52 \end{itemize} |
52 \end{itemize} |
53 |
53 |
54 \end{frame} |
54 \end{frame} |
55 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
55 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
56 |
56 |
57 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
58 \begin{frame}[c] |
|
59 \frametitle{Protocols} |
|
60 |
|
61 \begin{center} |
|
62 \includegraphics[scale=0.11]{../pics/keyfob.jpg} |
|
63 \quad |
|
64 \includegraphics[scale=0.3025]{../pics/startstop.jpg} |
|
65 \end{center} |
|
66 |
|
67 \begin{itemize} |
|
68 \item Other examples: Wifi, Http-request, TCP-request, |
|
69 card readers, RFID (passports)\ldots\medskip\pause |
|
70 |
|
71 \item The point is that we cannot control the network: An attacker |
|
72 can install a packet sniffer, inject packets, modify packets, |
|
73 replay messages\ldots{}fake pretty much everything. |
|
74 \end{itemize} |
|
75 |
|
76 \end{frame} |
|
77 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
78 |
|
79 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
80 \begin{frame}[c] |
|
81 \frametitle{Keyless Car Transponders} |
|
82 |
|
83 \begin{center} |
|
84 \includegraphics[scale=0.1]{../pics/keyfob.jpg} |
|
85 \quad |
|
86 \includegraphics[scale=0.27]{../pics/startstop.jpg} |
|
87 \end{center} |
|
88 |
|
89 \begin{itemize} |
|
90 \item There are two security mechanisms: one remote central |
|
91 locking system and one passive RFID tag (engine immobiliser). |
|
92 \item How can I get in? How can thieves be kept out? |
|
93 How to avoid MITM attacks? |
|
94 \end{itemize}\medskip |
|
95 |
|
96 \footnotesize |
|
97 \hfill Papers: Gone in 360 Seconds: Hijacking with Hitag2,\\ |
|
98 \hfill Dismantling Megamos Crypto: Wirelessly Lockpicking\\ |
|
99 \hfill a Vehicle Immobilizer |
|
100 |
|
101 \end{frame} |
|
102 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
103 |
|
104 |
|
105 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
106 \begin{frame}[c] |
|
107 \frametitle{Public-Key Infrastructure} |
|
108 |
|
109 \begin{itemize} |
|
110 \item the idea is to have a certificate authority (CA) |
|
111 \item you go to the CA to identify yourself |
|
112 \item CA: ``I, the CA, have verified that public key \bl{$P^{pub}_{Bob}$} belongs to Bob''\bigskip |
|
113 \item CA must be trusted by everybody |
|
114 \item What happens if CA issues a false certificate? Who pays in case of loss? (VeriSign |
|
115 explicitly limits liability to \$100.) |
|
116 \end{itemize} |
|
117 |
|
118 \end{frame} |
|
119 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
120 |
|
121 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
122 \begin{frame}[c] |
|
123 \frametitle{Man-in-the-Middle} |
|
124 |
|
125 ``Normal'' protocol run:\bigskip |
|
126 |
|
127 \begin{itemize} |
|
128 \item \bl{$A$} sends public key to \bl{$B$} |
|
129 \item \bl{$B$} sends public key to \bl{$A$} |
|
130 \item \bl{$A$} sends message encrypted with \bl{$B$}'s public key, \bl{$B$} decrypts it |
|
131 with its private key |
|
132 \item \bl{$B$} sends message encrypted with \bl{$A$}'s public key, \bl{$A$} decrypts it |
|
133 with its private key |
|
134 \end{itemize} |
|
135 |
|
136 \end{frame} |
|
137 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
138 |
|
139 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
140 \begin{frame}[c] |
|
141 \frametitle{Man-in-the-Middle} |
|
142 |
|
143 Attack: |
|
144 |
|
145 \begin{itemize} |
|
146 \item \bl{$A$} sends public key to \bl{$B$} --- \bl{$C$} intercepts this message and send his own public key |
|
147 \item \bl{$B$} sends public key to \bl{$A$} --- \bl{$C$} intercepts this message and send his own public key |
|
148 \item \bl{$A$} sends message encrypted with \bl{$C$}'s public key, \bl{$C$} decrypts it |
|
149 with its private key, re-encrypts with \bl{$B$}'s public key |
|
150 \item similar for other direction |
|
151 \end{itemize} |
|
152 |
|
153 \end{frame} |
|
154 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
155 |
|
156 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
157 \begin{frame}[c] |
|
158 \frametitle{Man-in-the-Middle} |
|
159 |
|
160 Potential Prevention? |
|
161 |
|
162 \begin{itemize} |
|
163 \item \bl{$A$} sends public key to \bl{$B$} |
|
164 \item \bl{$B$} sends public key to \bl{$A$} |
|
165 \item \bl{$A$} encrypts message with \bl{$B$}'s public key, send's {\bf half} of the message |
|
166 \item \bl{$B$} encrypts message with \bl{$A$}'s public key, send's {\bf half} of the message |
|
167 \item \bl{$A$} sends other half, \bl{$B$} can now decrypt entire message |
|
168 \item \bl{$B$} sends other half, \bl{$A$} can now decrypt entire message |
|
169 \end{itemize}\pause |
|
170 |
|
171 %\bl{$C$} would have to invent a totally new message |
|
172 \alert{Under which circumstances does this protocol prevent |
|
173 MiM-attacks, or does it?} |
|
174 |
|
175 \end{frame} |
|
176 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
177 |
|
178 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
179 \begin{frame}[c] |
|
180 \frametitle{Car Transponder (HiTag2)} |
|
181 |
|
182 \begin{enumerate} |
|
183 \item \bl{$C$} generates a random number \bl{$N$} |
|
184 \item \bl{$C$} calculates \bl{$(F,G) = \{N\}_K$} |
|
185 \item \bl{$C \to T$}: \bl{$N, F$} |
|
186 \item \bl{$T$} calculates \bl{$(F',G') = \{N\}_K$} |
|
187 \item \bl{$T$} checks that \bl{$F = F'$} |
|
188 \item \bl{$T \to C$}: \bl{$N, G'$} |
|
189 \item \bl{$C$} checks that \bl{$G = G'$} |
|
190 \end{enumerate}\pause |
|
191 |
|
192 \small |
|
193 This process means that the transponder believes the car knows |
|
194 the key \bl{$K$}, and the car believes the transponder knows |
|
195 the key \bl{$K$}. They have authenticated themselves |
|
196 to each other, or have they? |
|
197 |
|
198 \end{frame} |
|
199 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
200 |
|
201 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
202 \begin{frame}[c] |
|
203 |
|
204 A Man-in-the-middle attack in real life: |
|
205 |
|
206 \begin{itemize} |
|
207 \item the card only says yes to the terminal if the PIN is correct |
|
208 \item trick the card in thinking transaction is verified by signature |
|
209 \item trick the terminal in thinking the transaction was verified by PIN |
|
210 \end{itemize} |
|
211 |
|
212 \begin{minipage}{1.1\textwidth} |
|
213 \begin{center} |
|
214 \mbox{}\hspace{-6mm}\includegraphics[scale=0.5]{../pics/chip-attack.png} |
|
215 \includegraphics[scale=0.3]{../pics/chipnpinflaw.png} |
|
216 \end{center} |
|
217 \end{minipage} |
|
218 |
|
219 \end{frame} |
|
220 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
221 |
|
222 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
223 \begin{frame}[c] |
|
224 \frametitle{Problems with EMV} |
|
225 |
|
226 \begin{itemize} |
|
227 \item it is a wrapper for many protocols |
|
228 \item specification by consensus (resulted unmanageable complexity) |
|
229 \item its specification is 700 pages in English plus 2000+ pages for testing, additionally some |
|
230 further parts are secret |
|
231 \item other attacks have been found |
|
232 \end{itemize} |
|
233 |
|
234 \end{frame} |
|
235 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
236 |
|
237 |
|
238 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
239 \begin{frame}[c] |
|
240 \frametitle{Protocols are Difficult} |
|
241 |
|
242 \begin{itemize} |
|
243 \item even the systems designed by experts regularly fail\medskip |
|
244 \item the one who can fix a system should also be liable for the losses\medskip |
|
245 \item cryptography is often not the problem\bigskip\bigskip |
|
246 \end{itemize} |
|
247 |
|
248 \end{frame} |
|
249 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
250 |
|
251 |
|
252 |
|
253 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
254 \begin{frame}[c] |
|
255 \frametitle{A Simple PK Protocol} |
|
256 |
|
257 |
|
258 \begin{center} |
|
259 \begin{tabular}{ll@{\hspace{2mm}}l} |
|
260 1. & \bl{$A \to B :$} & \bl{$K^{pub}_A$}\smallskip\\ |
|
261 2. & \bl{$B \to A :$} & \bl{$K^{pub}_B$}\smallskip\\ |
|
262 3. & \bl{$A \to B :$} & \bl{$\{A,m\}_{K^{pub}_B}$}\smallskip\\ |
|
263 4. & \bl{$B \to A :$} & \bl{$\{B,m'\}_{K^{pub}_A}$} |
|
264 \end{tabular} |
|
265 \end{center}\pause\bigskip |
|
266 |
|
267 unfortunately there is a simple man-in-the- middle-attack |
|
268 \end{frame} |
|
269 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
270 |
|
271 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
272 \begin{frame}[c] |
|
273 \frametitle{A MITM Attack} |
|
274 |
|
275 |
|
276 \begin{center} |
|
277 \begin{tabular}{ll@{\hspace{2mm}}l} |
|
278 1. & \bl{$A \to E :$} & \bl{$K^{pub}_A$}\smallskip\\ |
|
279 2. & \bl{$E \to B :$} & \bl{$K^{pub}_E$}\smallskip\\ |
|
280 3. & \bl{$B \to E :$} & \bl{$K^{pub}_B$}\smallskip\\ |
|
281 4. & \bl{$E \to A :$} & \bl{$K^{pub}_E$}\smallskip\\ |
|
282 5. & \bl{$A \to E :$} & \bl{$\{A,m\}_{K^{pub}_E}$}\smallskip\\ |
|
283 6. & \bl{$E \to B :$} & \bl{$\{E,m\}_{K^{pub}_B}$}\smallskip\\ |
|
284 7. & \bl{$B \to E :$} & \bl{$\{B,m'\}_{K^{pub}_E}$}\smallskip\\ |
|
285 8. & \bl{$E \to A :$} & \bl{$\{E,m'\}_{K^{pub}_A}$} |
|
286 \end{tabular} |
|
287 \end{center}\pause\medskip |
|
288 |
|
289 and \bl{$A$} and \bl{$B$} have no chance to detect it |
|
290 \end{frame} |
|
291 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
292 |
|
293 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
294 \begin{frame}[c] |
|
295 \frametitle{Interlock Protocol} |
|
296 |
|
297 The interlock protocol (``best bet'' against MITM): |
|
298 |
|
299 \begin{center} |
|
300 \begin{tabular}{ll@{\hspace{2mm}}l} |
|
301 1. & \bl{$A \to B :$} & \bl{$K^{pub}_A$}\\ |
|
302 2. & \bl{$B \to A :$} & \bl{$K^{pub}_B$}\\ |
|
303 3. & & \bl{$\{A,m\}_{K^{pub}_B} \;\mapsto\; H_1,H_2$}\\ |
|
304 & & \bl{$\{B,m'\}_{K^{pub}_A} \;\mapsto\; M_1,M_2$}\\ |
|
305 4. & \bl{$A \to B :$} & \bl{$H_1$}\\ |
|
306 5. & \bl{$B \to A :$} & \bl{$\{H_1, M_1\}_{K^{pub}_A}$}\\ |
|
307 6. & \bl{$A \to B :$} & \bl{$\{H_2, M_1\}_{K^{pub}_B}$}\\ |
|
308 7. & \bl{$B \to A :$} & \bl{$M_2$} |
|
309 \end{tabular} |
|
310 \end{center} |
|
311 |
|
312 \end{frame} |
|
313 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
314 |
|
315 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
316 \begin{frame}[c] |
|
317 \frametitle{Splitting Messages} |
|
318 |
|
319 \begin{center} |
|
320 $\underbrace{\texttt{\Grid{0X1peUVTGJK+H70mMjAM8p}}}_{\bl{\{A,m\}_{K^{pub}_B}}}$ |
|
321 \end{center} |
|
322 |
|
323 \begin{center} |
|
324 $\underbrace{\texttt{\Grid{0X1peUVTGJK}}}_{\bl{H_1}}$\quad |
|
325 $\underbrace{\texttt{\Grid{+H70mMjAM8p}}}_{\bl{H_2}}$ |
|
326 \end{center} |
|
327 |
|
328 \begin{itemize} |
|
329 \item you can also use the even and odd bytes |
|
330 \item the point is you cannot decrypt the halves, even if you |
|
331 have the key |
|
332 \end{itemize} |
|
333 |
|
334 |
|
335 \end{frame} |
|
336 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
337 |
|
338 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
339 \begin{frame}[c] |
|
340 |
|
341 \begin{center} |
|
342 \begin{tabular}{l@{\hspace{9mm}}l} |
|
343 \begin{tabular}[t]{@{}l@{}} |
|
344 \bl{$A \to C : K^{pub}_A$}\\ |
|
345 \bl{$C \to B : K^{pub}_C$}\\ |
|
346 \bl{$B \to C : K^{pub}_B$}\\ |
|
347 \bl{$C \to A : K^{pub}_C$}\medskip\\ |
|
348 \bl{$\{A,m\}_{K^{pub}_C} \;\mapsto\; H_1,H_2$}\\ |
|
349 \bl{$\{B,m'\}_{K^{pub}_C} \;\mapsto\; M_1,M_2$}\bigskip\\ |
|
350 \bl{$\{C,a\}_{K^{pub}_B} \;\mapsto\; C_1,C_2$}\\ |
|
351 \bl{$\{C,b\}_{K^{pub}_A} \;\mapsto\; D_1,D_2$} |
|
352 \end{tabular} & |
|
353 \begin{tabular}[t]{@{}l@{}} |
|
354 \bl{$A \to C : H_1$}\\ |
|
355 \bl{$C \to B : C_1$}\\ |
|
356 \bl{$B \to C : \{C_1, M_1\}_{K^{pub}_C}$}\\ |
|
357 \bl{$C \to A : \{H_1, D_1\}_{K^{pub}_A}$}\\ |
|
358 \bl{$A \to C : \{H_2, D_1\}_{K^{pub}_C}$}\\ |
|
359 \bl{$C \to B : \{C_2, M_1\}_{K^{pub}_B}$}\\ |
|
360 \bl{$B \to C : M_2$}\\ |
|
361 \bl{$C \to A : D_2$} |
|
362 \end{tabular} |
|
363 \end{tabular} |
|
364 \end{center}\pause |
|
365 |
|
366 \footnotesize |
|
367 \bl{$m$} = How is your grandmother? \bl{$m'$} = How is the |
|
368 weather today in London? |
|
369 |
|
370 \end{frame} |
|
371 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
372 |
|
373 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
374 \begin{frame}[c] |
|
375 |
|
376 \begin{itemize} |
|
377 \item you have to ask something that cannot be imitated |
|
378 (requires \bl{$A$} and \bl{$B$} know each other) |
|
379 \item what happens if \bl{$m$} and \bl{$m'$} are voice |
|
380 messages?\bigskip\pause |
|
381 |
|
382 \item So \bl{$C$} can either leave the communication unchanged, |
|
383 or invent a complete new conversation |
|
384 |
|
385 \end{itemize} |
|
386 |
|
387 \end{frame} |
|
388 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
389 |
|
390 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
391 \begin{frame}[c] |
|
392 |
|
393 \begin{itemize} |
|
394 \item the moral: establishing a secure connection from |
|
395 ``zero'' is almost impossible---you need to rely on some |
|
396 established trust\medskip |
|
397 |
|
398 \item that is why PKI relies on certificates, which however are |
|
399 badly, badly realised |
|
400 |
|
401 \end{itemize} |
|
402 |
|
403 \end{frame} |
|
404 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
405 |
57 |
406 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
58 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
407 \begin{frame}[c] |
59 \begin{frame}[c] |
408 \frametitle{Trusted Third Parties} |
60 \frametitle{Trusted Third Parties} |
409 |
61 |