Lecture 9: Cryptographic Authentication

Lecture 9: Cryptographic Authentication • objectives and classification • one-way • secret key • public key • mutual • secret key • public key • establishing session key

Authentication Objectives and Classification • Objectives • Authentication (what was that again?) • one-way • mutual • Immunity from attacks • efficiency: minimum number of messages exchanged • bootstrapping a session: establishing a session key • types of authentication • password authentication (authenticating humans or machines on their behalf) • what’s wrong with it? • cryptographic challenge-response • secret key • public key

Secret Key One-Way problems • one-way authentication, • who is not authenticated? why is that a problem? • connection hijacking possible • dictionary attack possible if Trudy is eavesdropping (if KAB is derived from a password) • Bob stores key in clear • what is possible if Bob’s machine is broken into? I’m Alice a challenge R Alice Bob F(KAB,R)

Secret Key One-Way: Variant advantages • can be used for mutual authentication, how? • replay attack possible if R’s lifetime is not limited problems • requires reversible cryptography • subject to dictionary attack, without eavesdropping, if R is recognizable I’m Alice KAB{R} Alice Bob R

Secret Key One-Way: Timestamp Based • alternatively, with a hash function, send: I’m Alice, timestamp, H(KAB,timestamp) advantages • easy integration into password-sending systems • efficient: single message, stateless (what does that mean?) problems • clocks need to be synchronized, • extra protection against replay needed • if Alice uses same password to multiple servers, Trudy can authenticate to a different server if acts quickly • clock protection needed at Bob I’m Alice, KAB{timestamp} Alice Bob

Public Key, One-Way I’m Alice where []A is Alice’s signature. Can this be done with encryption? problem • Trudy can get Alice to sign/decrypt any text he chooses, how? • why is decryption useful? solution • don’t use the same key for authentication and other purposes • give structure (formatting) (e.g. type field) to challenge so it cannot be mistaken for other things R Alice Bob [R]A

Secret KeysMutual Authentication simple solution: run one-way authentication twice in reverse directions • can we save a message? problems with simple solution (to be explained next) • reflection attack • password guessing I’m Alice R1 F(KAB,R1) Alice Bob R2 F(KAB,R2)

Reflection Attack I’m Alice, R1 Trudy opens two connections to Bob and reuses the results of the second connection to complete the first solutions: • use dissimilar keys for directions • format challenges • have initiator authenticate first (more next slide) R2, F(KAB,R1) Trudy 1stconnection Bob F(KAB,R2) I’m Alice, R2 2ndconnection Trudy Bob R3, F(KAB,R2)

Dictionary Attack Against Mutual Authentication Trudy can obtain material for offline password guessing (no eavesdropping) by forcing Bob to encrypt her challenge Solution against dictionary and reflection attacks: I’m Alice R1 Alice Bob F(KAB,R1), R2 F(KAB,R2) password guessing is still possible if Trudy can impersonate Bob (considered harder)

Mutual AuthenticationPublic Keys • [] – signature, {} – encryption • why does Alice sign R? • (minor) problem, • assume R is going to be used as conversation key,if Trudy records the conversation and, after the conversation is over, overruns Bob (breaks into Bob’s computer and learns his secrets), she can decode the conversation • why overrunning Alice won’t help? • we already know the solution, what is it? I’m Alice, [{R}B]A Alice Bob

Establishing Session Key secret keys • knowing , KAB and R modify them in some way, ex: (KAB+1){R} (KAB+1){R} • why not KAB{R}? • KAB{R+1} ? public keys • send additional random nonces(a number that is used only once) {R}A , {R}B and use them to derive a session key.

Lecture 9: Cryptographic Authentication