4 |
4 |
5 \lstset{language=JavaScript} |
5 \lstset{language=JavaScript} |
6 |
6 |
7 |
7 |
8 \begin{document} |
8 \begin{document} |
9 \fnote{\copyright{} Christian Urban, 2014} |
9 \fnote{\copyright{} Christian Urban, 2014, 2015} |
10 |
10 |
11 \section*{Handout 1 (Security Engineering)} |
11 \section*{Handout 1 (Security Engineering)} |
12 |
12 |
13 |
13 |
14 Much of the material and inspiration in this module is taken |
14 Much of the material and inspiration in this module is taken |
132 that a signature was used. This is a kind of \emph{protocol |
132 that a signature was used. This is a kind of \emph{protocol |
133 failure}. After discovery, the flaw was mitigated by requiring |
133 failure}. After discovery, the flaw was mitigated by requiring |
134 that a link between the card and the bank is established at |
134 that a link between the card and the bank is established at |
135 every time the card is used. Even later this group found |
135 every time the card is used. Even later this group found |
136 another problem with Chip-and-PIN and ATMs which did not |
136 another problem with Chip-and-PIN and ATMs which did not |
137 generate random enough numbers (nonces) on which the security |
137 generate random enough numbers (cryptographic nonces) on which |
138 of the underlying protocols relies. |
138 the security of the underlying protocols relies. |
139 |
139 |
140 The overarching problem with all this is that the banks who |
140 The overarching problem with all this is that the banks who |
141 introduced Chip-and-PIN managed with the new system to shift |
141 introduced Chip-and-PIN managed with the new system to shift |
142 the liability for any fraud and the burden of proof onto the |
142 the liability for any fraud and the burden of proof onto the |
143 customer. In the old system, the banks had to prove that the |
143 customer. In the old system, the banks had to prove that the |
298 knowing the output. This is often called \emph{preimage |
298 knowing the output. This is often called \emph{preimage |
299 resistance}. Cryptographic hash functions also ensure that |
299 resistance}. Cryptographic hash functions also ensure that |
300 given a message and a hash, it is computationally infeasible to |
300 given a message and a hash, it is computationally infeasible to |
301 find another message with the same hash. This is called |
301 find another message with the same hash. This is called |
302 \emph{collusion resistance}. Because of these properties hash |
302 \emph{collusion resistance}. Because of these properties hash |
303 functions are often called \emph{one-way functions}\ldots you |
303 functions are often called \emph{one-way functions}: you |
304 cannot go back from the output to the input (without some |
304 cannot go back from the output to the input (without some |
305 tricks, see below). |
305 tricks, see below). |
306 |
306 |
307 |
307 |
308 |
308 |
330 |
330 |
331 We can use hashes in our web-application and store in the |
331 We can use hashes in our web-application and store in the |
332 cookie the value of the counter in plain text but together |
332 cookie the value of the counter in plain text but together |
333 with its hash. We need to store both pieces of data in such a |
333 with its hash. We need to store both pieces of data in such a |
334 way that we can extract them again later on. In the code below |
334 way that we can extract them again later on. In the code below |
335 I will just separate them using a \pcode{"-"}, for example |
335 I will just separate them using a \pcode{"-"}. For the |
|
336 counter \pcode{1} for example |
336 |
337 |
337 \begin{center} |
338 \begin{center} |
338 \pcode{1-356a192b7913b04c54574d18c28d46e6395428ab} |
339 \pcode{1-356a192b7913b04c54574d18c28d46e6395428ab} |
339 \end{center} |
340 \end{center} |
340 |
341 |
341 \noindent for the counter \pcode{1}. If we now read back the |
342 \noindent If we now read back the |
342 cookie when the client visits our webpage, we can extract the |
343 cookie when the client visits our webpage, we can extract the |
343 counter, hash it again and compare the result to the stored |
344 counter, hash it again and compare the result to the stored |
344 hash value inside the cookie. If these hashes disagree, then |
345 hash value inside the cookie. If these hashes disagree, then |
345 we can deduce that the cookie has been tampered with. |
346 we can deduce that the cookie has been tampered with. |
346 Unfortunately, if they agree, we can still not be entirely |
347 Unfortunately, if they agree, we can still not be entirely |
393 to keep the salt secret. Once the salt is public, we better |
394 to keep the salt secret. Once the salt is public, we better |
394 ignore all cookies and start setting them again with a new |
395 ignore all cookies and start setting them again with a new |
395 salt. |
396 salt. |
396 |
397 |
397 There is an interesting and very subtle point to note with |
398 There is an interesting and very subtle point to note with |
398 respect to the New York Times' way of checking the number |
399 respect to the 'New York Times' way of checking the number |
399 visits. Essentially they have their `resource' unlocked at the |
400 visits. Essentially they have their `resource' unlocked at the |
400 beginning and lock it only when the data in the cookie states |
401 beginning and lock it only when the data in the cookie states |
401 that the allowed free number of visits are up. As said before, |
402 that the allowed free number of visits are up. As said before, |
402 this can be easily circumvented by just deleting the cookie or |
403 this can be easily circumvented by just deleting the cookie or |
403 by switching the browser. This would mean the New York Times |
404 by switching the browser. This would mean the New York Times |
406 not work, because then this newspaper will cut off any new |
407 not work, because then this newspaper will cut off any new |
407 readers, or anyone who gets a new computer. In contrast, our |
408 readers, or anyone who gets a new computer. In contrast, our |
408 web-application has the resource (discount) locked at the |
409 web-application has the resource (discount) locked at the |
409 beginning and only unlocks it if the cookie data says so. If |
410 beginning and only unlocks it if the cookie data says so. If |
410 the cookie is deleted, well then the resource just does not |
411 the cookie is deleted, well then the resource just does not |
411 get unlocked. No mayor harm will result to us. You can see: |
412 get unlocked. No major harm will result to us. You can see: |
412 the same security mechanism behaves rather differently |
413 the same security mechanism behaves rather differently |
413 depending on whether the ``resource'' needs to be locked or |
414 depending on whether the ``resource'' needs to be locked or |
414 unlocked. Apart from thinking about the difference very |
415 unlocked. Apart from thinking about the difference very |
415 carefully, I do not know of any good ``theory'' that could |
416 carefully, I do not know of any good ``theory'' that could |
416 help with solving such security intricacies in any other way. |
417 help with solving such security intricacies in any other way. |