=0.25]{../pics/barclays.jpg}

\quad

\includegraphics[scale=0.25]{../pics/phone-signal.jpg}

\end{center}

\begin{itemize}

\item I am sitting at Starbuck. How can I be sure I am really

      visiting Barclays? I have no control of the access

      point.

\item How can I achieve that a secret key is established in

      order to encrypt my mobile conversation? I have no

      control over the access points. 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{G20 Summit in 2009}

\begin{center}

\includegraphics[scale=0.1]{../pics/snowden.jpg}

\end{center}

\small

\begin{itemize}

\item Snowden documents reveal ``that during the G20

      meetings\dots{}GCHQ used 

      `ground-breaking intelligence capabilities' to intercept

      the communications of visiting delegations. This

      included setting up internet cafes where they used an

      email interception program and key-logging software to

      spy on delegates' use of computers\ldots''

\item ``The G20 spying appears to have been organised for the

      more mundane purpose of securing an advantage in

      meetings.'' 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Handshakes}

\begin{itemize}

\item starting a TCP connection between a client and a server

initiates the following three-way handshake protocol:

\end{itemize}

\begin{columns}[t]

\begin{column}{5cm}

\begin{minipage}[t]{4cm}

\begin{center}

\raisebox{-2cm}{\includegraphics[scale=0.5]{../pics/handshake.png}}

\end{center}

\end{minipage}

\end{column}

\begin{column}{5cm}

\begin{tabular}[t]{rl}

Alice:  & Hello server!\\

Server: & I heard you\\

Alice:  & Thanks

\end{tabular}

\end{column}

\end{columns}

\only<2>{

\begin{textblock}{3}(11,5)

\begin{bubble}[3.2cm]

SYNflood attacks:\medskip\\

\includegraphics[scale=0.4]{../pics/synflood.png}

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Protocols}

\mbox{} 

\begin{tabular}{l}

{\Large \bl{$A\;\rightarrow\; B : \ldots$}}\\

\onslide<2->{\Large \bl{$B\;\rightarrow\; A : \ldots$}}\\

\onslide<2->{\Large \;\;\;\;\;\bl{$:$}}\bigskip

\end{tabular}  

 \begin{itemize}

 \item by convention \bl{$A$}, \bl{$B$} are named principals \bl{Alice\ldots}\\

 but most likely they are programs, which just follow some instructions (they are more like roles)\bigskip

\item<2-> indicates one ``protocol run'', or session,  which specifies some 

order in the communication

\item<2-> there can be several sessions in parallel (think of wifi routers) 

\end{itemize} 

  \end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Messages}

\mbox{}

\begin{tabular}{l}

{\Large \bl{$A\;\rightarrow\; B : msg$}}\\

\end{tabular}\bigskip  

\begin{itemize}

\item Unencrypted: \bl{$msg$}

\item Random number (nonce): \bl{$N$}

\item Encrypted: \bl{$\{msg\}_K$}, \bl{$\{msg_1, msg_2\}_K$}, \bl{$\{\{msg\}_{K_1}\}_{K_2}$}

\end{itemize} 

  \end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Handshakes}

\begin{itemize}

\item starting a TCP connection between a client and a server

initiates the following three-way handshake protocol:

\end{itemize}

\begin{columns}[t]

\begin{column}{5cm}

\begin{minipage}[t]{4cm}

\begin{center}

\raisebox{-2cm}{\includegraphics[scale=0.5]{../pics/handshake.png}}

\end{center}

\end{minipage}

\end{column}

\begin{column}{5cm}

\begin{tabular}[t]{rl}

Alice:  & Hello server!\\

Server: & I heard you\\

Alice:  & Thanks

\end{tabular}

\end{column}

\end{columns}

\begin{center}

\begin{tabular}{rl}

\bl{$A \rightarrow S$}: & \bl{SYN}\\

\bl{$S \rightarrow A$}: & \bl{SYN-ACK}\\

\bl{$A \rightarrow S$}: & \bl{ACK}\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large Cryptographic Protocol Failures}

Ross Anderson and Roger Needham wrote:\bigskip

\begin{quote}\rm

A lot of the recorded frauds were the result of this kind of

  blunder, or from management negligence pure and simple. 

  \alert{However,

there have been a significant number of cases where the designers

protected the right things, used cryptographic algorithms which were

not broken, and yet found that their systems were still successfully

attacked.}

\end{quote}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \begin{frame}<1-3>[c]

  \frametitle{Oyster Cards}

  \includegraphics[scale=0.4]{../pics/oysterc.jpg}

  \begin{itemize}

  \item good example of a bad protocol\\ (security by obscurity)\bigskip

  \item<3->  {\it``Breaching security on Oyster cards should not 

  allow unauthorised use for more than a day, as TfL promises to turn 

  off any cloned cards within 24 hours\ldots''}

  \end{itemize}

  \only<2>{

  \begin{textblock}{12}(0.5,0.5)

  \begin{bubble}[11cm]\footnotesize

  {\bf Wirelessly Pickpocketing a Mifare Classic Card}\medskip

  The Mifare Classic is the most widely used contactless smartcard on the

  market. The stream cipher CRYPTO1 used by the Classic has recently been

  reverse engineered and serious attacks have been proposed. The most serious

  of them retrieves a secret key in under a second. In order to clone a card,

  previously proposed attacks require that the adversary either has access to

  an eavesdropped communication session or executes a message-by-message

  man-in-the-middle attack between the victim and a legitimate

  reader. Although this is already disastrous from a cryptographic point of

  view, system integrators maintain that these attacks cannot be performed

  undetected.\smallskip

  This paper proposes four attacks that can be executed by an adversary having

  only wireless access to just a card (and not to a legitimate reader). The

  most serious of them recovers a secret key in less than a second on ordinary

  hardware. Besides the cryptographic weaknesses, we exploit other weaknesses

  in the protocol stack. A vulnerability in the computation of parity bits

  allows an adversary to establish a side channel. Another vulnerability

  regarding nested authentications provides enough plaintext for a speedy

  known-plaintext attack.\hfill{}(a paper from 2009)

  \end{bubble}

  \end{textblock}}

  \end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}<1->[t]

\frametitle{Another Example}

In an email from Ross Anderson\bigskip\small	

\begin{tabular}{l}

From: Ross Anderson <Ross.Anderson@cl.cam.ac.uk>\\

Sender: cl-security-research-bounces@lists.cam.ac.uk\\

To: cl-security-research@lists.cam.ac.uk\\

Subject: Birmingham case\\

Date: Tue, 13 Aug 2013 15:13:17 +0100\\

\end{tabular}

\only<2>{

\begin{textblock}{12}(0.5,0.8)

\begin{bubble}[11cm]

\footnotesize

As you may know, Volkswagen got an injunction against the University of

Birmingham suppressing the publication of the design of a weak cipher

used in the remote key entry systems in its recent-model cars. The paper

is being given today at Usenix, minus the cipher design.\medskip

I've been contacted by Birmingham University's lawyers who seek to prove

that the cipher can be easily obtained anyway. They are looking for a

student who will download the firmware from any newish VW, disassemble

it and look for the cipher. They'd prefer this to be done by a student

rather than by a professor to emphasise how easy it is.\medskip

Volkswagen's argument was that the Birmingham people had reversed a

locksmithing tool produced by a company in Vietnam, and since their key

fob chip is claimed to be tamper-resistant, this must have involved a

corrupt insider at VW or at its supplier Thales. Birmingham's argument

is that this is nonsense as the cipher is easy to get hold of. Their

lawyers feel this argument would come better from an independent

outsider.\medskip

Let me know if you're interested in having a go, and I'll put you in

touch

Ross

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Authentication Protocols}

Alice (\bl{$A$}) and Bob (\bl{$B$}) share a secret key \bl{$K_{AB}$}\bigskip

Passwords:

\begin{center}

\bl{$B \rightarrow A: K_{AB}$} 

\end{center}\pause\bigskip

Problem: Eavesdropper can capture the secret and replay it; \bl{$A$} cannot confirm the

identity of \bl{$B$}  

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Authentication?}

\begin{center}

\raisebox{-2cm}{\includegraphics[scale=0.4]{../pics/dogs.jpg}}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Authentication Protocols}

Alice (\bl{$A$}) and Bob (\bl{$B$}) share a secret key \bl{$K_{AB}$}\bigskip

Simple Challenge Response:

\begin{center}

\begin{tabular}{ll}

\bl{$A \rightarrow B:$} & \bl{$N$}\\

\bl{$B \rightarrow A:$} & \bl{$\{N\}_{K_{AB}}$}\\

\end{tabular} 

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Authentication Protocols}

Alice (\bl{$A$}) and Bob (\bl{$B$}) share a secret key \bl{$K_{AB}$}\bigskip

Mutual Challenge Response:

\begin{center}

\begin{tabular}{ll}

\bl{$A \rightarrow B:$} & \bl{$N_A$}\\

\bl{$B \rightarrow A:$} & \bl{$\{N_A, N_B\}_{K_{AB}}$}\\

\bl{$A \rightarrow B:$} & \bl{$N_B$}\\

\end{tabular} 

\end{center}

%\pause

%An attacker \bl{$E$} can launch an impersonation attack by

%intercepting all messages for \bl{$B$} and make \bl{$A$} decrypt her

%own challenges.

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Nonces}

\begin{enumerate}

\item I generate a nonce (random number) and send it to you encrypted with a key we share

\item you increase it by one, encrypt it under a key I know and send

it back to me

\end{enumerate}\medskip

I can infer: