\PassOptionsToPackage{bookmarks=false}{hyperref}

\documentclass[dvipsnames,14pt,t,hyperref={bookmarks=false}]{beamer}

\usepackage{../style}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\usepackage{../data}

\usetikzlibrary{arrows}

\usetikzlibrary{shapes}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\renewcommand{\slidecaption}{SEN 05, King's College London}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (5)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

  \normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also homework is there)\\

  \end{tabular}

  \end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Problems with Key Fobs}

\begin{columns}

\begin{column}[T]{4cm}

\includegraphics[scale=0.4]{../pics/car-standard.jpg}

\end{column}

\begin{column}[T]{6cm}\small 

Circumventing the ignition protection:

\begin{itemize}

\item either dismantling Megamos crypto,

\item or use the diagnostic port to program 

  blank keys 

\end{itemize}

\hspace{14mm}

\includegraphics[scale=0.16]{../pics/Dismantling_Megamos_Crypto.png}

\end{column}

\end{columns}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Nonces}

\begin{enumerate}

\item I generate a nonce (random number) and send it to you encrypted with a key we share

\item you increase it by one, encrypt it under a key I know and send

it back to me

\end{enumerate}

I can infer:

\begin{itemize}

\item you must have received my message

\item you could only have generated your answer after I have

      sent you my initial message

\item if only you and me know the key, the message must have come from you

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Protocols}

\begin{center}

\includegraphics[scale=0.11]{../pics/keyfob.jpg}

\quad

\includegraphics[scale=0.232]{../pics/starbucks.jpg}

\end{center}

\begin{itemize}

\item The point is that we have no control over the network

\item We want to avoid that a message exchange (a protocol) can

be attacked without detection

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{G20 Summit in 2009}

\begin{center}

\includegraphics[scale=0.1]{../pics/snowden.jpg}

\end{center}

\small

\begin{itemize}

\item Snowden documents reveal ``that during the G20

      meetings\dots{}GCHQ used 

      `ground-breaking intelligence capabilities' to intercept

      the communications of visiting delegations. This

      included setting up internet cafes where they used an

      email interception program and key-logging software to

      spy on delegates' use of computers\ldots''

\item ``The G20 spying appears to have been organised for the

      more mundane purpose of securing an advantage in

      meetings.'' 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A Simple PK Protocol}

\begin{center}

\begin{tabular}{ll@{\hspace{2mm}}l}

1. & \bl{$A \to B :$} & \bl{$K^{pub}_A$}\smallskip\\

2. & \bl{$B \to A :$} & \bl{$K^{pub}_B$}\smallskip\\

3. & \bl{$A \to B :$} & \bl{$\{A,m\}_{K^{pub}_B}$}\smallskip\\

4. & \bl{$B \to A :$} & \bl{$\{B,m'\}_{K^{pub}_A}$}

\end{tabular}

\end{center}\pause\bigskip

unfortunately there is a simple man-in-the- middle-attack

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{A MITM Attack}

\begin{center}

\begin{tabular}{ll@{\hspace{2mm}}l}

1. & \bl{$A \to E :$} & \bl{$K^{pub}_A$}\smallskip\\

2. & \bl{$E \to B :$} & \bl{$K^{pub}_E$}\smallskip\\

3. & \bl{$B \to E :$} & \bl{$K^{pub}_B$}\smallskip\\

4. & \bl{$E \to A :$} & \bl{$K^{pub}_E$}\smallskip\\

5. & \bl{$A \to E :$} & \bl{$\{A,m\}_{K^{pub}_E}$}\smallskip\\

6. & \bl{$E \to B :$} & \bl{$\{E,m\}_{K^{pub}_B}$}\smallskip\\

7. & \bl{$B \to E :$} & \bl{$\{B,m'\}_{K^{pub}_E}$}\smallskip\\

8. & \bl{$E \to A :$} & \bl{$\{E,m'\}_{K^{pub}_A}$}

\end{tabular}

\end{center}\pause\medskip

and \bl{$A$} and \bl{$B$} have no chance to detect it

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Interlock Protocol}

The interlock protocol (``best bet'' against MITM):

\begin{center}

\begin{tabular}{ll@{\hspace{2mm}}l}

1. & \bl{$A \to B :$} & \bl{$K^{pub}_A$}\\

2. & \bl{$B \to A :$} & \bl{$K^{pub}_B$}\\

3. & & \bl{$\{A,m\}_{K^{pub}_B} \;\mapsto\; H_1,H_2$}\\

   & & \bl{$\{B,m'\}_{K^{pub}_A} \;\mapsto\; M_1,M_2$}\\

4. & \bl{$A \to B :$} & \bl{$H_1$}\\

5. & \bl{$B \to A :$} & \bl{$\{H_1, M_1\}_{K^{pub}_A}$}\\

6. & \bl{$A \to B :$} & \bl{$\{H_2, M_1\}_{K^{pub}_B}$}\\

7. & \bl{$B \to A :$} & \bl{$M_2$}

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Splitting Messages}

\begin{center}

$\underbrace{\texttt{\Grid{0X1peUVTGJK+H70mMjAM8p}}}_{\bl{\{A,m\}_{K^{pub}_B}}}$

\end{center}

\begin{center}

$\underbrace{\texttt{\Grid{0X1peUVTGJK}}}_{\bl{H_1}}$\quad

$\underbrace{\texttt{\Grid{+H70mMjAM8p}}}_{\bl{H_2}}$

\end{center}

\begin{itemize}

\item you can also use the even and odd bytes

\item the point is you cannot decrypt the halves, even if you

      have the key 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{center}

\begin{tabular}{l@{\hspace{9mm}}l}

\begin{tabular}[t]{@{}l@{}}

\bl{$A \to C : K^{pub}_A$}\\

\bl{$C \to B : K^{pub}_C$}\\

\bl{$B \to C : K^{pub}_B$}\\

\bl{$C \to A : K^{pub}_C$}\medskip\\

\bl{$\{A,m\}_{K^{pub}_C} \;\mapsto\; H_1,H_2$}\\

\bl{$\{B,m'\}_{K^{pub}_C} \;\mapsto\; M_1,M_2$}\bigskip\\

\bl{$\{C,a\}_{K^{pub}_B} \;\mapsto\; C_1,C_2$}\\

\bl{$\{C,b\}_{K^{pub}_A} \;\mapsto\; D_1,D_2$}

\end{tabular} &

\begin{tabular}[t]{@{}l@{}}

\bl{$A \to C : H_1$}\\

\bl{$C \to B : C_1$}\\

\bl{$B \to C : \{C_1, M_1\}_{K^{pub}_C}$}\\

\bl{$C \to A : \{H_1, D_1\}_{K^{pub}_A}$}\\

\bl{$A \to C : \{H_2, D_1\}_{K^{pub}_C}$}\\

\bl{$C \to B : \{C_2, M_1\}_{K^{pub}_B}$}\\

\bl{$B \to C : M_2$}\\

\bl{$C \to A : D_2$}

\end{tabular}

\end{tabular}

\end{center}\pause

\footnotesize

\bl{$m$} = How is your grandmother? \bl{$m'$} = How is the

weather today in London?

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{itemize}

\item you have to ask something that cannot be imitated 

  (requires \bl{$A$} and \bl{$B$} know each other)

\item what happens if \bl{$m$} and \bl{$m'$} are voice

  messages?\bigskip\pause

\item So \bl{$C$} can either leave the communication unchanged

      (Hellman-Diffie), or invent a complete new conversation

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\begin{itemize}

\item the moral: establishing a secure connection from

      ``zero'' is almost impossible---you need to rely on some

      established trust\medskip

\item that is why PKI relies on certificates, which however are

      badly, badly realised

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Trusted Third Parties}

Simple protocol for establishing a secure connection via a

mutually trusted 3rd party (server):

\begin{center}

\begin{tabular}{r@ {\hspace{1mm}}l}

\bl{$A \rightarrow S :$} & \bl{$A, B$}\\

\bl{$S \rightarrow A :$} & \bl{$\{K_{AB}, \{K_{AB}\}_{K_{BS}} \}_{K_{AS}}$}\\

\bl{$A \rightarrow B :$} & \bl{$\{K_{AB}\}_{K_{BS}} $}\\

\bl{$A \rightarrow B :$} & \bl{$\{m\}_{K_{AB}}$}\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{PKI: The Main Idea}

\begin{itemize}

\item the idea is to have a certificate authority (CA)

\item you go to the CA to identify yourself

\item CA: ``I, the CA, have verified that public key 

  \bl{$P^{pub}_{Bob}$} belongs to Bob''\bigskip

\item CA must be trusted by everybody\medskip

\item certificates are time limited, and can be revoked

\item What happens if CA issues a false certificate? Who pays in case of loss? (VeriSign 

explicitly limits liability to \$100.)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{PKI: Chains of Trust}

\begin{center}

  \begin{tikzpicture}[scale=1,

                      node/.style={

                      rectangle,rounded corners=3mm,

                      very thick,draw=black!50,minimum height=18mm, minimum width=23mm,

                      top color=white,bottom color=black!20}]

  \node (A) at (0,0)  [node] {};

  \node [below right] at (A.north west) 

  {\small\begin{tabular}{@{}l}CA\\Root Cert.\end{tabular}};

  \node (B) at (4,0)  [node] {};

  \node [below right=1mm] at (B.north west) 

 {\mbox{}\hspace{-1mm}\small

  \begin{tabular}{@{}l}Subordinate\\ CA\end{tabular}};

  \node (C) at (8,0)  [node] {};

  \node [below right] at (C.north west) 

  {\small\begin{tabular}{@{}l}Server\\ Bank.com\end{tabular}};

  \draw [->,line width=4mm] (A) -- (B); 

  \draw [->,line width=4mm] (B) -- (C); 

  \node (D) at (6,-3)  [node] {};

  \node [below right] at (D.north west) 

  {\small\begin{tabular}{@{}l}Browser\\ Root Store\end{tabular}};

  \node (E) at (2,-3)  [node] {};

  \node [below right] at (E.north west) 

  {\small\begin{tabular}{@{}l}Browser\\ Vendor\end{tabular}};

  \draw [->,line width=4mm] (E) -- (D); 

  \end{tikzpicture}

\end{center}

\begin{itemize}

\item CAs make almost no money anymore, because of stiff

  competition

\item browser companies are not really interested in security;

  only in market share

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{PKI: Weaknesses}

CAs just cannot win (make any profit):\medskip

\begin{itemize}

\item there are hundreds of CAs, which issue millions of

      certificates and the error rate is small

\item users (servers) do not want to pay or pay as little as

      possible\bigskip

\item a CA can issue a certificate for any domain not needing

      any permission (CAs are meant to undergo audits,

      but\ldots DigiNotar)

\item if a CA has issued many certificates, it ``becomes too

      big to fail'' 

\item Can we be sure CAs are not just frontends of some 

      government organisation?  

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{PKI: Weaknesses}

\begin{itemize}

\item many certificates are issued via Whois, whether you own

      the domain\ldots if you hijacked a domain, it is easy to

      obtain certificates\medskip

\item the revocation mechanism does not work (Chrome has given

      up on general revocation lists)\medskip

\item lax approach to validation of certificates 

  (Have you ever bypassed certification warnings?)\medskip

\item sometimes you want to actually install invalid

      certificates (self-signed)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{PKI: Attacks}

\begin{itemize}

\item Go directly after root certificates 

  \begin{itemize}

  \item governments can demand private keys\smallskip

  \item 10 years ago it was estimated that breaking a 1024 bit

        key takes one year and costs 10 - 30 Mio \$; this is now

        reduced to 1 Mio \$

   \end{itemize} 

\item Go after buggy implementations of certificate

      validation\smallskip

\item Social Engineering 

  \begin{itemize}

    \item in 2001 somebody pretended to be 

    from Microsoft and asked for two code-signing 

    certificates

    \end{itemize}\bigskip

\end{itemize}

\small The eco-system is completely broken (it relies on

thousands of entities to do the right thing). Maybe DNSSEC

where keys can be attached to domain names is a way out.

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Real Attacks}

\begin{itemize}

\item In 2011, DigiNotar (Dutch company) was the first CA that

      got compromised comprehensively, and where many

      fraudulent certificates were issued to the wild. It

      included approximately 300,000 IP addresses, mostly

      located in Iran. The attackers (in Iran?) were likely

      interested ``only'' in collecting gmail passwords.\medskip

\item The Flame malware piggy-bagged on this attack by

      advertising malicious Windows updates to some targeted

      systems (mostly in Iran, Israel, Sudan).

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{PKI is Broken}

\begin{itemize}