1 \documentclass[dvipsnames,14pt,t]{beamer}

     1 \PassOptionsToPackage{bookmarks=false}{hyperref}

     2 \documentclass[dvipsnames,14pt,t,hyperref={bookmarks=false}]{beamer}

   147 \bl{$\{B,n\}_{K^{pub}_C} \;\mapsto\; M_1,M_2$}\bigskip\\

   211 \bl{$\{B,m'\}_{K^{pub}_C} \;\mapsto\; M_1,M_2$}\bigskip\\

   162 \end{center}

   226 \end{center}\pause

   227 

   228 \footnotesize

   229 \bl{$m$} = How is your grandmother? \bl{$m'$} = How is the

   230 weather today in London?

   173 \item what happens if \bl{$m$} and \bl{$n$} are voice

   241 \item what happens if \bl{$m$} and \bl{$m'$} are voice

   174   messages?\bigskip  

   242   messages?\bigskip\pause

   175 

   243 

   176 \item the moral: establishing a secure connection from ``zero'' is

   244 \item So \bl{$C$} can either leave the communication unchanged

   177 almost impossible---you need to rely on some established 

   245       (Hellamn-Diffie), or invent a complete new conversation

   178 trust\medskip

   246       

   247 \end{itemize}

   248 

   249 \end{frame}

   250 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

   251 

   252 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   253 \begin{frame}[c]

   254 

   255 \begin{itemize}

   256 \item the moral: establishing a secure connection from

   257       ``zero'' is almost impossible---you need to rely on some

   258       established trust\medskip

   181 badly, badly realised (just today a POODLE attack against SSL)

   261       badly, badly realised

   182 

   262 

   183 \end{itemize}

   263 \end{itemize}

   184 

   264 

   185 \end{frame}

   265 \end{frame}

   186 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

   266 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

   187 

   267 

   188 

   268 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   189 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   269 \begin{frame}[c]

   190 \begin{frame}[c]

   270 \frametitle{Trusted Third Parties}

   191 \frametitle{Protocols}

   271 

   192 

   272 Simple protocol for establishing a secure connection via a

   193 Some examples where ``over-the-air'' protocols are used:

   273 mutually trusted 3rd party (server):

   194 

   195 \begin{itemize}

   196 \item wifi

   197 \item card readers (you cannot trust the terminals)

   198 \item RFID (passports)

   199 \item car transponders

   200 \end{itemize}\medskip\pause

   201 

   202 The point is that we cannot control the network: An attacker

   203 can install a packet sniffer, inject packets, modify packets,

   204 replay messages\ldots{}fake pretty much everything.

   205 

   206 \end{frame}

   207 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

   208 

   209 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   210 \begin{frame}[c]

   211 \frametitle{Keyless Car Transponders}

   212 

   213 \begin{center}

   214 \includegraphics[scale=0.1]{../pics/keyfob.jpg}

   215 \quad

   216 \includegraphics[scale=0.27]{../pics/startstop.jpg}

   217 \end{center}

   218 

   219 \begin{itemize}

   220 \item There are two security mechanisms: one remote central 

   221 locking system and one passive RFID tag (engine immobiliser).

   222 \item How can I get in? How can thieves be kept out? 

   223 How to avoid MITM attacks?

   224 \end{itemize}\medskip

   225 

   226 \footnotesize

   227 \hfill Papers: Gone in 360 Seconds: Hijacking with Hitag2,\\

   228 \hfill Dismantling Megamos Crypto: Wirelessly Lockpicking\\

   229 \hfill a Vehicle Immobilizer

   230 

   231 \end{frame}

   232 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

   233 

   234 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   235 \begin{frame}[c]

   236 \frametitle{HTTPS / GSM}

   237 

   238 \begin{center}

   239 \includegraphics[scale=0.25]{../pics/barclays.jpg}

   240 \quad

   241 \includegraphics[scale=0.25]{../pics/phone-signal.jpg}

   242 \end{center}

   243 

   244 \begin{itemize}

   245 \item I am sitting at Starbuck. How can I be sure I am really

   246       visiting Barclays? I have no control of the access

   247       point.

   248 \item How can I achieve that a secret key is established in

   249       order to encrypt my mobile conversation? I have no

   250       control over the access points. 

   251 \end{itemize}

   252 

   253 \end{frame}

   254 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

   255 

   256 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   257 \begin{frame}[c]

   258 \frametitle{Handshakes}

   259 

   260 \begin{itemize}

   261 \item starting a TCP connection between a client and a server

   262 initiates the following three-way handshake protocol:

   263 \end{itemize}

   264 

   265 \begin{columns}[t]

   266 \begin{column}{5cm}

   267 \begin{minipage}[t]{4cm}

   268 \begin{center}

   269 \raisebox{-2cm}{\includegraphics[scale=0.5]{../pics/handshake.png}}

   270 \end{center}

   271 \end{minipage}

   272 \end{column}

   273 \begin{column}{5cm}

   274 \begin{tabular}[t]{rl}

   275 Alice:  & Hello server!\\

   276 Server: & I heard you\\

   277 Alice:  & Thanks

   278 \end{tabular}

   279 \end{column}

   280 \end{columns}

   281 

   282 \onslide<2->{

   283 \begin{center}

   284 \begin{tabular}{rl}

   285 \bl{$A \rightarrow S$}: & \bl{SYN}\\

   286 \bl{$S \rightarrow A$}: & \bl{SYN-ACK}\\

   287 \bl{$A \rightarrow S$}: & \bl{ACK}\\

   288 \end{tabular}

   289 \end{center}}

   290 

   291 \only<3>{

   292 \begin{textblock}{3}(11,5)

   293 \begin{bubble}[3.2cm]

   294 SYNflood attacks:\medskip\\

   295 \includegraphics[scale=0.4]{../pics/synflood.png}

   296 \end{bubble}

   297 \end{textblock}}

   298 

   299 \end{frame}

   300 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

   301 

   302 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   303 \begin{frame}[c]

   304 \frametitle{Authentication}

   305 

   306 \begin{columns} 

   307 \begin{column}{8cm}

   308 \begin{minipage}[t]{7.5cm}

   309 \begin{center}

   310 \raisebox{-2cm}{\includegraphics[scale=0.4]{../pics/dogs.jpg}}

   311 \end{center}

   312 \end{minipage}

   313 \end{column}

   314 \begin{column}{5cm}

   315 \begin{minipage}[t]{4.5cm}

   316 \begin{tabular}{l}

   317 Knock Knock!\\

   318 Who's there?\\

   319 Alice.\\

   320 Alice who?

   321 \end{tabular}

   322 \end{minipage}

   323 \end{column}

   324 \end{columns}

   325 

   326 \end{frame}

   327 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   328 

   329 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   330 \begin{frame}[c]

   331 \frametitle{Authentication Protocols}

   332 

   333 Alice (\bl{$A$}) and Bob (\bl{$B$}) share a secret key

   334 \bl{$K_{AB}$}\bigskip

   335 

   336 Password transmission:

   337 

   338 \begin{center}

   339 \bl{$A \rightarrow B: K_{AB}$} 

   340 \end{center}\pause\bigskip

   341 

   342 Problems: Eavesdropper can capture the secret and replay it;

   343 \bl{$B$} cannot confirm the identity of \bl{$A$}  

   344 

   345 \end{frame}

   346 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

   347 

   348 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   349 \begin{frame}[c]

   350 \frametitle{Authentication Protocols}

   351 

   352 Alice (\bl{$A$}) and Bob (\bl{$B$}) share a secret key

   353 \bl{$K_{AB}$}\bigskip

   354 

   355 Simple Challenge Response (solving the replay problem):

   356 

   357 \begin{center}

   358 \begin{tabular}{lll}

   359 \bl{$A \rightarrow B:$} & \bl{Hi I am A}\\

   360 \bl{$B \rightarrow A:$} & \bl{$N$} & (challenge)\\

   361 \bl{$A \rightarrow B:$} & \bl{$\{N\}_{K_{AB}}$}\\

   362 \end{tabular} 

   363 \end{center}\pause

   364 

   365 \begin{itemize}

   366 \item cannot be replayed since next time will be another

   367       challenge \bl{$N$}

   368 \item \bl{$B$} authenticates \bl{$A$}, but \bl{$A$} does not

   369       authenticate \bl{$B$} (Eve can intercept

   370       messages from \bl{$A$}, send random challenge 

   371       and ignore last) 

   372 \end{itemize}

   373 

   374 \end{frame}

   375 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   376 

   377 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   378 \begin{frame}[c]

   379 \frametitle{Authentication Protocols}

   380 

   381 Alice (\bl{$A$}) and Bob (\bl{$B$}) share a secret key \bl{$K_{AB}$}\bigskip

   382 

   383 Mutual Challenge Response:

   384 

   385 \begin{center}

   386 \begin{tabular}{ll}

   387 \bl{$A \rightarrow B:$} & \bl{$N_A$}\\

   388 \bl{$B \rightarrow A:$} & \bl{$\{N_A, N_B\}_{K_{AB}}$}\\

   389 \bl{$A \rightarrow B:$} & \bl{$N_B$}\\

   390 \end{tabular} 

   391 \end{center}\pause

   392 

   393 But requires shared secret key.

   394 \end{frame}

   395 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   396 

   397 

   398 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   399 \begin{frame}[c]

   400 \frametitle{Nonces}

   401 

   402 \begin{enumerate}

   403 \item I generate a nonce (random number) and send it to you encrypted with a key we share

   404 \item you increase it by one, encrypt it under a key I know and send

   405 it back to me

   406 \end{enumerate}

   407 

   408 

   409 I can infer:

   410 

   411 \begin{itemize}

   412 \item you must have received my message

   413 \item you could only have generated your answer after I send you my initial

   414 message

   415 \item if only you and me know the key, the message must have come from you

   416 \end{itemize}

   417 

   418 \end{frame}

   419 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   420 

   421 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   422 \mode<presentation>{

   423 \begin{frame}[c]

   424 

   425 \begin{center}

   426 \begin{tabular}{ll}

   427 \bl{$A \rightarrow B$:} & \bl{$N_A$}\\  

   428 \bl{$B \rightarrow A$:} & \bl{$\{N_A, N_B\}_{K_{AB}}$}\\

   429 \bl{$A \rightarrow B$:} & \bl{$N_B$}\\

   430 \end{tabular}

   431 \end{center}

   432 

   433 The attack (let $A$ decrypt her own messages):

   434 

   435 \begin{center}

   436 \begin{tabular}{ll}

   437 \bl{$A \rightarrow E$:} & \bl{$N_A$}\\ 

   438 \textcolor{gray}{$E \rightarrow A$:} & \textcolor{gray}{$N_A$}\\ 

   439 \textcolor{gray}{$A \rightarrow E$:} & \textcolor{gray}{$\{N_A, N_A'\}_{K_{AB}}$}\\

   440 \bl{$E \rightarrow A$:} & \bl{$\{N_A, N_A'\}_{K_{AB}}$}\\

   441 \bl{$A \rightarrow E$:} & \bl{$N_A' \;\;(= N_B)$}\\

   442 \end{tabular}

   443 \end{center}\pause

   444 

   445 \small Solutions: \bl{$K_{AB} \not= K_{BA}$} or include an id in the second message

   446 \end{frame}}

   447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   448 

   449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   450   \mode<presentation>{

   451   \begin{frame}[c]

   452   \frametitle{Encryption to the Rescue?}

   453 

   454 

   455  \begin{itemize}

   456  \item \bl{$A \,\rightarrow\, B :  \{A, N_A\}_{K_{AB}}$}\hspace{1cm} encrypted\bigskip 

   457  \item \bl{$B\,\rightarrow\, A : \{N_A, K'_{AB}\}_{K_{AB}}$}\bigskip

   458  \item \bl{$A \,\rightarrow\, B : \{N_A\}_{K'_{AB}}$}\bigskip

   459  \end{itemize}\pause

   460  

   461 means you need to send separate ``Hello'' signals (bad), or worse 

   462 share a single key between many entities

   463 \end{frame}}

   464 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      

   465 

   466 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   467 \mode<presentation>{

   468 \begin{frame}[c]

   469 \frametitle{Trusted Third Party}

   470 

   471 Simple protocol for establishing a secure connection via a mutually

   472 trusted 3rd party (server):

   477 \bl{$S \rightarrow A :$} & \bl{$\{K_{AB}\}_{K_{AS}}$} and \bl{$\{\{K_{AB}\}_{K_{BS}} \}_{K_{AS}}$}\\

   278 \bl{$S \rightarrow A :$} & \bl{$\{K_{AB}, \{K_{AB}\}_{K_{BS}} \}_{K_{AS}}$}\\

   483 \end{frame}}

   284 \end{frame}

   487 \mode<presentation>{

   288 \begin{frame}[c]

   488 \begin{frame}[c]

   289 \frametitle{PKI: The Main Idea}

   489 \frametitle{Public-Key Infrastructure}

   496 \item CA must be trusted by everybody

   296 \item CA must be trusted by everybody\medskip

   297 

   501 \end{frame}}

   302 \end{frame}

   502 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   303 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   503 

   304 

   504 

   505 

   506 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   507 \begin{frame}[c]

   508 \frametitle{Person-in-the-Middle}

   509 

   510 ``Normal'' protocol run:\bigskip

   511 

   512 \begin{itemize}

   513 \item \bl{$A$} sends public key  to \bl{$B$}

   514 \item \bl{$B$} sends public key  to \bl{$A$}

   515 \item \bl{$A$} sends a message encrypted with \bl{$B$}'s public key, \bl{$B$} decrypts it

   516 with its private key

   517 \item \bl{$B$} sends a message encrypted with \bl{$A$}'s public key, \bl{$A$} decrypts it

   518 with its private key

   519 \end{itemize}

   520 

   521 \end{frame}

   522 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   523 

   524 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   525 \mode<presentation>{

   526 \begin{frame}[c]

   527 \frametitle{Person-in-the-Middle}

   528 

   529 Attack:

   530 

   531 \begin{itemize}

   532 \item \bl{$A$} sends public key  to \bl{$B$}  --- \bl{$C$} 

   533   intercepts this message and send his own public key to 

   534   \bl{$B$}

   535 \item \bl{$B$} sends public key  to \bl{$A$} --- \bl{$C$} 

   536   intercepts this message and send his own public key 

   537   \bl{$A$}  

   538 \item \bl{$A$} sends a message encrypted with \bl{$C$}'s public key, \bl{$C$} decrypts it

   539 with its private key, re-encrypts with \bl{$B$}'s public key 

   540 \item similar the other way

   541 \end{itemize}

   542 

   543 \end{frame}}

   544 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   545 

   546 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   547 \begin{frame}[c]

   548 \frametitle{Person-in-the-Middle}

   549 

   550 Prevention:

   551 

   552 \begin{itemize}

   553 \item \bl{$A$} sends public key  to \bl{$B$}

   554 \item \bl{$B$} sends public key  to \bl{$A$}

   555 \item \bl{$A$} encrypts a message with \bl{$B$}'s public key, 

   556   sends {\bf half} of the message to \bl{$B$}

   557 \item \bl{$B$} encrypts a message with \bl{$A$}'s public key, 

   558  sends {\bf half} of the message back to \bl{$A$}

   559 \item \bl{$A$} sends other half, \bl{$B$} can now decrypt 

   560  entire message

   561 \item \bl{$B$} sends other half, \bl{$A$} can now decrypt 

   562  entire message

   563 \end{itemize}\pause

   564 

   565 \bl{$C$} would have to invent a totally new message

   566 

   567 \end{frame}

   568 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   569 

   570 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   571 \begin{frame}[c]

   572 \frametitle{Car Transponder (HiTag2)}

   573 

   574 \begin{enumerate}

   575 \item \bl{$C$} generates a random number \bl{$N$}

   576 \item \bl{$C$} calculates \bl{$(F,G) = \{N\}_K$}

   577 \item \bl{$C \to T$}: \bl{$N, F$}

   578 \item \bl{$T$} calculates \bl{$(F',G') = \{N\}_K$}

   579 \item \bl{$T$} checks that \bl{$F = F'$}

   580 \item \bl{$T \to C$}: \bl{$N, G'$}

   581 \item \bl{$C$} checks that \bl{$G = G'$}

   582 \end{enumerate}\pause

   583 

   584 \small

   585 This process means that the transponder believes the car knows

   586 the key \bl{$K$}, and the car believes the transponder knows

   587 the key \bl{$K$}. They have authenticated themselves

   588 to each other.

   589 

   590 \end{frame}

   591 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   592 

   593 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   594 \begin{frame}[c]

   595 \frametitle{Person-in-the-Middle}

   596 

   597 \begin{itemize}

   598 \item Border Gateway Protocol (BGP) --- routers believe 

   599   their neighbours

   600 \item it is possible to advertise bad routes

   601 \item can be done over continents\bigskip 

   602 \end{itemize}

   603 

   604 \hfill\footnotesize\url{http://www.renesys.com/2013/11/mitm-internet-hijacking/}

   605 \end{frame}

   606 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

   607 

   608 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   609 \mode<presentation>{

   610 \begin{frame}[c]

   611 \frametitle{Protocol Attacks}

   612 

   613 \begin{itemize}

   614 \item replay attacks

   615 \item reflection attacks

   616 \item man-in-the-middle attacks

   617 \item timing attacks

   618 \item parallel session attacks

   619 \item binding attacks (public key protocols)

   620 \item changing environment / changing assumptions\bigskip

   621 

   622 \item (social engineering attacks)

   623 \end{itemize}

   624 \end{frame}}

   625 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   665 \end{frame}}

   343 \end{frame}

   701 \end{frame}}

   378 \end{frame}