1 / 40

COM342 Networks and Data Communications

COM342 Networks and Data Communications. Lecture 10B: Security; authentication and encryption. Ian McCrum Room 5B18 Tel: 90 366364 voice mail on 6 th ring Email: IJ.McCrum@Ulster.ac.uk Web site: http://www.eej.ulst.ac.uk. Keypoints. War driving, what is it.

korene
Télécharger la présentation

COM342 Networks and Data Communications

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. COM342Networks and Data Communications Lecture 10B: Security; authentication and encryption Ian McCrum Room 5B18 Tel: 90 366364 voice mail on 6th ring Email: IJ.McCrum@Ulster.ac.uk Web site: http://www.eej.ulst.ac.uk www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  2. Keypoints • War driving, what is it. • Brief knowledge of common key (symmetric cryptography) and private/public key encryption (asymmetric cryptography) • Public Key repositories; certificates. • Authentication and encryption, • SSH how it is used (no need to know detailed protocol) • Tunnelling www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  3. Security Issues • War Driving / Sniffing (Parking Lot attack) • Rogue Access Points • MAC Address • SSID • WEP • SSH • Tunnels and secure IP links • Keys; private and public, trusted key repositories www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  4. War Driving • War driving is one of the latest hacker fads • http://www.wardriving.com/ • Involves driving around and scanning in search of unprotected 802.11 wireless networks • Several War Driving tools are available • NetStumbler • AiroPeek • MobileManager • Sniffer Wireless • THC-WarDrive www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  5. Net Stumbler • The MAC address of the access point • The network name • SSID • Manufacturer • Channel that it was heard on • WEP Enabled (Yes or No) • Signal strength • Signal to Noise Ratio www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  6. War Driving Example www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  7. Parking Lot Attack www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  8. War Chalking www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  9. Unauthorized Access Points • Install access points without permission (Sack ‘em!) • Security is NOT enabled • The whole Network becomes vulnerable to war driving/sniffing attacks www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  10. Using MAC Address • Control access by allowing only valid MAC addresses to access the network • Complicated and difficult to maintain list of valid MAC addresses • Using software, MAC addresses can be spoofed www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  11. www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  12. Modern Cryptography • Two broad classes • 1. Shared-key cryptography • 2. Public-key cryptography • There are many others, one time cipher etc., Also various algorithms. • RSA , DES, RC4, etc., • A good read (good Christmas Present!) is “The Code Book” by Simon Singh 1999 ISBN 1-85702-879-1. It contains a £10,000 cipher challenge! www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  13. Central Key Generation Key Distribution & Management Cipher Text Crypto Engine Crypto Engine Clear Text Clear Text Encryption Decryption History of Cryptography Symmetric Cryptography - The Only Solution Prior To 1975 www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  14. Symmetric Key Encryption Plain-text input Plain-text output Cipher-text “The quick brown fox jumps over the lazy dog” “The quick brown fox jumps over the lazy dog” “AxCv;5bmEseTfid3)fGsmWe#4^,sdgfMwir3:dkJeTsY8R\s@!q3%” Encryption Decryption Same key (shared secret) www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  15. Certificate Repository “Public” Key History of Cryptography Asymmetric Cryptography - Publicly Introduced In 1975(1) Key Pair Generation “Private” Key Key Distribution & Management Cipher Text Pub Key Crypto Engine Pub Key Crypto Engine Clear Text Clear Text Encryption Decryption www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt (1) Whitfield Diffie and Martin Helman, “New Directions In Cryptography”, IEEE Transactions On Information Theory, v.IT-22 n.6, 6 Nov 1976, pp 644-654

  16. public private Public Key Encryption Clear-text input Clear-text output Cipher-text “The quick brown fox jumps over the lazy dog” “The quick brown fox jumps over the lazy dog” “Py75c%bn&*)9|fDe^bDFaq#xzjFr@g5=&nmdFg$5knvMd’rkvegMs” Encryption Decryption Different keys Recipient’s public key Recipient’s private key www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  17. PrivateKey PublicKey PIN 5638 12429 • Protected by owner • Used to sign messages • Used to decrypt messages • Kept in physical possession of owner • Distributed freely and openly • Used to verify signatures • Used to encrypt messages • Kept in public certificate key directory servers Bill What are the PKI Keys? www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  18. Public Key Cryptography • Public/private key pair • Only the owner knows the private key, but everyone knows the public key • If the message is encrypted with the private key, then everyone with the public key can recover the message, but only the owner can generate the encrypted message www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  19. Continued • If the message is encrypted with the public key, only the owner can decrypted it using its private key • The first property can be used for signature and the second property can be used for encryption. • It is computationally intensive so one popular practical encryption system SSH, uses private and public keys to initially authenticate each end of a link and then switches to a common “one-time” key to speed things up • SSH is a modern replacement for telnet but it can also tunnel other ports… www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  20. public private SMART CARD private 123 89 3486 M Public Key Pairs Public and private keys are always generated as amatchedpair Keys are mathematically related but it is computationally infeasible to deduce a private key from its public key Private keys are kept secret - preferably by being stored in a tamper-resistant chip Public keys are just that - public! www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  21. Key Management • Ideally, every person has two key pairs: • Key-exchange key pair • Signature key pair • Key pairs are distinct • Public and private keys are always generated as a pair at the user’s machine • Public key can be openly shared • Private key is always kept private (it never leaves the machine where it was generated) • A complex protocol passes data back and forth to ensure each is who they say there are. www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  22. TO:BOB No Protection Transmitted “in the clear” ‘Postcard’ Bob receives Alice’s mail without any assurance of originator, confidentiality or integrity of contents Alice knows Bob’s address www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  23. PIN 5556 10011011.. FROM: ALICE Certificate Repository TO: BOB 33728 Alice 33728 Alice Digital Signature Record with digital signature transmitted electronically “Token” Contains Private Key material Bob verifies Alice was sender from Alice’s Public Key at certificate repository Obtains Alice’s Public Key Alice signs record using Private Key www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  24. wascdfee944 x./,cafvza/qfaservbrsrtrt 11011010.. TO: BOB Certificate Repository 999081 Bob Encryption “Token” Contains Private Key material Alice gets Bob’s Public Key from certificate repository Encrypts transmission using Bob’s PublicKey Sends to Bob Obtains Bob’s Public Key Bob decrypts using his Private Key Certificate Repository www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  25. Alice digitally signs record using her Private Key Bob decrypts using his Private Key “Token” Contains Private Key material PIN 9086 PIN 5556 Encrypts transmission using Bob’s Public Key “Token” Contains Private Key material 11011010... Sends to Bob 10011011... verifies Alice as originator Obtains Bob’s Public Key 33728 Alice Bob verifies Alice was sender from Alice’s Public Key from certificate repository 999081 Bob wascdfee944 x./,cafvza/qfaservbrsrtrt Alice gets Bob’s Public Key from certificate repository 999081 Bob Certificate Repository PKIDSS1097.PPT Digital Signature & Encryption www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  26. RSA authentication uses the property that anything encrypted with the public key of a key pair can be decrypted only with the private key. The reverse is also true. A second property is that it is not possible to derive the private key from the public key or vice versa. • Thus a host generates a random string, and encrypts it with the public key of a remote host. If the remote host correctly decrypts the string and returns it, it is considered authenticated. By forcing both ends to verify their identity, ssh provides protection against three common spoofing attacks: DNS, IP and routing spoofing. • ssh encryptionIn addition to authentication, ssh also provides several options for encryption. IDEA is the default cipher for encryption, but DES, 3DES, and blowfish are also available. ssh employs symmetric key encryption for the data transfer because public key encryption is too computationally expensive. The client generates a random string for use as the symmetric key and sends it to the server encrypted with the server's public key, so someone eavesdropping can't get the key. The encryption is automatic, end-to-end, and is started immediately after host authentication, but before user authentication. This way, even if the user must enter her password, it is sent over a secure channel. No configuration is necessary to enable encryption. In fact, it can't be disabled, except at compile time. www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  27. Practical SSH sessions • When you ssh to a host you've never talked to before, it sends you itspublic key. This is possibly a security hole, since a fake host could getyou to take its key instead at this point. • Example $ ssh somehostThe authenticity of host 'somehost (192.168.1.1)' can't be established. RSA key fingerprint is 90:9c:46:ab:03:1d:30:2c:5c:87:c5:c7:d9:13:5d:75. Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added 'somehost' (RSA) to the list of known hosts. user@somehost's password: [not shown] • Explanation ssh is warning you that it doesn't really know about this host yet. Itshows you the hostname and IP address, so you can be sure you're talkingto the correct computer. It also shows the fingerprint of the server'spublic key. If you know what the fingerprint should be, you can check itand disallow it if it doesn't match. www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  28. Practical SSH continued… Reasonable paranoiaMost of the time, it's pretty safe to just accept host keys. At least within a controlled environment such as UUJ, it's unlikely that someone could compromise the network enough to have their computer masquerading as, say, one of the gl machines. In other situations, it's up to you to decide whether to get key information from the server admin before connecting. Changed host key example $ ssh somehost@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 90:9c:46:ab:03:1d:30:2c:5c:87:c5:c7:d9:13:5d:75. Please contact your system administrator. Add correct host key in /home/user/.ssh/known_hosts to get rid of this message. Offending key in /home/user/.ssh/known_hosts:1 www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  29. Using SSH • Another convenient feature of ssh is the ability to forward arbitrary TCP ports over the secure connection. ssh supports forwarding client local ports to a second remote system via the secure connection to the remote server, as well as forwarding ports from the remote server to a second local system. • ssh ian@localhost.com -C –L 25025:remote.mc.com:110 • Now if I telnet to localhost –p 25025 It is as if I had telneted direct to port 110 on the remote machine, except it actually went over the SSH port-port link, encrypted! • Localhost is 127.0.0.1, and is always the local machine, this is an IP number that never goes onto the cable but is “looped back” through the TCP/IP stack www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  30. RSA encryption (from “The Code Book” by Simon Singh • Alice picks two giant prime numbers p and q e.g (p=17, q=11) • Multiply these to get N=187. Now pick another number e.g e=7 • e and (p-1).(q-1) should be relatively prime • Publish e and N in a directory. These numbers are needed for encryption. Together they are called the public-key N must be unique. • To encrypt: convert the message into a number, M and generate the ciphertext C as C=Me(mod N). • E.g Bob wants to send Alice a “kiss” the letter X is 1011000=88 • C=887(mod 187) (this is too big for calculators but it can be factored…the answer is 11. • Alice can calculate a special number known as a decryption key d such that e.d = 1( mod(p-1).(q-1)) hence d=23 • To decrypt the message M=Cd(mod 187) = 1123 mod 187 = 88 in decimal • Of course working out 1123 is tricky, but it can be factored into parts “[ (111mod 187) . (112mod 187) . (114mod 187) . (1116mod 187) ] (mod 187 )” www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  31. Proposed Solutions to Enhance Security • Virtual Private Network (VPN) • Secure LAN (SLAN) • Remote Authentication Dial In User Services (RADIUS) • ipsec • CIPe • 802.1x • Proprietary WEP Implementations www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  32. VPN • Enables you to send data between two computers across a shared or public network in a manner that emulates the properties of a point-to-point private link • Provides a scaleable authentication and encryption solution • Does require end user configuration and a strong knowledge of VPN technology • Users must re-authenticate if roaming between VPN servers www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  33. www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  34. Secure LAN (SLAN) • A GPL open-source “VPN” System • Provides server authentication, client authentication, data privacy, and integrity using per session and per user short life keys • Simpler and more cost efficient than a VPN • Support for Windows and Linux • Website: http://slan.sourceforge.net/ www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  35. SLAN Architecture www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  36. RADIUS • Several 802.11 access points offer RADIUS authentication • Clients can gain access to the network by supplying a username and password to a separate server • This information is securely sent over the network eliminating the possibility of passive snooping www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  37. IPsec • Provides encryption and authentication services at the IP level of the network protocol stack • Can be used to secure nearly any type of Internet traffic • Legacy applications not implementing secure communications can be made secure using IPsec • Examples: • Free S/WAN - http://www.freeswan.org/ IPsec - Disadvantages • IPsec authenticates machines, not users • IPsec does not stop Denial-of-Service attacks • IPsec is not true end-to-end security • IPsec cannot be secure if your system isn’t www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  38. 802.1x • Provides enhanced security for users of 802.11b WLANs • Provides port-level authentication for any wired or wireless Ethernet client system • 802.1x was originally designed as a standard for wired Ethernet, but is applicable to WLANs • It leverages many of the security features used with dial-up networking (RADIUS) • Also uses Extensible Authentication Protocol (EAP, RFC 2284) • Built in support in Windows XP www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  39. www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

  40. Summary You do not need to know very much about the preceding slides. • War driving, what is it. • Brief knowledge of common key (symmetric cryptography) and private/public key encryption (asymmetric cryptography) Be able to describe the difference between each. • Public Key repositories; certificates. • Authentication and encryption, describe what each is and why it is needed • SSH what is it (no need to know detailed protocol) • Tunnelling, www.eej.ulst.ac.uk/~ian/modules/COM342/COM342_L10B.ppt

More Related