DOCSLIB.ORG

RFC 8994: an Autonomic Control Plane

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
RFC 8994: an Autonomic Control Plane Stream: Internet Engineering Task Force (IETF) RFC: 8994 Category: Standards Track Published: May 2021 ISSN: 2070-1721 Authors: T. Eckert, Ed. M. Behringer, Ed.S. Bjarnason Futurewei USA Arbor Networks RFC 8994 An Autonomic Control Plane (ACP) Abstract Autonomic functions need a control plane to communicate, which depends on some addressing and routing. This Autonomic Control Plane should ideally be self-managing and be as independent as possible of configuration. This document defines such a plane and calls it the "Autonomic Control Plane", with the primary use as a control plane for autonomic functions. It also serves as a "virtual out-of-band channel" for Operations, Administration, and Management (OAM) communications over a network that provides automatically configured, hop-by-hop authenticated and encrypted communications via automatically configured IPv6 even when the network is not configured or is misconfigured. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8994. Copyright Notice Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions Eckert, et al. Standards Track Page 1 RFC 8994 An Autonomic Control Plane (ACP) May 2021 with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction (Informative) 1.1. Applicability and Scope 2. Acronyms and Terminology (Informative) 3. Use Cases for an Autonomic Control Plane (Informative) 3.1. An Infrastructure for Autonomic Functions 3.2. Secure Bootstrap over an Unconfigured Network 3.3. Permanent Reachability Independent of the Data Plane 4. Requirements (Informative) 5. Overview (Informative) 6. Self-Creation of an Autonomic Control Plane (ACP) (Normative) 6.1. Requirements for the Use of Transport Layer Security (TLS) 6.2. ACP Domain, Certificate, and Network 6.2.1. ACP Certificates 6.2.2. ACP Certificate AcpNodeName 6.2.2.1. AcpNodeName ASN.1 Module 6.2.3. ACP Domain Membership Check 6.2.3.1. Realtime Clock and Time Validation 6.2.4. Trust Anchors (TA) 6.2.5. Certificate and Trust Anchor Maintenance 6.2.5.1. GRASP Objective for EST Server 6.2.5.2. Renewal 6.2.5.3. Certificate Revocation Lists (CRLs) 6.2.5.4. Lifetimes 6.2.5.5. Reenrollment 6.2.5.6. Failing Certificates 6.3. ACP Adjacency Table Eckert, et al. Standards Track Page 2 RFC 8994 An Autonomic Control Plane (ACP) May 2021 6.4. Neighbor Discovery with DULL GRASP 6.5. Candidate ACP Neighbor Selection 6.6. Channel Selection 6.7. Candidate ACP Neighbor Verification 6.8. Security Association (Secure Channel) Protocols 6.8.1. General Considerations 6.8.2. Common Requirements 6.8.3. ACP via IPsec 6.8.3.1. Native IPsec 6.8.3.1.1. RFC 8221 (IPsec/ESP) 6.8.3.1.2. RFC 8247 (IKEv2) 6.8.3.2. IPsec with GRE Encapsulation 6.8.4. ACP via DTLS 6.8.5. ACP Secure Channel Profiles 6.9. GRASP in the ACP 6.9.1. GRASP as a Core Service of the ACP 6.9.2. ACP as the Security and Transport Substrate for GRASP 6.9.2.1. Discussion 6.10. Context Separation 6.11. Addressing inside the ACP 6.11.1. Fundamental Concepts of Autonomic Addressing 6.11.2. The ACP Addressing Base Scheme 6.11.3. ACP Zone Addressing Sub-Scheme (ACP-Zone) 6.11.4. ACP Manual Addressing Sub-Scheme (ACP-Manual) 6.11.5. ACP Vlong Addressing Sub-Scheme (ACP-Vlong-8/ACP-Vlong-16) 6.11.6. Other ACP Addressing Sub-Schemes 6.11.7. ACP Registrars 6.11.7.1. Use of BRSKI or Other Mechanisms or Protocols 6.11.7.2. Unique Address/Prefix Allocation 6.11.7.3. Addressing Sub-Scheme Policies Eckert, et al. Standards Track Page 3 RFC 8994 An Autonomic Control Plane (ACP) May 2021 6.11.7.4. Address/Prefix Persistence 6.11.7.5. Further Details 6.12. Routing in the ACP 6.12.1. ACP RPL Profile 6.12.1.1. Overview 6.12.1.1.1. Single Instance 6.12.1.1.2. Reconvergence 6.12.1.2. RPL Instances 6.12.1.3. Storing vs. Non-Storing Mode 6.12.1.4. DAO Policy 6.12.1.5. Path Metrics 6.12.1.6. Objective Function 6.12.1.7. DODAG Repair 6.12.1.8. Multicast 6.12.1.9. Security 6.12.1.10. P2P Communications 6.12.1.11. IPv6 Address Configuration 6.12.1.12. Administrative Parameters 6.12.1.13. RPL Packet Information 6.12.1.14. Unknown Destinations 6.13. General ACP Considerations 6.13.1. Performance 6.13.2. Addressing of Secure Channels 6.13.3. MTU 6.13.4. Multiple Links between Nodes 6.13.5. ACP Interfaces 6.13.5.1. ACP Loopback Interfaces 6.13.5.2. ACP Virtual Interfaces 6.13.5.2.1. ACP Point-to-Point Virtual Interfaces 6.13.5.2.2. ACP Multi-Access Virtual Interfaces Eckert, et al. Standards Track Page 4 RFC 8994 An Autonomic Control Plane (ACP) May 2021 7. ACP Support on L2 Switches/Ports (Normative) 7.1. Why (Benefits of ACP on L2 Switches) 7.2. How (per L2 Port DULL GRASP) 8. Support for Non-ACP Components (Normative) 8.1. ACP Connect 8.1.1. Non-ACP Controller and/or Network Management System (NMS) 8.1.2. Software Components 8.1.3. Autoconfiguration 8.1.4. Combined ACP and Data Plane Interface (VRF Select) 8.1.5. Use of GRASP 8.2. Connecting ACP Islands over Non-ACP L3 Networks (Remote ACP Neighbors) 8.2.1. Configured Remote ACP Neighbor 8.2.2. Tunneled Remote ACP Neighbor 8.2.3. Summary 9. ACP Operations (Informative) 9.1. ACP (and BRSKI) Diagnostics 9.1.1. Secure Channel Peer Diagnostics 9.2. ACP Registrars 9.2.1. Registrar Interactions 9.2.2. Registrar Parameters 9.2.3. Certificate Renewal and Limitations 9.2.4. ACP Registrars with Sub-CA 9.2.5. Centralized Policy Control 9.3. Enabling and Disabling the ACP and/or the ANI 9.3.1. Filtering for Non-ACP/ANI Packets 9.3.2. "admin down" State 9.3.2.1. Security 9.3.2.2. Fast State Propagation and Diagnostics 9.3.2.3. Low-Level Link Diagnostics 9.3.2.4. Power Consumption Issues Eckert, et al. Standards Track Page 5 RFC 8994 An Autonomic Control Plane (ACP) May 2021 9.3.3. Enabling Interface-Level ACP and ANI 9.3.4. Which Interfaces to Auto-Enable? 9.3.5. Enabling Node-Level ACP and ANI 9.3.5.1. Brownfield Nodes 9.3.5.2. Greenfield Nodes 9.3.6. Undoing "ANI/ACP enable" 9.3.7. Summary 9.4. Partial or Incremental Adoption 9.5. Configuration and the ACP (Summary) 10. Summary: Benefits (Informative) 10.1. Self-Healing Properties 10.2. Self-Protection Properties 10.2.1. From the Outside 10.2.2. From the Inside 10.3. The Administrator View 11. Security Considerations 12. IANA Considerations 13. References 13.1. Normative References 13.2. Informative References Appendix A. Background and Future (Informative) A.1. ACP Address Space Schemes A.2. BRSKI Bootstrap (ANI) A.3. ACP Neighbor Discovery Protocol Selection A.3.1. LLDP A.3.2. mDNS and L2 Support A.3.3. Why DULL GRASP? A.4. Choice of Routing Protocol (RPL) A.5. ACP Information Distribution and Multicast A.6. CAs, Domains, and Routing Subdomains Eckert, et al. Standards Track Page 6 RFC 8994 An Autonomic Control Plane (ACP) May 2021 A.7. Intent for the ACP A.8. Adopting ACP Concepts for Other Environments A.9. Further (Future) Options A.9.1. Auto-Aggregation of Routes A.9.2. More Options for Avoiding IPv6 Data Plane Dependencies A.9.3. ACP APIs and Operational Models (YANG) A.9.4. RPL Enhancements A.9.5. Role Assignments A.9.6. Autonomic L3 Transit A.9.7. Diagnostics A.9.8. Avoiding and Dealing with Compromised ACP Nodes A.9.9. Detecting ACP Secure Channel Downgrade Attacks Acknowledgements Contributors Authors' Addresses 1. Introduction (Informative) Autonomic Networking is a concept of self-management: autonomic functions self-configure, and negotiate parameters and settings across the network. "Autonomic Networking: Definitions and Design Goals" [RFC7575] defines the fundamental ideas and design goals of Autonomic Networking. A gap analysis of Autonomic Networking is given in "General Gap Analysis for Autonomic Networking" [RFC7576]. The reference architecture for Autonomic Networking in the IETF is specified in the document "A Reference Model for Autonomic Networking" [RFC8993]. Autonomic functions need an autonomically built communications infrastructure. This infrastructure needs to be secure, resilient, and reusable by all autonomic functions. Section 5 of [RFC7575] introduces that infrastructure and calls it the Autonomic Control Plane (ACP).
Load more

Recommended publications
  • The Order of Encryption and Authentication for Protecting Communications (Or: How Secure Is SSL?)?
    The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)? Hugo Krawczyk?? Abstract. We study the question of how to generically compose sym- metric encryption and authentication when building \secure channels" for the protection of communications over insecure networks. We show that any secure channels protocol designed to work with any combina- tion of secure encryption (against chosen plaintext attacks) and secure MAC must use the encrypt-then-authenticate method. We demonstrate this by showing that the other common methods of composing encryp- tion and authentication, including the authenticate-then-encrypt method used in SSL, are not generically secure. We show an example of an en- cryption function that provides (Shannon's) perfect secrecy but when combined with any MAC function under the authenticate-then-encrypt method yields a totally insecure protocol (for example, ¯nding passwords or credit card numbers transmitted under the protection of such protocol becomes an easy task for an active attacker). The same applies to the encrypt-and-authenticate method used in SSH. On the positive side we show that the authenticate-then-encrypt method is secure if the encryption method in use is either CBC mode (with an underlying secure block cipher) or a stream cipher (that xor the data with a random or pseudorandom pad). Thus, while we show the generic security of SSL to be broken, the current practical implementations of the protocol that use the above modes of encryption are safe. 1 Introduction The most widespread application of cryptography in the Internet these days is for implementing a secure channel between two end points and then exchanging information over that channel.
    [Show full text]
  • Multi-Device for Signal
    Multi-Device for Signal S´ebastienCampion3, Julien Devigne1, C´elineDuguey1;2, and Pierre-Alain Fouque2 1 DGA Maˆıtrisede l’information, Bruz, France [email protected] 2 Irisa, Rennes, France, [email protected], [email protected] Abstract. Nowadays, we spend our life juggling with many devices such as smartphones, tablets or laptops, and we expect to easily and efficiently switch between them without losing time or security. However, most ap- plications have been designed for single device usage. This is the case for secure instant messaging (SIM) services based on the Signal proto- col, that implements the Double Ratchet key exchange algorithm. While some adaptations, like the Sesame protocol released by the developers of Signal, have been proposed to fix this usability issue, they have not been designed as specific multi-device solutions and no security model has been formally defined either. In addition, even though the group key exchange problematic appears related to the multi-device case, group solutions are too generic and do not take into account some properties of the multi-device setting. Indeed, the fact that all devices belong to a single user can be exploited to build more efficient solutions. In this paper, we propose a Multi-Device Instant Messaging protocol based on Signal, ensuring all the security properties of the original Signal. Keywords: cryptography, secure instant messaging, ratchet, multi-device 1 Introduction 1.1 Context Over the last years, secure instant messaging has become a key application ac- cessible on smartphones. In parallel, more and more people started using several devices - a smartphone, a tablet or a laptop - to communicate.
    [Show full text]
  • A Novel Asymmetric Hyperchaotic Image Encryption Scheme Based on Elliptic Curve Cryptography
    applied sciences Article A Novel Asymmetric Hyperchaotic Image Encryption Scheme Based on Elliptic Curve Cryptography Haotian Liang , Guidong Zhang *, Wenjin Hou, Pinyi Huang, Bo Liu and Shouliang Li * School of Information Science and Engineering, Lanzhou University, Lanzhou 730000, China; [email protected] (H.L.); [email protected] (W.H.); [email protected] (P.H.); [email protected] (B.L.) * Correspondence: [email protected] (G.Z.); [email protected] (S.L.); Tel.: +86-185-0948-7799 (S.L.) Abstract: Most of the image encryption schemes based on chaos have so far employed symmetric key cryptography, which leads to a situation where the key cannot be transmitted in public channels, thus limiting their extended application. Based on the elliptic curve cryptography (ECC), we proposed a public key image encryption method where the hash value derived from the plain image was encrypted by ECC. Furthermore, during image permutation, a novel algorithm based on different- sized block was proposed. The plain image was firstly divided into five planes according to the amount of information contained in different bits: the combination of the low 4 bits, and other four planes of high 4 bits respectively. Second, for different planes, the corresponding method of block partition was followed by the rule that the higher the bit plane, the smaller the size of the partitioned block as a basic unit for permutation. In the diffusion phase, the used hyperchaotic sequences in permutation were applied to improve the efficiency. Lots of experimental simulations and cryptanalyses were implemented in which the NPCR and UACI are 99.6124% and 33.4600% Citation: Liang, H.; Zhang, G.; Hou, respectively, which all suggested that it can effectively resist statistical analysis attacks and chosen W.; Huang, P.; Liu, B.; Li, S.
    [Show full text]
  • Trivia: a Fast and Secure Authenticated Encryption Scheme
    TriviA: A Fast and Secure Authenticated Encryption Scheme Avik Chakraborti1, Anupam Chattopadhyay2, Muhammad Hassan3, and Mridul Nandi1 1 Indian Statistical Institute, Kolkata, India [email protected], [email protected] 2 School of Computer Engineering, NTU, Singapore [email protected] 3 RWTH Aachen University, Germany [email protected] Abstract. In this paper, we propose a new hardware friendly authen- ticated encryption (AE) scheme TriviA based on (i) a stream cipher for generating keys for the ciphertext and the tag, and (ii) a pairwise in- dependent hash to compute the tag. We have adopted one of the ISO- standardized stream ciphers for lightweight cryptography, namely Triv- ium, to obtain our underlying stream cipher. This new stream cipher has a state that is a little larger than the state of Trivium to accommodate a 128-bit secret key and IV. Our pairwise independent hash is also an adaptation of the EHC or \Encode-Hash-Combine" hash, that requires the optimum number of field multiplications and hence requires small hardware footprint. We have implemented the design in synthesizable RTL. Pre-layout synthesis, using 65 nm standard cell technology under typical operating conditions, reveals that TriviA is able to achieve a high throughput of 91:2 Gbps for an area of 24:4 KGE. We prove that our construction has at least 128-bit security for privacy and 124-bit security of authenticity under the assumption that the underlying stream cipher produces a pseudorandom bit stream. Keywords: Trivium, stream cipher, authenticated encryption, pairwise independent, EHC, TriviA. 1 Introduction The emergence of Internet-of-Things (IoT) has made security an extremely im- portant design goal.
    [Show full text]
  • Cryptanalysis of Globalplatform Secure Channel Protocols
    Cryptanalysis of GlobalPlatform Secure Channel Protocols Mohamed Sabt1;2, Jacques Traor´e1 1 Orange Labs, 42 rue des coutures, 14066 Caen, France fmohamed.sabt, [email protected] 2 Sorbonne universit´es,Universit´ede technologie de Compi`egne, Heudiasyc, Centre de recherche Royallieu, 60203 Compi`egne,France Abstract. GlobalPlatform (GP) card specifications are the de facto standards for the industry of smart cards. Being highly sensitive, GP specifications were defined regarding stringent security requirements. In this paper, we analyze the cryptographic core of these requirements; i.e. the family of Secure Channel Protocols (SCP). Our main results are twofold. First, we demonstrate a theoretical attack against SCP02, which is the most popular protocol in the SCP family. We discuss the scope of our attack by presenting an actual scenario in which a malicious entity can exploit it in order to recover encrypted messages. Second, we inves- tigate the security of SCP03 that was introduced as an amendment in 2009. We find that it provably satisfies strong notions of security. Of par- ticular interest, we prove that SCP03 withstands algorithm substitution attacks (ASAs) defined by Bellare et al. that may lead to secret mass surveillance. Our findings highlight the great value of the paradigm of provable security for standards and certification, since unlike extensive evaluation, it formally guarantees the absence of security flaws. Keywords: GlobalPlatform, secure channel protocol, provable security, plaintext recovery, stateful encryption 1 Introduction Nowadays, smart cards are already playing an important role in the area of in- formation technology. Considered to be tamper resistant, they are increasingly used to provide security services [38].
    [Show full text]
  • The RSA Algorithm
    The RSA Algorithm Evgeny Milanov 3 June 2009 In 1978, Ron Rivest, Adi Shamir, and Leonard Adleman introduced a cryptographic algorithm, which was essentially to replace the less secure National Bureau of Standards (NBS) algorithm. Most impor- tantly, RSA implements a public-key cryptosystem, as well as digital signatures. RSA is motivated by the published works of Diffie and Hellman from several years before, who described the idea of such an algorithm, but never truly developed it. Introduced at the time when the era of electronic email was expected to soon arise, RSA implemented two important ideas: 1. Public-key encryption. This idea omits the need for a \courier" to deliver keys to recipients over another secure channel before transmitting the originally-intended message. In RSA, encryption keys are public, while the decryption keys are not, so only the person with the correct decryption key can decipher an encrypted message. Everyone has their own encryption and decryption keys. The keys must be made in such a way that the decryption key may not be easily deduced from the public encryption key. 2. Digital signatures. The receiver may need to verify that a transmitted message actually origi- nated from the sender (signature), and didn't just come from there (authentication). This is done using the sender's decryption key, and the signature can later be verified by anyone, using the corresponding public encryption key. Signatures therefore cannot be forged. Also, no signer can later deny having signed the message. This is not only useful for electronic mail, but for other electronic transactions and transmissions, such as fund transfers.
    [Show full text]
  • Post-Quantum TLS Without Handshake Signatures Full Version, September 29, 2020
    Post-Quantum TLS Without Handshake Signatures Full version, September 29, 2020 Peter Schwabe Douglas Stebila Thom Wiggers Max Planck Institute for Security and University of Waterloo Radboud University Privacy & Radboud University [email protected] [email protected] [email protected] ABSTRACT Client Server static (sig): pk(, sk( We present KEMTLS, an alternative to the TLS 1.3 handshake that TCP SYN uses key-encapsulation mechanisms (KEMs) instead of signatures TCP SYN-ACK for server authentication. Among existing post-quantum candidates, G $ Z @ 6G signature schemes generally have larger public key/signature sizes compared to the public key/ciphertext sizes of KEMs: by using an ~ $ Z@ ss 6G~ IND-CCA-secure KEM for server authentication in post-quantum , 0, 00, 000 KDF(ss) TLS, we obtain multiple benefits. A size-optimized post-quantum ~ 6 , AEAD (cert[pk( ]kSig(sk(, transcript)kkey confirmation) instantiation of KEMTLS requires less than half the bandwidth of a ss 6~G size-optimized post-quantum instantiation of TLS 1.3. In a speed- , 0, 00, 000 KDF(ss) optimized instantiation, KEMTLS reduces the amount of server CPU AEAD 0 (application data) cycles by almost 90% compared to TLS 1.3, while at the same time AEAD 00 (key confirmation) reducing communication size, reducing the time until the client can AEAD 000 (application data) start sending encrypted application data, and eliminating code for signatures from the server’s trusted code base. Figure 1: High-level overview of TLS 1.3, using signatures CCS CONCEPTS for server authentication. • Security and privacy ! Security protocols; Web protocol security; Public key encryption.
    [Show full text]
  • ECE596C: Handout #15
    ECE596C: Handout #15 Key Distribution Electrical and Computer Engineering, University of Arizona, Loukas Lazos Abstract. In this lecture we describe different key distribution schemes for establishing a shared secret among two or multiple parties. Particularly we present the Diffie-Hellman key distribution scheme and the Blom’s key predistribution scheme. 1 Key Distribution Problem The key distribution problem (KDP) is the problem of establishing and maintaining security asso- ciations (shared secrets) between a network of n users connected via insecure links. The KDP can be classified into the following two stages. – Initialization: During the initialization phase, a trusted party also referred to as Trusted Au- thority (TA) distributes keying information to relevant parties in a secure manner. The keying material can be either used directly to encrypt data, or it can be used to establish new security associations. – Maintenance: During the maintenance phase, the TA, or the network users themselves renew relevant cryptographic secrets to maintain secrecy of the communications (How is maintenance different from the initialization phase?) For the initialization phase, key material can be either preloaded to the network entities before deployment, or can be issued using a temporary secure channel. Using the secure channel, the TA assigns long lived keys to network entities, that are usually only used to derive other keys and not to encrypt data (they are also called key encryption keys). Nodes who wish to securely communicate use their long lived keys to establish a session key that has a much shorter expiration time. Question What determines the expiration time of a key? What are the advantages of having a session key? Parameters considered when designing a key distribution scheme – Resistance to node compromise and collusion.
    [Show full text]
  • Secure Channels Secure Channels • Example Applications – PGP: Pretty Good Privacy CS 161/194-1 – TLS: Transport Layer Security Anthony D
    Main Points • Applying last week’s lectures in practice • Creating Secure Channels Secure Channels • Example Applications – PGP: Pretty Good Privacy CS 161/194-1 – TLS: Transport Layer Security Anthony D. Joseph – VPN: Virtual Private Network September 26, 2005 September 26, 2005 CS161 Fall 2005 2 Joseph/Tygar/Vazirani/Wagner What is a Secure Channel? Plaintext Plaintext Creating Secure Channels Encryption / Internet Encryption / • Authentication and Data Integrity Decryption Decryption Ciphertext and MAC – Use Public Key Infrastructure or third-party server to authenticate each end to the other • A stream with these security requirements: – Add Message Authentication Code for – Authentication integrity • Ensures sender and receiver are who they claim to be – Confidentiality • Confidentiality • Ensures that data is read only by authorized users – Data integrity – Exchange session key for encrypt/decrypt ops • Ensures that data is not changed from source to destination • Bulk data transfer – Non-repudiation (not discussed today) • Ensures that sender can’t deny message and rcvr can’t deny msg • Key Distribution and Segmentation September 26, 2005 CS161 Fall 2005 3 September 26, 2005 CS161 Fall 2005 4 Joseph/Tygar/Vazirani/Wagner Joseph/Tygar/Vazirani/Wagner Symmetric Key-based Symmetric Key-based Secure Channel Secure Channel Alice Bob • Sender (A) and receiver (B) share secret keys KABencrypt KABencrypt – One key for A è B confidentiality KABauth KABauth – One for A è B authentication/integrity Message MAC Compare? Message – Each message
    [Show full text]
  • Further Simplifications in Proactive RSA Signatures
    Further Simplifications in Proactive RSA Signatures Stanislaw Jarecki and Nitesh Saxena School of Information and Computer Science, UC Irvine, Irvine, CA 92697, USA {stasio, nitesh}@ics.uci.edu Abstract. We present a new robust proactive (and threshold) RSA sig- nature scheme secure with the optimal threshold of t<n/2 corruptions. The new scheme offers a simpler alternative to the best previously known (static) proactive RSA scheme given by Tal Rabin [36], itself a simpli- fication over the previous schemes given by Frankel et al. [18, 17]. The new scheme is conceptually simple because all the sharing and proac- tive re-sharing of the RSA secret key is done modulo a prime, while the reconstruction of the RSA signature employs an observation that the secret can be recovered from such sharing using a simple equation over the integers. This equation was first observed and utilized by Luo and Lu in a design of a simple and efficient proactive RSA scheme [31] which was not proven secure and which, alas, turned out to be completely in- secure [29] due to the fact that the aforementioned equation leaks some partial information about the shared secret. Interestingly, this partial information leakage can be proven harmless once the polynomial sharing used by [31] is replaced by top-level additive sharing with second-level polynomial sharing for back-up. Apart of conceptual simplicity and of new techniques of independent interests, efficiency-wise the new scheme gives a factor of 2 improvement in speed and share size in the general case, and almost a factor of 4 im- provement for the common RSA public exponents 3, 17, or 65537, over the scheme of [36] as analyzed in [36].
    [Show full text]
  • Private Authentication
    Private Authentication Mart´ınAbadi University of California at Santa Cruz C´edricFournet Microsoft Research Abstract Frequently, communication between two principals reveals their identities and pres- ence to third parties. These privacy breaches can occur even if security protocols are in use; indeed, they may even be caused by security protocols. However, with some care, security protocols can provide authentication for principals that wish to com- municate while protecting them from monitoring by third parties. We discuss the problem of private authentication and present two protocols for private authentica- tion of mobile principals. Our protocols allow two mobile principals to communicate when they meet at a location if they wish to do so, without the danger of tracking by third parties. We also present the analysis of one of the protocols in the applied pi calculus. We establish authenticity and secrecy properties. Although such properties are fairly standard, their formulation in the applied pi calculus makes an original use of process equivalences. In addition, we treat identity-protection properties, thus exploring a formal model of privacy. 1 Privacy, authenticity, and the applied pi calculus Although privacy may coexist with communication, it often does not, and there is an intrinsic tension between them. Often, effective communication be- tween two principals requires that they reveal their identities to each other. Still, they may wish to reveal nothing to others. Third parties should not be able to infer the identities of the two principals, nor to monitor their move- ments and their communication patterns. For better or for worse, they often can. In particular, a mobile principal may advertise its presence at a location in order to discover and to communicate with certain other principals at the location, thus revealing its presence also to third parties.
    [Show full text]
  • Employing Security Channel Protocol in the NFC Environment
    WHITEPAPER | Employing Security Channel Protocol In the NFC Environment ‘Global Platform’ (GP) created specifications that enabled different players to provide digital services and allow devices to be trusted and managed securely by protecting their privacy. In this regard, GP introduced Secure Channel Protocol (SCP) in smart cards to enable devices to exchange data in open channel and to protect against data skimming and establish secure communication. This white paper throws light on the comprehensive design and lucid implementation of Secure Channel Protocol variant three (SCP03) with a dedicated focus towards contactless smart cards. These cards are based on Near Field Communication (NFC) which is used for user authentication for a secure device. Every approach behind the secure communication, the management of ‘encryption keys’, creation of boundaries that form ‘security domain’s’ and how these enable to create a ‘secure channel’ has been discussed. The document lists out various NIST specification which sets the strength of the encryption keys and enables common compliance criteria. Read on. Authored by: Ravikiran HV Chaitra Patil Reviewed by: Shreeranganath Gupta © 2010-2020 PathPartner Technology Pvt. Ltd. • 1 www.pathpartnertech.com Whitepaper | Securing NFC Environment The Growth of NFC Short range wireless communication is a major feature of NFC technology. With this inherent nature of short range, smart cards evolved to become contactless smart card as it enabled to have contactless feature with communication happening in vicinity of user, which established physical level trust and security for data exchange. Rapid growth of NFC based mobile units and low-cost deployment allowed various industries to adopt this technology for financial transactions, user authentication, secure login to workplace, secure PC login etc.
    [Show full text]