1 \documentclass{article} |
1 \documentclass{article} |
2 \usepackage{../style} |
2 \usepackage{../style} |
3 \usepackage{../langs} |
3 \usepackage{../langs} |
4 |
4 |
5 \begin{document} |
5 \begin{document} |
6 \fnote{\copyright{} Christian Urban, 2014} |
6 \fnote{\copyright{} Christian Urban, King's College London, 2014, 2016} |
7 |
7 |
8 %% the expectation is that anything encrypted today, will be |
8 %% the expectation is that anything encrypted today, will be |
9 %% decrypted in 20 years time |
9 %% decrypted in 20 years time |
10 |
10 |
11 %http://www.net.in.tum.de/fileadmin/TUM/teaching/netzsicherheit/ws1516/07_PKI.pdf |
11 %http://www.net.in.tum.de/fileadmin/TUM/teaching/netzsicherheit/ws1516/07_PKI.pdf |
93 meters). But there are many, many more examples for protocols |
93 meters). But there are many, many more examples for protocols |
94 (Bitcoins, Tor, mobile phones,\ldots). |
94 (Bitcoins, Tor, mobile phones,\ldots). |
95 |
95 |
96 The common characteristics of the protocols we are interested |
96 The common characteristics of the protocols we are interested |
97 in is that an adversary or attacker is assumed to be in |
97 in is that an adversary or attacker is assumed to be in |
98 complete control over the network or channel over which we |
98 complete control of the network or channel over which we |
99 exchanging messages. An attacker can install a packet sniffer |
99 exchanging messages. An attacker can install a packet sniffer |
100 on a network, inject packets, intercept packets, modify |
100 on a network, inject packets, intercept packets, modify |
101 packets, replay old messages, or fake pretty much everything |
101 packets, replay old messages, or fake pretty much everything |
102 else. In this hostile environment, the purpose of a protocol |
102 else. In this hostile environment, the purpose of a protocol |
103 (that is exchange of messages) is to achieve some security |
103 (that is exchange of messages) is to achieve some security |
571 broken\ldots{}but this is a story for another time. Suffice |
571 broken\ldots{}but this is a story for another time. Suffice |
572 to say for now that one of the main certification |
572 to say for now that one of the main certification |
573 organisations, VeriSign, has limited its liability to \$100 in |
573 organisations, VeriSign, has limited its liability to \$100 in |
574 case it issues a false certificate. This is really a joke and |
574 case it issues a false certificate. This is really a joke and |
575 really the wrong incentive for the certification organisations |
575 really the wrong incentive for the certification organisations |
576 to clean up their mess. |
576 to clean up their mess. The problem is compounded that |
577 |
577 browser vendors also play a crucial role for this to |
578 The problem we want to study closer here is that protocols |
578 work (and they might have completely different incentives |
|
579 according to which they operate). |
|
580 |
|
581 The problem we want to study closer now is that protocols |
579 based on public-private key encryption are susceptible to |
582 based on public-private key encryption are susceptible to |
580 simple person-in-the-middle attacks. Consider the following |
583 simple person-in-the-middle attacks. Consider the following |
581 protocol where $A$ and $B$ attempt to exchange secret messages |
584 protocol where $A$ and $B$ attempt to exchange secret messages |
582 using public-private keys. |
585 using public-private keys. |
583 |
586 |
602 \end{tabular} |
605 \end{tabular} |
603 \end{center} |
606 \end{center} |
604 |
607 |
605 \noindent Since we assume an attacker, say $E$, has complete |
608 \noindent Since we assume an attacker, say $E$, has complete |
606 control over the network, $E$ can intercept the first two |
609 control over the network, $E$ can intercept the first two |
607 messages and substitutes her own public key. The protocol |
610 messages and substitutes her own public key. The resulting protocol |
608 run would therefore be |
611 run would be |
609 |
612 |
610 \begin{center} |
613 \begin{center} |
611 \begin{tabular}{ll@{\hspace{2mm}}l} |
614 \begin{tabular}{ll@{\hspace{2mm}}l} |
612 1. & $A \to E :$ & $K^{pub}_A$\smallskip\\ |
615 1. & $A \to E :$ & $K^{pub}_A$\smallskip\\ |
613 2. & $E \to B :$ & $K^{pub}_E$\smallskip\\ |
616 2. & $E \to B :$ & $K^{pub}_E$\smallskip\\ |
801 possibility: what if $A$ and $B$ include a voice message in there |
804 possibility: what if $A$ and $B$ include a voice message in there |
802 messages. |
805 messages. |
803 \end{minipage}}}\bigskip |
806 \end{minipage}}}\bigskip |
804 |
807 |
805 \noindent |
808 \noindent |
806 I hope you have thought about all these questions. Maybe you noticed that |
809 I hope you have thought about all these questions. $E$ cannot modify |
807 there is a way to defeat the lockstep protocol. If an attacker could only |
810 the received messages---$A$ and $B$ woudl find this out. To stay |
808 forward the (unmodified) messages, then all would be great. Because then |
811 undetected, $E$ can only forward the messages (unmodified) and this is |
809 it could be used to establish secret keys using the Hellman-Diffie |
812 all what $A$ and $B$ need in order to establish a shared secret. For |
810 technique (see further reading). That $E$ was able to decrypt all messages |
813 example they can use the Hellman-Diffie key exchange protocol (see |
811 is of no importance for the Hellman-Diffie |
814 further reading) which works, even if $E$ can decrypt all messages. |
812 technique. |
815 |
813 |
816 All good? Unfortunately, there is a way to defeat this lockstep |
814 Unfortunately, $E$ can create completely fake messages. Let |
817 protocol---the name of this protocol that halves the messages. The |
815 us look at this possibility: $E$ intercepts again the keys from $A$ |
818 problem is $E$ can create completely fake messages. Let us look at |
816 and $B$, and substitutes its own keys. |
819 this possibility: $E$ intercepts again the keys from $A$ and $B$, and |
|
820 substitutes its own keys. |
817 |
821 |
818 \begin{center} |
822 \begin{center} |
819 \begin{tabular}{ll@{\hspace{2mm}}l} |
823 \begin{tabular}{ll@{\hspace{2mm}}l} |
820 1. & $A \to E :$ & $K^{pub}_A$\smallskip\\ |
824 1. & $A \to E :$ & $K^{pub}_A$\smallskip\\ |
821 2. & $E \to B :$ & $K^{pub}_E$\smallskip\\ |
825 2. & $E \to B :$ & $K^{pub}_E$\smallskip\\ |