Authentication Dr. Arjan Durresi Louisiana State University Baton Rouge, LA 70810 [email protected] These slides are available at: http://www.csc.lsu.edu/~durresi/csc4601-04/ Louisiana State University 12- Authentication- 1 CSC4601 F04 Overview Passwords Humans and Computers Louisiana State University 12- Authentication- 2 CSC4601 F04 Password Proof by knowledge, sharing Password guessing On-line: limit tries, alarm Off-line: dictionary attack Storing passwords Per-node: /etc/passwd Server: authentication storage server, retrieved by node (yp/NIS) Facilitator: server says yes/no Louisiana State University 12- Authentication- 3 CSC4601 F04 Password Storing hash instead of the password, the attacker can guess the password Better store the encrypted password. More difficult to get the key. But if the node itself is compromised … Combination of both Louisiana State University 12- Authentication- 4 CSC4601 F04 Address-based .rhosts node, user name /etc/hosts.equiv trusted hosts Threats: break in one, break in all often: A trusts B, then B trusts A address spoofing Louisiana State University 12- Authentication- 5 CSC4601 F04 Humans and Computers Humans: Short, memorable key (8 characters, 48 bits), directly or as key for longer key Computers: (Long) high-quality secret Hidden key (encrypted by password), directly (e.g., hash of the password) Louisiana State University 12- Authentication- 6 CSC4601 F04 Message Authentication Message authentication is concerned with: protecting the integrity of a message validating identity of originator non-repudiation of origin (dispute resolution) Will consider the security requirements Then three alternative functions used: message encryption message authentication code (MAC) hash function Louisiana State University 12- Authentication- 7 CSC4601 F04 Security Requirements: Types of Attacks Disclosure: Release of message contents to any person or process not possessing the appropriate key Traffic analysis: Discover the pattern of traffic between parties Masquerade: Insertion of messages into the network from a fraudulent source Content modification Sequence modification in a series of messages Timing modification: Delay or replay of message Source repudiation: Denial of transmission Destination repudiation: Denial of receipt Louisiana State University 12- Authentication- 8 CSC4601 F04 Authentication Functions Any message authentication needs two levels: Lower level – function that produces an Message Encryption Message Authentication Code (MAC) Hash function High level – Protocol that uses the authenticator as primitive Louisiana State University 12- Authentication- 9 CSC4601 F04 Message Encryption Message encryption by itself also provides a measure of authentication If symmetric encryption is used then: receiver know sender must have created it since only sender and receiver now key used know content cannot be altered if message has suitable structure, redundancy or a checksum to detect any changes Louisiana State University 12- Authentication- 10 CSC4601 F04 Symmetric Encryption: Confidentiality and Authentication Louisiana State University 12- Authentication- 11 CSC4601 F04 Internal Error Control Louisiana State University 12- Authentication- 12 CSC4601 F04 External Error Control Louisiana State University 12- Authentication- 13 CSC4601 F04 TCP Segment Louisiana State University 12- Authentication- 14 CSC4601 F04 Message Encryption If public-key encryption is used: encryption provides no confidence of sender since anyone potentially knows public-key however if sender signs message using their private-key then encrypts with recipients public key have both secrecy and authentication again need to recognize corrupted messages but at cost of two public-key uses on message Louisiana State University 12- Authentication- 15 CSC4601 F04 Public Key Encryption: Confidentiality Louisiana State University 12- Authentication- 16 CSC4601 F04 Public Key Encryption: Authentication and Signature Louisiana State University 12- Authentication- 17 CSC4601 F04 Public Key Encryption: Confidentiality, Authentication and Signature Louisiana State University 12- Authentication- 18 CSC4601 F04 Confidentiality and Authentication Implications of Message Encryption Louisiana State University 12- Authentication- 19 CSC4601 F04 Message Authentication Code (MAC) Generated by an algorithm that creates a small fixed- sized block depending on both message and some key like encryption though need not be reversible Appended to message as a signature Receiver performs same computation on message and checks it matches the MAC Provides assurance that message is unaltered and comes from sender Louisiana State University 12- Authentication- 20 CSC4601 F04 Message Authentication Code K – shared secret key Louisiana State University 12- Authentication- 21 CSC4601 F04 Message Authentication and Confidentiality Authentication tied to plaintext Louisiana State University 12- Authentication- 22 CSC4601 F04 Message Authentication and Confidentiality Authentication tied to ciphertext Louisiana State University 12- Authentication- 23 CSC4601 F04 Message Authentication Codes As shown the MAC provides confidentiality Can also use encryption for secrecy generally use separate keys for each can compute MAC either before or after encryption is generally regarded as better done before Why use a MAC? sometimes only authentication is needed sometimes need authentication to persist longer than the encryption (eg. archival use) Note that a MAC is not a digital signature because both sender and receiver share the key Louisiana State University 12- Authentication- 24 CSC4601 F04 Basic uses of MAC Louisiana State University 12- Authentication- 25 CSC4601 F04 Basic Uses of Hash Function Louisiana State University 12- Authentication- 26 CSC4601 F04 Basic Uses of Hash Function Louisiana State University 12- Authentication- 27 CSC4601 F04 Basic Uses of Hash Function Louisiana State University 12- Authentication- 28 CSC4601 F04 Basic Uses of Hash Function Louisiana State University 12- Authentication- 29 CSC4601 F04 MAC Properties A MAC is a cryptographic checksum MAC = CK(M) condenses a variable-length message M using a secret key K to a fixed-sized authenticator Is a many-to-one function potentially many messages have same MAC but finding these needs to be very difficult Louisiana State University 12- Authentication- 30 CSC4601 F04 Attack on MAC If k>n, k – length of key, n – length of message M1 and MAC1 are known Attacker has to perform MACi = Cki(M1) for all possible ki. At least one key is guaranteed to produce a match MACi = MAC1 A total of 2k MACs will be produced But there are only 2n<2k different MAC values The attacker has no way to know which is the correct key Louisiana State University 12- Authentication- 31 CSC4601 F04 Attack on MAC (cont.) The attacker has to iterate: Round 1 Given M1, MAC 1 = CK(M1) k Compute MACi = Cki(M1) for all 2 keys (k-n) Number of matches ≈ 2 Round 2 Given M2, MAC 2 = CK(M2) (k-n) Compute MACi = Cki(M1) for all 2 keys (k-2n) Number of matches ≈ 2 How many rounds? α = k/n For example if k = 80 bit and n = 32 48 First round : 2 keys 16 Second round: 2 Third round – find the key Louisiana State University 12- Authentication- 32 CSC4601 F04 Louisiana State University 12- Authentication- 33 CSC4601 F04 Requirements for MACs Taking into account the types of attacks Need the MAC to satisfy the following: 1. knowing a message and MAC, is infeasible to find another message with same MAC 2. MACs should be uniformly distributed 3. MAC should depend equally on all bits of the message Louisiana State University 12- Authentication- 34 CSC4601 F04 Using Symmetric Ciphers for MACs Can use any block cipher chaining mode and use final block as a MAC Data Authentication Algorithm (DAA) is a widely used MAC based on DES-CBC using IV=0 and zero-pad of final block encrypt message using DES in CBC mode and send just the final block as the MAC or the leftmost M bits (16≤M≤64) of final block But final MAC is now too small for security Louisiana State University 12- Authentication- 35 CSC4601 F04 Data Authentication Algorithm Louisiana State University 12- Authentication- 36 CSC4601 F04 Hash Functions condenses arbitrary message to fixed size usually assume that the hash function is public and not keyed cf. MAC which is keyed hash used to detect changes to message can use in various ways with message most often to create a digital signature Louisiana State University 12- Authentication- 37 CSC4601 F04 Hash Functions & Digital Signatures Louisiana State University 12- Authentication- 38 CSC4601 F04 Eavesdropping and Server Database Reading Public key: Need to protect private key Use good password Eavesdropping Use random challenge with signing/encryption using secret Server database reading Lamport hash Louisiana State University 12- Authentication- 39 CSC4601 F04 Public key Louisiana State University 12- Authentication- 40 CSC4601 F04 Password Alice, instant_pwd Alice Bob Bob knows hash of Alice’s pwd Bob computes has of instant_pwd and compares it with the stored value Louisiana State University 12- Authentication- 41 CSC4601 F04 Random challenge Knows Alice’s secret Alice Picks random R Alice Bob R X Computes same function and compares X Louisiana State University 12- Authentication- 42 CSC4601 F04 Lamport hash Defend against eavesdropping and reading the database hashn(pwd) = hash(hash…(hash(pwd))…) Alice