1 \documentclass[dvipsnames,14pt,t]{beamer} |
|
2 \usepackage{proof} |
|
3 \usepackage{beamerthemeplainculight} |
|
4 \usepackage[T1]{fontenc} |
|
5 \usepackage[latin1]{inputenc} |
|
6 \usepackage{mathpartir} |
|
7 \usepackage{isabelle} |
|
8 \usepackage{isabellesym} |
|
9 \usepackage[absolute,overlay]{textpos} |
|
10 \usepackage{ifthen} |
|
11 \usepackage{tikz} |
|
12 \usepackage{courier} |
|
13 \usepackage{listings} |
|
14 \usetikzlibrary{arrows} |
|
15 \usetikzlibrary{positioning} |
|
16 \usetikzlibrary{calc} |
|
17 \usepackage{graphicx} |
|
18 \usetikzlibrary{shapes} |
|
19 \usetikzlibrary{shadows} |
|
20 \usetikzlibrary{plotmarks} |
|
21 |
|
22 |
|
23 \isabellestyle{rm} |
|
24 \renewcommand{\isastyle}{\rm}% |
|
25 \renewcommand{\isastyleminor}{\rm}% |
|
26 \renewcommand{\isastylescript}{\footnotesize\rm\slshape}% |
|
27 \renewcommand{\isatagproof}{} |
|
28 \renewcommand{\endisatagproof}{} |
|
29 \renewcommand{\isamarkupcmt}[1]{#1} |
|
30 |
|
31 % Isabelle characters |
|
32 \renewcommand{\isacharunderscore}{\_} |
|
33 \renewcommand{\isacharbar}{\isamath{\mid}} |
|
34 \renewcommand{\isasymiota}{} |
|
35 \renewcommand{\isacharbraceleft}{\{} |
|
36 \renewcommand{\isacharbraceright}{\}} |
|
37 \renewcommand{\isacharless}{$\langle$} |
|
38 \renewcommand{\isachargreater}{$\rangle$} |
|
39 \renewcommand{\isasymsharp}{\isamath{\#}} |
|
40 \renewcommand{\isasymdots}{\isamath{...}} |
|
41 \renewcommand{\isasymbullet}{\act} |
|
42 |
|
43 |
|
44 |
|
45 \definecolor{javared}{rgb}{0.6,0,0} % for strings |
|
46 \definecolor{javagreen}{rgb}{0.25,0.5,0.35} % comments |
|
47 \definecolor{javapurple}{rgb}{0.5,0,0.35} % keywords |
|
48 \definecolor{javadocblue}{rgb}{0.25,0.35,0.75} % javadoc |
|
49 |
|
50 \lstset{language=Java, |
|
51 basicstyle=\ttfamily, |
|
52 keywordstyle=\color{javapurple}\bfseries, |
|
53 stringstyle=\color{javagreen}, |
|
54 commentstyle=\color{javagreen}, |
|
55 morecomment=[s][\color{javadocblue}]{/**}{*/}, |
|
56 numbers=left, |
|
57 numberstyle=\tiny\color{black}, |
|
58 stepnumber=1, |
|
59 numbersep=10pt, |
|
60 tabsize=2, |
|
61 showspaces=false, |
|
62 showstringspaces=false} |
|
63 |
|
64 \lstdefinelanguage{scala}{ |
|
65 morekeywords={abstract,case,catch,class,def,% |
|
66 do,else,extends,false,final,finally,% |
|
67 for,if,implicit,import,match,mixin,% |
|
68 new,null,object,override,package,% |
|
69 private,protected,requires,return,sealed,% |
|
70 super,this,throw,trait,true,try,% |
|
71 type,val,var,while,with,yield}, |
|
72 otherkeywords={=>,<-,<\%,<:,>:,\#,@}, |
|
73 sensitive=true, |
|
74 morecomment=[l]{//}, |
|
75 morecomment=[n]{/*}{*/}, |
|
76 morestring=[b]", |
|
77 morestring=[b]', |
|
78 morestring=[b]""" |
|
79 } |
|
80 |
|
81 \lstset{language=Scala, |
|
82 basicstyle=\ttfamily, |
|
83 keywordstyle=\color{javapurple}\bfseries, |
|
84 stringstyle=\color{javagreen}, |
|
85 commentstyle=\color{javagreen}, |
|
86 morecomment=[s][\color{javadocblue}]{/**}{*/}, |
|
87 numbers=left, |
|
88 numberstyle=\tiny\color{black}, |
|
89 stepnumber=1, |
|
90 numbersep=10pt, |
|
91 tabsize=2, |
|
92 showspaces=false, |
|
93 showstringspaces=false} |
|
94 |
|
95 % beamer stuff |
|
96 \renewcommand{\slidecaption}{APP 08, King's College London, 20 November 2012} |
|
97 \newcommand{\dn}{\stackrel{\mbox{\scriptsize def}}{=}}% for definitions |
|
98 \newcommand{\bl}[1]{\textcolor{blue}{#1}} |
|
99 |
|
100 \begin{document} |
|
101 |
|
102 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
103 \mode<presentation>{ |
|
104 \begin{frame}<1>[t] |
|
105 \frametitle{% |
|
106 \begin{tabular}{@ {}c@ {}} |
|
107 \\ |
|
108 \LARGE Access Control and \\[-3mm] |
|
109 \LARGE Privacy Policies (8)\\[-6mm] |
|
110 \end{tabular}}\bigskip\bigskip\bigskip |
|
111 |
|
112 %\begin{center} |
|
113 %\includegraphics[scale=1.3]{pics/barrier.jpg} |
|
114 %\end{center} |
|
115 |
|
116 \normalsize |
|
117 \begin{center} |
|
118 \begin{tabular}{ll} |
|
119 Email: & christian.urban at kcl.ac.uk\\ |
|
120 Of$\!$fice: & S1.27 (1st floor Strand Building)\\ |
|
121 Slides: & KEATS (also homework is there)\\ |
|
122 \end{tabular} |
|
123 \end{center} |
|
124 |
|
125 |
|
126 \end{frame}} |
|
127 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
128 |
|
129 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
130 \mode<presentation>{ |
|
131 \begin{frame}[c] |
|
132 \frametitle{Last Week} |
|
133 |
|
134 Andrew Secure RPC Protocol: |
|
135 \bl{$A$} and \bl{$B$} share a key private \bl{$K_{AB}$} and want to identify |
|
136 each other\bigskip |
|
137 |
|
138 \begin{itemize} |
|
139 \item \bl{$A \,\text{sends}\, B : A, N_A$} |
|
140 \item \bl{$B\,\text{sends}\, A : \{N_A, K'_{AB}\}_{K_{AB}}$} |
|
141 \item \bl{$A \,\text{sends}\, B : \{N_A\}_{K'_{AB}}$} |
|
142 \end{itemize} |
|
143 |
|
144 \end{frame}} |
|
145 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
146 |
|
147 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
148 \mode<presentation>{ |
|
149 \begin{frame}[t] |
|
150 \frametitle{Protocols} |
|
151 |
|
152 \mbox{} |
|
153 |
|
154 \begin{tabular}{l} |
|
155 {\Large \bl{$A\;\text{sends}\; B : \ldots$}}\\ |
|
156 \onslide<2->{\Large \bl{$B\;\text{sends}\; A : \ldots$}}\\ |
|
157 \onslide<2->{\Large \;\;\;\;\;\bl{$:$}}\bigskip |
|
158 \end{tabular} |
|
159 |
|
160 \begin{itemize} |
|
161 \item by convention \bl{$A$}, \bl{$B$} are named principals \bl{Alice\ldots}\\ |
|
162 but most likely they are programs, which just follow some instructions (they are more like roles)\bigskip |
|
163 \item<2-> indicates one ``protocol run'', or session, which specifies some |
|
164 order in the communication |
|
165 \item<2-> there can be several sessions in parallel (think of wifi routers) |
|
166 \end{itemize} |
|
167 |
|
168 \end{frame}} |
|
169 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
170 |
|
171 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
172 \mode<presentation>{ |
|
173 \begin{frame}[c] |
|
174 \frametitle{Last Week} |
|
175 |
|
176 |
|
177 \bl{$A$} and \bl{$B$} share the key \bl{$K_{AB}$} and want to identify |
|
178 each other\bigskip |
|
179 |
|
180 \begin{itemize} |
|
181 \item \bl{$A \,\text{sends}\, B : A, N_A$} |
|
182 \item \bl{$B\,\text{sends}\, A : \{N_A, K'_{AB}\}_{K_{AB}}$} |
|
183 \item \bl{$A \,\text{sends}\, B : \{N_A\}_{K'_{AB}}$} |
|
184 \end{itemize} |
|
185 \end{frame}} |
|
186 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
187 |
|
188 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
189 \mode<presentation>{ |
|
190 \begin{frame}[c] |
|
191 \frametitle{Defeating Challenge-Response} |
|
192 |
|
193 \noindent |
|
194 A \alert{reflection attack}: an intruder \bl{$I$} impersonates \bl{$B$}. |
|
195 |
|
196 \begin{center} |
|
197 \begin{tabular}{@{\hspace{-7mm}}c@{\hspace{1mm}}c@{}} |
|
198 \begin{tabular}{@{}l@{}} |
|
199 \onslide<1->{\bl{$A \,\text{sends}\, I : A, N_A$}}\\ |
|
200 \onslide<4->{\bl{$I \,\text{sends}\, A : \{N_A,\!K'_{\!AB}\}_{K_{\!AB}}$}}\\ |
|
201 \onslide<5->{\bl{$A \,\text{sends}\, I : \{N_A\}_{K'_{AB}}$}}\\ |
|
202 \end{tabular} |
|
203 & |
|
204 \begin{tabular}{@{}l@{}} |
|
205 \onslide<2->{\bl{$I \,\text{sends}\, A : B, N_A$}}\\ |
|
206 \onslide<3->{\bl{$A \,\text{sends}\, I : \{N_A,\!K'_{\!AB}\}_{K_{\!AB}}$}}\\ |
|
207 \onslide<6->{\bl{$I \,\text{sends}\, A : \{N_A\}_{K'_{AB}}$}}\\ |
|
208 \end{tabular} |
|
209 \end{tabular} |
|
210 \end{center}\bigskip |
|
211 |
|
212 \onslide<7->{Sounds stupid: ``\ldots answering a question with a counter question''\medskip\\ |
|
213 was originally developed at CMU for terminals to connect to |
|
214 workstations (e.g., file servers)} |
|
215 |
|
216 \end{frame}} |
|
217 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
218 |
|
219 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
220 \mode<presentation>{ |
|
221 \begin{frame}[c] |
|
222 \frametitle{Identify Friend or Foe} |
|
223 |
|
224 \begin{center} |
|
225 \onslide<3->{\mbox{}\hspace{3.4cm}\includegraphics[scale=0.55]{pics/MigInMiddle.jpg}} |
|
226 \end{center} |
|
227 |
|
228 \begin{textblock}{6}(0.3,2) |
|
229 \onslide<2->{ |
|
230 198?: war between Angola (supported by Cuba) |
|
231 and Namibia (supported by SA)} |
|
232 \end{textblock} |
|
233 |
|
234 \begin{textblock}{3}(12.5,4.6) |
|
235 \onslide<3->{ |
|
236 \begin{tikzpicture} |
|
237 \node at (0,0) [single arrow, fill=red,text=white, rotate=-50, shape border rotate=180]{``bystander''}; |
|
238 \end{tikzpicture}} |
|
239 \end{textblock} |
|
240 |
|
241 \begin{textblock}{3}(10.9,10) |
|
242 \onslide<3->{ |
|
243 \begin{tikzpicture} |
|
244 \node at (0,0) [single arrow, fill=red,text=white, rotate=-40, shape border rotate=180]{attacker}; |
|
245 \end{tikzpicture}} |
|
246 \end{textblock} |
|
247 |
|
248 \only<4->{ |
|
249 \begin{textblock}{6}(0.3,9) |
|
250 being outsmarted by Angola/Cuba |
|
251 ended SA involvement (?) |
|
252 \end{textblock}} |
|
253 \only<5->{ |
|
254 \begin{textblock}{6}(0.3,13) |
|
255 IFF opened up a nice side-channel attack |
|
256 \end{textblock}} |
|
257 \end{frame}} |
|
258 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
259 |
|
260 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
261 \mode<presentation>{ |
|
262 \begin{frame}[c] |
|
263 \frametitle{Encryption to the Rescue?} |
|
264 |
|
265 |
|
266 \begin{itemize} |
|
267 \item \bl{$A \,\text{sends}\, B : \{A, N_A\}_{K_{AB}}$}\hspace{1cm} encrypted\bigskip |
|
268 \item \bl{$B\,\text{sends}\, A : \{N_A, K'_{AB}\}_{K_{AB}}$}\bigskip |
|
269 \item \bl{$A \,\text{sends}\, B : \{N_A\}_{K'_{AB}}$}\bigskip |
|
270 \end{itemize}\pause |
|
271 |
|
272 means you need to send separate ``Hello'' signals (bad), or worse |
|
273 share a single key between many entities |
|
274 \end{frame}} |
|
275 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
276 |
|
277 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
278 \mode<presentation>{ |
|
279 \begin{frame}[c] |
|
280 \frametitle{Protocol Attacks} |
|
281 |
|
282 \begin{itemize} |
|
283 \item replay attacks |
|
284 \item reflection attacks |
|
285 \item man-in-the-middle attacks |
|
286 \item timing attacks |
|
287 \item parallel session attacks |
|
288 \item binding attacks (public key protocols) |
|
289 \item changing environment / changing assumptions\bigskip |
|
290 |
|
291 \item (social engineering attacks) |
|
292 \end{itemize} |
|
293 \end{frame}} |
|
294 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
295 |
|
296 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
297 \mode<presentation>{ |
|
298 \begin{frame}[c] |
|
299 \frametitle{Replay Attacks} |
|
300 |
|
301 Schroeder-Needham protocol: exchange of a symmetric key with a trusted 3rd-party \bl{$S$}: |
|
302 |
|
303 \begin{center} |
|
304 \begin{tabular}{r@ {\hspace{1mm}}l} |
|
305 \bl{$A \rightarrow S :$} & \bl{$A, B, N_A$}\\ |
|
306 \bl{$S \rightarrow A :$} & \bl{$\{N_A, B, K_{AB},\{K_{AB}, A\}_{K_{BS}} \}_{K_{AS}}$}\\ |
|
307 \bl{$A \rightarrow B :$} & \bl{$\{K_{AB}, A\}_{K_{BS}} $}\\ |
|
308 \bl{$B \rightarrow A :$} & \bl{$\{N_B\}_{K_{AB}}$}\\ |
|
309 \bl{$A \rightarrow B :$} & \bl{$\{N_B-1\}_{K_{AB}}$}\\ |
|
310 \end{tabular} |
|
311 \end{center}\bigskip\pause |
|
312 |
|
313 at the end of the protocol both \bl{$A$} and \bl{$B$} should be in the possession of the secret key |
|
314 \bl{$K_{AB}$} and know that the other principal has the key |
|
315 |
|
316 \end{frame}} |
|
317 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
318 |
|
319 |
|
320 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
321 \mode<presentation>{ |
|
322 \begin{frame}[c] |
|
323 \frametitle{Nonces} |
|
324 |
|
325 \begin{enumerate} |
|
326 \item I generate a nonce (random number) and send it to you encrypted with a key we share |
|
327 \item you increase it by one, encrypt it under a key I know and send |
|
328 it back to me |
|
329 \end{enumerate} |
|
330 |
|
331 |
|
332 I can infer: |
|
333 |
|
334 \begin{itemize} |
|
335 \item you must have received my message |
|
336 \item you could only have generated your answer after I send you my initial |
|
337 message |
|
338 \item if only you and me know the key, the message must have come from you |
|
339 \end{itemize} |
|
340 |
|
341 \end{frame}} |
|
342 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
343 |
|
344 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
345 \mode<presentation>{ |
|
346 \begin{frame}[c] |
|
347 |
|
348 \begin{center} |
|
349 \begin{tabular}{l} |
|
350 \bl{$A \rightarrow S :$} \bl{$A, B, N_A$}\\ |
|
351 \bl{$S \rightarrow A :$} \bl{$\{N_A, B, K_{AB},\{K_{AB}, A\}_{K_{BS}} \}_{K_{AS}}$}\\ |
|
352 \bl{$A \rightarrow B :$} \bl{$\{K_{AB}, A\}_{K_{BS}} $}\\ |
|
353 \bl{$B \rightarrow A :$} \bl{$\{N_B\}_{K_{AB}}$}\\ |
|
354 \bl{$A \rightarrow B :$} \bl{$\{N_B-1\}_{K_{AB}}$}\pause\\ |
|
355 \hspace{5cm}compromise \bl{$K_{AB}$}\pause\\ |
|
356 \bl{$A \rightarrow S :$} \bl{$A, B, N'_A$}\\ |
|
357 \bl{$S \rightarrow A :$} \bl{$\{N'_A, B, K'_{AB},\{K'_{AB}, A\}_{K_{BS}} \}_{K_{AS}}$}\pause\\ |
|
358 \bl{$I(A) \rightarrow B :$} \bl{$\{K_{AB}, A\}_{K_{BS}} $}\hspace{0.5cm} replay of older run\pause\\ |
|
359 \bl{$B \rightarrow I(A) :$} \bl{$\{N'_B\}_{K_{AB}}$}\\ |
|
360 \bl{$I(A) \rightarrow B :$} \bl{$\{N'_B-1\}_{K_{AB}}$}\ |
|
361 \end{tabular} |
|
362 \end{center}\pause |
|
363 |
|
364 \bl{$B$} believes it is following the correct protocol, |
|
365 intruder \bl{$I$} can form the correct response because it knows \bl{$K_{AB}$} and |
|
366 talks to \bl{$B$} masquerading as \bl{$A$} |
|
367 \end{frame}} |
|
368 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
369 |
|
370 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
371 \mode<presentation>{ |
|
372 \begin{frame}[c] |
|
373 |
|
374 \begin{center} |
|
375 \includegraphics[scale=0.5]{pics/dogs.jpg} |
|
376 \end{center} |
|
377 |
|
378 \end{frame}} |
|
379 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
380 |
|
381 |
|
382 |
|
383 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
384 \mode<presentation>{ |
|
385 \begin{frame}[c] |
|
386 \frametitle{Replay Attacks} |
|
387 |
|
388 Andrew Secure RPC protocol: exchanging a new key |
|
389 between \bl{$A$} and \bl{$B$} |
|
390 |
|
391 \begin{center} |
|
392 \begin{tabular}{l} |
|
393 \bl{$A \rightarrow B :$} \bl{$A, \{N_A\}_{K_{AB}}$}\\ |
|
394 \bl{$B \rightarrow A :$} \bl{$\{N_A+1, N_B\}_{K_{AB}}$}\\ |
|
395 \bl{$A \rightarrow B :$} \bl{$\{N_B+1\}_{K_{AB}}$}\\ |
|
396 \bl{$B \rightarrow A :$} \bl{$\{K^{new}_{AB}, N^{new}_B\}_{K_{AB}}$}\\ |
|
397 \end{tabular} |
|
398 \end{center}\bigskip\pause |
|
399 |
|
400 Assume nonces are represented as bit-sequences of the same length as keys |
|
401 \begin{center} |
|
402 \begin{tabular}{@{}l@{}} |
|
403 \bl{$A \rightarrow B :$} \bl{$A, \{N_A\}_{K_{AB}}$}\\ |
|
404 \bl{$B \rightarrow A :$} \bl{$\{N_A+1, N_B\}_{K_{AB}}$}\\ |
|
405 \bl{$A \rightarrow I(B) :$} \bl{$\{N_B+1\}_{K_{AB}}$}\hspace{0.5mm}intercepts\\ |
|
406 \bl{$I(B) \rightarrow A :$} \bl{$\{N_A+1, N_B\}_{K_{AB}}$}\hspace{0.5mm}resend 2nd msg\\ |
|
407 \end{tabular} |
|
408 \end{center} |
|
409 \end{frame}} |
|
410 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
411 |
|
412 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
413 \mode<presentation>{ |
|
414 \begin{frame}[c] |
|
415 \frametitle{Time-Stamps} |
|
416 |
|
417 The Schroeder-Needham protocol can be fixed by including a time-stamp (e.g., in Kerberos): |
|
418 |
|
419 \begin{center} |
|
420 \begin{tabular}{r@ {\hspace{1mm}}l} |
|
421 \bl{$A \rightarrow S :$} & \bl{$A, B, N_A$}\\ |
|
422 \bl{$S \rightarrow A :$} & \bl{$\{N_A, B, K_{AB},\{K_{AB}, A, T_S\}_{K_{BS}} \}_{K_{AS}}$}\\ |
|
423 \bl{$A \rightarrow B :$} & \bl{$\{K_{AB}, A, T_S\}_{K_{BS}} $}\\ |
|
424 \bl{$B \rightarrow A :$} & \bl{$\{N_B\}_{K_{AB}}$}\\ |
|
425 \bl{$A \rightarrow B :$} & \bl{$\{N_B-1\}_{K_{AB}}$}\\ |
|
426 \end{tabular} |
|
427 \end{center}\bigskip\pause |
|
428 |
|
429 but nothing is for free: then you need to synchronise time and possibly become a victim to |
|
430 timing attacks |
|
431 |
|
432 \end{frame}} |
|
433 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
434 |
|
435 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
436 \mode<presentation>{ |
|
437 \begin{frame}[c] |
|
438 |
|
439 It can also be fixed by including another nonce: |
|
440 |
|
441 \begin{center} |
|
442 \begin{tabular}{r@ {\hspace{1mm}}l} |
|
443 \bl{$A \rightarrow B :$} & \bl{$A$}\\ |
|
444 \bl{$B \rightarrow A :$} & \bl{$\{A, N_B\}_{K_{BS}}$}\\ |
|
445 \bl{$A \rightarrow S :$} & \bl{$A, B, N_A, \{A, N_B\}_{K_{BS}}$}\\ |
|
446 \bl{$S \rightarrow A :$} & \bl{$\{N_A, B, K_{AB},\{K_{AB}, A, N_B\}_{K_{BS}} \}_{K_{AS}}$}\\ |
|
447 \bl{$A \rightarrow B :$} & \bl{$\{K_{AB}, A, N_B\}_{K_{BS}} $}\\ |
|
448 \bl{$B \rightarrow A :$} & \bl{$\{N_B\}_{K_{AB}}$}\\ |
|
449 \bl{$A \rightarrow B :$} & \bl{$\{N_B-1\}_{K_{AB}}$}\\ |
|
450 \end{tabular} |
|
451 \end{center}\bigskip\pause |
|
452 |
|
453 but nothing is for free: then you need to synchronise time and possibly become victim to |
|
454 timing attacks |
|
455 |
|
456 \end{frame}} |
|
457 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
458 |
|
459 |
|
460 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
461 \mode<presentation>{ |
|
462 \begin{frame}[c] |
|
463 \frametitle{Binding Attacks} |
|
464 |
|
465 with public-private keys it is important that the public key is \alert{bound} |
|
466 to the right owner (verified by a certification authority \bl{$CA$}) |
|
467 |
|
468 \begin{center} |
|
469 \begin{tabular}{l} |
|
470 \bl{$A \rightarrow CA :$} \bl{$A, B, N_A$}\\ |
|
471 \bl{$CA \rightarrow A :$} \bl{$CA, \{CA, A, N_A, K^{pub}_{B}\}_{K^{pub}_{A}}$}\\ |
|
472 \end{tabular} |
|
473 \end{center}\bigskip |
|
474 |
|
475 \bl{$A$} knows \bl{$K^{priv}_A$} and can verify the message came from \bl{$CA$} |
|
476 in response to \bl{$A$}'s message and trusts \bl{$K^{pub}_{B}$} is \bl{$B$}'s public key |
|
477 |
|
478 |
|
479 \end{frame}} |
|
480 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
481 |
|
482 |
|
483 |
|
484 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
485 \mode<presentation>{ |
|
486 \begin{frame}[c] |
|
487 \frametitle{Binding Attacks} |
|
488 |
|
489 \begin{center} |
|
490 \begin{tabular}{l} |
|
491 \bl{$A \rightarrow I(CA) :$} \bl{$A, B, N_A$}\\ |
|
492 \bl{$I(A) \rightarrow CA :$} \bl{$A, I, N_A$}\\ |
|
493 \bl{$CA \rightarrow I(A) :$} \bl{$CA, \{CA, A, N_A, K^{pub}_{I}\}_{K^{pub}_{A}}$}\\ |
|
494 \bl{$I(CA) \rightarrow A :$} \bl{$CA, \{CA, A, N_A, K^{pub}_{I}\}_{K^{pub}_{A}}$}\\ |
|
495 \end{tabular} |
|
496 \end{center}\pause |
|
497 |
|
498 \bl{$A$} now encrypts messages for \bl{$B$} with the public key of \bl{$I$} |
|
499 (which happily decrypts them with its private key) |
|
500 |
|
501 \end{frame}} |
|
502 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
503 |
|
504 |
|
505 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
506 \mode<presentation>{ |
|
507 \begin{frame}[c] |
|
508 |
|
509 There are plenty of other protocols and attacks. This could go on ``forever''.\pause\bigskip |
|
510 |
|
511 We look here on one more kind of attacks that are because of a changing environment. |
|
512 |
|
513 \end{frame}} |
|
514 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
515 |
|
516 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
517 \mode<presentation>{ |
|
518 \begin{frame}[t] |
|
519 \frametitle{Changing Environment Attacks} |
|
520 |
|
521 \begin{itemize} |
|
522 \item all protocols rely on some assumptions about the environment |
|
523 (e.g., cryptographic keys cannot be broken)\bigskip\pause |
|
524 \end{itemize} |
|
525 |
|
526 \only<2>{ |
|
527 \begin{itemize} |
|
528 \item in the ``good olden days'' (1960/70) rail transport was cheap, so fraud was not |
|
529 worthwhile |
|
530 \end{itemize}} |
|
531 |
|
532 \only<3>{ |
|
533 \begin{itemize} |
|
534 \item when it got expensive, some people bought cheaper monthly tickets for a suburban |
|
535 station and a nearby one, and one for the destination and a nearby one |
|
536 \item a large investment later all barriers were automatic and tickets could record state |
|
537 \end{itemize}} |
|
538 |
|
539 \only<4>{ |
|
540 \begin{itemize} |
|
541 \item but suddenly the environment changed: rail transport got privatised creating many |
|
542 competing companies |
|
543 potentially cheating each other |
|
544 \item revenue from monthly tickets was distributed according to a formula involving where the ticket was bought\ldots |
|
545 \end{itemize}} |
|
546 |
|
547 \only<5>{ |
|
548 \begin{itemize} |
|
549 \item apart from bad outsiders (passengers), you also had bad insiders (rail companies) |
|
550 \item chaos and litigation ensued |
|
551 \end{itemize}} |
|
552 |
|
553 \end{frame}} |
|
554 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
555 |
|
556 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
557 \mode<presentation>{ |
|
558 \begin{frame}[c] |
|
559 |
|
560 A Man-in-the-middle attack in real life: |
|
561 |
|
562 \begin{itemize} |
|
563 \item the card only says yes or no to the terminal if the PIN is correct |
|
564 \item trick the card in thinking transaction is verified by signature |
|
565 \item trick the terminal in thinking the transaction was verified by PIN |
|
566 \end{itemize} |
|
567 |
|
568 \begin{minipage}{1.1\textwidth} |
|
569 \begin{center} |
|
570 \mbox{}\hspace{-6mm}\includegraphics[scale=0.5]{pics/chip-attack.png} |
|
571 \includegraphics[scale=0.3]{pics/chipnpinflaw.png} |
|
572 \end{center} |
|
573 \end{minipage} |
|
574 |
|
575 \end{frame}} |
|
576 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
577 |
|
578 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
579 \mode<presentation>{ |
|
580 \begin{frame}[c] |
|
581 \frametitle{Problems with EMV} |
|
582 |
|
583 \begin{itemize} |
|
584 \item it is a wrapper for many protocols |
|
585 \item specification by consensus (resulted unmanageable complexity) |
|
586 \item its specification is 700 pages in English plus 2000+ pages for testing, additionally some |
|
587 further parts are secret |
|
588 \item other attacks have been found |
|
589 |
|
590 \item one solution might be to require always online verification of the PIN with the bank |
|
591 \end{itemize} |
|
592 |
|
593 \end{frame}} |
|
594 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
595 |
|
596 |
|
597 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
598 \mode<presentation>{ |
|
599 \begin{frame}[c] |
|
600 \frametitle{Problems with WEP (Wifi)} |
|
601 |
|
602 \begin{itemize} |
|
603 \item a standard ratified in 1999 |
|
604 \item the protocol was designed by a committee not including cryptographers |
|
605 \item it used the RC4 encryption algorithm which is a stream cipher requiring a unique nonce |
|
606 \item WEP did not allocate enough bits for the nonce |
|
607 \item for authenticating packets it used CRC checksum which can be easily broken |
|
608 \item the network password was used to directly encrypt packages (instead of a key negotiation protocol)\bigskip |
|
609 \item encryption was turned of by default |
|
610 \end{itemize} |
|
611 |
|
612 \end{frame}} |
|
613 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
614 |
|
615 |
|
616 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
617 \mode<presentation>{ |
|
618 \begin{frame}[c] |
|
619 \frametitle{Protocols are Difficult} |
|
620 |
|
621 \begin{itemize} |
|
622 \item even the systems designed by experts regularly fail\medskip |
|
623 \item try to make everything explicit (you need to authenticate all data you might rely on)\medskip |
|
624 \item the one who can fix a system should also be liable for the losses\medskip |
|
625 \item cryptography is often not {\bf the} answer\bigskip\bigskip |
|
626 \end{itemize} |
|
627 |
|
628 logic is one way protocols are studied in academia |
|
629 (you can use computers to search for attacks) |
|
630 |
|
631 \end{frame}} |
|
632 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
633 |
|
634 |
|
635 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
636 \mode<presentation>{ |
|
637 \begin{frame}[c] |
|
638 \frametitle{Public-Key Infrastructure} |
|
639 |
|
640 \begin{itemize} |
|
641 \item the idea is to have a certificate authority (CA) |
|
642 \item you go to the CA to identify yourself |
|
643 \item CA: ``I, the CA, have verified that public key \bl{$P^{pub}_{Bob}$} belongs to Bob''\bigskip |
|
644 \item CA must be trusted by everybody |
|
645 \item What happens if CA issues a false certificate? Who pays in case of loss? (VeriSign |
|
646 explicitly limits liability to \$100.) |
|
647 \end{itemize} |
|
648 |
|
649 \end{frame}} |
|
650 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
651 |
|
652 |
|
653 |
|
654 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
655 \mode<presentation>{ |
|
656 \begin{frame}[c] |
|
657 \frametitle{Privacy, Anonymity et al} |
|
658 |
|
659 Some terminology: |
|
660 |
|
661 \begin{itemize} |
|
662 \item \alert{secrecy} is the mechanism used to limit the number of |
|
663 principals with access to information (eg, cryptography or access controls) |
|
664 |
|
665 \item \alert{confidentiality} is the obligation to protect the secrets of other people |
|
666 or organizations (secrecy for the benefit of an organisation) |
|
667 |
|
668 \item \alert{anonymity} is the ability to leave no evidence of an activity (eg, sharing a secret) |
|
669 |
|
670 \item \alert{privacy} is the ability or right to protect your personal secrets |
|
671 (secrecy for the benefit of an individual) |
|
672 |
|
673 \end{itemize} |
|
674 |
|
675 \end{frame}} |
|
676 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
677 |
|
678 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
679 \mode<presentation>{ |
|
680 \begin{frame}[t] |
|
681 \frametitle{Privacy vs Anonymity} |
|
682 |
|
683 \begin{itemize} |
|
684 \item everybody agrees that anonymity has its uses (e.g., voting, whistleblowers, peer-review) |
|
685 \end{itemize}\bigskip\bigskip\pause |
|
686 |
|
687 |
|
688 But privacy?\bigskip\bigskip |
|
689 |
|
690 ``You have zero privacy anyway. Get over it.''\\ |
|
691 \hfill{}Scott Mcnealy (CEO of Sun)\bigskip\\ |
|
692 |
|
693 |
|
694 If you have nothing to hide, you have nothing to fear. |
|
695 |
|
696 \end{frame}} |
|
697 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
698 |
|
699 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
700 \mode<presentation>{ |
|
701 \begin{frame}[t] |
|
702 \frametitle{Privacy} |
|
703 |
|
704 private data can be often used against me |
|
705 |
|
706 \begin{itemize} |
|
707 \item if my location data becomes public, thieves will switch off their phones and help themselves in my home |
|
708 \item if supermarkets can build a profile of what I buy, they can use it to their advantage (banks - mortgages) |
|
709 \item my employer might not like my opinions\bigskip\pause |
|
710 |
|
711 \item one the other hand, Freedom-of-Information Act |
|
712 \item medical data should be private, but medical research needs data |
|
713 \end{itemize} |
|
714 |
|
715 \end{frame}} |
|
716 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
717 |
|
718 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
719 \mode<presentation>{ |
|
720 \begin{frame}[t] |
|
721 \frametitle{Privacy Problems} |
|
722 |
|
723 \begin{itemize} |
|
724 \item Apple takes note of every dictation (send over the Internet to Apple) |
|
725 \item markets often only work, if data is restricted (to build trust) |
|
726 \item Social network can reveal data about you |
|
727 \item have you tried the collusion extension for FireFox? |
|
728 \item I do use Dropbox, store cards\bigskip |
|
729 \item next week: anonymising data |
|
730 \end{itemize} |
|
731 |
|
732 \begin{textblock}{5}(12,8.9) |
|
733 \includegraphics[scale=0.3]{pics/gattaca.jpg}\\ |
|
734 \small Gattaca (1997) |
|
735 \end{textblock} |
|
736 |
|
737 \end{frame}} |
|
738 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
739 |
|
740 |
|
741 \end{document} |
|
742 |
|
743 %%% Local Variables: |
|
744 %%% mode: latex |
|
745 %%% TeX-master: t |
|
746 %%% End: |
|
747 |
|