sen-material: comparison handouts/ho05.tex

equal deleted inserted replaced

-:9a3aa8c39951
+:56bc53ba7c5b
 also have the convention that messages, like $SYN$ above, are
 send in clear-text over the network. If we want that a message
 is encrypted, then we use the notation
 \[
-\{msg\}_{K_{AB}}
+\{msg\}_{K}
 \]
 \noindent for messages. The curly braces indicate a kind of
-envelope which can only be opened if you know the key $K_{AB}$
+envelope which can only be opened if you know the key $K$
 with which the message has been encrypted. We always assume
 that an attacker, say Eve, cannot get to the content of the
 message, unless she is also in the possession of the key. We
 explicitly exclude in our study that the encryption can be
 broken.\footnote{\ldots{}which of course is what a good
 which has been attacked and broken.} It is also
 possible that an encrypted message contains several parts. In
 this case we would write something like
 \[
-\{msg_1, msg_2\}_{K_{AB}}
+\{msg_1, msg_2\}_{K}
 \]
 \noindent But again Eve would not be able to know
 this unless she also has the key. We also allow the
 possibility that a message is encrypted twice under
 different keys. In this case we write
 \[
-\{\{msg\}_{K_{AB}}\}_{K_{BC}}
+\{\{msg\}_{K_1}\}_{K_2}
 \]
 \noindent The idea is that even if attacker Eve has the
-key $K_{BC}$ she could decrypt the outer envelop, but
+key $K_2$ she could decrypt the outer envelop, but
 still does not get to the message, because it is still
-encrypted with the key $K_{AB}$. Note, however,
+encrypted with the key $K_1$. Note, however,
 while an attacker cannot obtain the content of the message
 without the key, encrypted messages can be observed
 and be recorded and then replayed at another time, or
 send to another person!
 and nobody else can decrypt the message. $B$ of course can
 decrypt the answer from $A$ and check whether the answer
 corresponds to the challenge (nonce) $B$ has sent earlier.
 But what about $A$? Can $A$ make any inferences about whom it
-talks to? It dutifully answered the challenge and hopes its
+talks to? It dutifully answered the challenge and hopes his or
-bank, say, will be the only one to understand her answer. But
+her bank, say, will be the only one to understand her answer.
-is this the case? No! Let us consider again an attacker Eve
+But is this the case? No! Let us consider again an attacker
-who has control over the network. She could have intercepted
+Eve who has control over the network. She could have
-the message $HELLO$ and just replied herself to $A$ using a
+intercepted the message $HELLO$ and just replied herself to
-random number\ldots{}for example one which she observed in a
+$A$ using a random number\ldots{}for example one which she
-previous run of this protocol. Remember that if a message is
+observed in a previous run of this protocol. Remember that if
-sent without curly braces it is sent in clear text. $A$ would
+a message is sent without curly braces it is sent in clear
-encrypt the nonce with the key $K_{AB}$ and send it back to
+text. $A$ would encrypt the nonce with the key $K_{AB}$ and
-Eve. She just throws away the answer. $A$ would hope that she
+send it back to Eve. She just throws away the answer. $A$
-talked to $B$ because she followed the protocol, but
+would hope that she talked to $B$ because she followed the
-unfortunately she cannot be sure who she is talking to---it
+protocol, but unfortunately she cannot be sure who she is
-might be Eve.
+talking to---it might be Eve.
 The solution is to follow a \emph{mutual challenge-response}
 protocol. There $A$ already starts off with a challenge (nonce)
 on her own.
 protocol has run. $B$ received a challenge and answered
 correctly to $A$ (inside the encrypted message). An attacker
 would not be able to answer this challenge correctly because
 the attacker is assumed to not be in the possession of the key
 $K_{AB}$; so is not able to generate this message. It could
-also not have been that it is an old message replayed, because
+also not have been the case that it is an old message
-$A$ would send out each time a fresh nonce. So with this
+replayed, because $A$ would send out each time a fresh nonce.
-protocol you can ensure also for $A$ that it talks to $B$. I
+So with this protocol you can ensure also for $A$ that it
-leave you to argue that $B$ can be sure to talk to $A$. Of
+talks to $B$. I leave you to argue that $B$ can be sure to
-course these arguments will depend on the assumptions that
+talk to $A$. Of course these arguments will depend on the
-only $A$ and $B$ know the key $K_{AB}$ and that nobody can
+assumptions that only $A$ and $B$ know the key $K_{AB}$ and
-break the encryption unless they have this key and that the
+that nobody can break the encryption unless they have this key
-nonces are fresh each time the protocol is run.
+and that the nonces are fresh each time the protocol is run.
 The purpose of the nonces, the random numbers that are sent
 around, might be a bit opaque. Because they are unpredictable
 they fulfil an important role in protocols. Suppose
 \item if only you and me know the key $K_{IY}$, the message
 must have come from you
 \end{itemize}
-\noindent Even if this does not seem much information I can
+\noindent Even if this does not seem much information we can
 glean from such an exchange, it is in fact the basic building
 block in protocols for establishing some secret or for
-achieving some security goal (like authentication).
+achieving some security goal (like authentication). This is
+what I meant by magic: we send around ``just'' some random
+numbers, but actually can use them to make some meaningful
+inferences.
 While the mutual challenge-response protocol solves the
 authentication problem, there are some limitations. One is of
 course that it requires a pre-shared secret key. That is
 something that needs to be established beforehand. Not all
 person-in-the-middle attacks.
 \subsubsection*{Further Reading}
-A blogpost that describes the first few milliseconds of an HTTPS connection
+\begin{itemize}
-is at
+\item A blogpost that describes the first few milliseconds of
+an HTTPS connection is at
 \begin{center}
 \url{http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html}
 \end{center}
-\noindent
+It disentangles every message sent between a client and a
-It disentangles every message sent between a client and a server.
+server.
-If you want to know more about how cars can be hijacked,
+\item If you want to know more about how cars can be hijacked,
 the paper
 \begin{center}
 \url{http://www.cs.ru.nl/~rverdult/Gone_in_360_Seconds_Hijacking_with_Hitag2-USENIX_2012.pdf}
 \end{center}
-\noindent is quite amusing to read. Obviously an even more
+is quite amusing to read. Obviously an even more amusing paper
-amusing paper would be ``Dismantling Megamos Crypto:
+would ``Dismantling Megamos Crypto: Wirelessly Lockpicking a
-Wirelessly Lockpicking a Vehicle Immobilizer'' by the same
+Vehicle Immobilizer'' by the same authors, but because of the
-authors, but because of the court injunction by VW,
+court injunction by VW, we are denied this entertainment.
-we are denied this entertainment.
+UPDATE: This paper is now in the public domain.
-Person-in-the-middle-attacks from the ``wild'' are described
+\item Man-in-the-middle-attacks from the ``wild'' are
-with real data in the blog post
+described with real data in the blog post
 \begin{center}
 \url{http://www.renesys.com/2013/11/mitm-internet-hijacking}
 \end{center}
-\noindent The conclusion in this post is that person-in-the-middle-attacks
+The conclusion in this post is that man-in-the-middle-attacks
 can be launched from any place on Earth---it is not required
-that you sit in the ``middle'' of the communication of two people.
+that you sit in the ``middle'' of the communication of two
-You just have to route their traffic through a node you own.
+people. You just have to route their traffic through a node
+you own.
-An article in The Guardian from 2013 reveals how GCHQ and the NSA at a
-G20 Summit in 2009 sniffed emails from Internet cafes, monitored phone
+\item An article in The Guardian from 2013 reveals how GCHQ
-calls from delegates and attempted to listen on phone calls which were made
+and the NSA at a G20 Summit in 2009 sniffed emails from
-by Russians and which were transmitted via satellite links:
+Internet cafes, monitored phone calls from delegates and
+attempted to listen on phone calls which were made by
+Russians and which were transmitted via satellite links:
 \begin{center}
 \url{http://www.theguardian.com/uk/2013/jun/16/gchq-intercepted-communications-g20-summits}
 \end{center}
-\noindent
 \ldots all in the name of having a better position for
 negotiations. Hmmm\ldots
-A paper how the NSA can decrypt so much of the encrypted
+\item A paper guessing how the NSA can decrypt so much of the
-Internet traffic:
+encrypted Internet traffic:
 \begin{center}
 \url{https://weakdh.org/imperfect-forward-secrecy.pdf}
 \end{center}
+\end{itemize}
 \end{document}
 %%% Local Variables:
 %%% mode: latex

changeset 415	56bc53ba7c5b
parent 409	0c04ec017892
child 443	67d7d239c617