Design and Analyze Secure Networked Systems Prof. Edward Chow @ Colorado Univ. Note by waegaein@github.com

1. Design and Analyze
Secure Networked Systems
5
Prof. Edward Chow @ Colorado Univ.
Note by waegaein@github.com

2. Software Signing
• Provide ways to verify authenticity and integrity of software
which are distributed via web.
• GPG
GNU Privacy Guard (GnuPG or GPG) is a tool for secure
communication. It can be used to generate public/private key pair.
• PGP
Pretty Good Privacy (PGP) is encryption program that follows
OpenPGP standard for encyption/decryption of data.

3. Sign Software
1. Finish a version for release.
2. Generate MD5 and SHA1 message digest of the software.
3. Generate PGP signature of the digest, using private key.
4. Distribute the software with the signature.
5. Distribute the public key, which pairs with the private key
used for signing, to key servers.

4. Sign Software
Key server
Version
for release
Mirror site
Software Author

5. Sign Software
Key server
Version
for release
Message
DigestHash
e.g.
SHA-256
Mirror site
Software Author

6. Sign Software
Key server
Version
for release
Message
DigestHash
e.g.
SHA-256
(private key) Mirror site
Software Author
Encrypt

7. Sign Software
Key server
Version
for release
Message
DigestHash
e.g.
SHA-256
(private key)
Software
Distribution
Mirror site
Software Author
Encrypt

8. Sign Software
Key server
Upload distribution
Version
for release
Message
DigestHash
e.g.
SHA-256
(private key)
Software
Distribution
Mirror site
Software Author
Encrypt

9. Sign Software
Software Author Key server
Upload public key
Upload distribution
Version
for release
Message
DigestHash
e.g.
SHA-256
Encrypt
(private key)
Software
Distribution
Mirror site

10. Verify Software
1. Download software and its signature.
2. Retrieve public key from key server.
3. Decrypt the signature into a digest.
4. Generate a digest by hashing the software.
5. If the two digests are identical, the software is verified.
6. If different, the software or signature is considered to be
altered.

11. Verify Software
Software User
Key server
Mirror site

12. Verify Software
Software User
Retrieve public key
Download distribution
Key server
Mirror site

13. Verify Software
Software User
Retrieve public key
Download distribution
Key server
Mirror site

14. Verify Software
Software User
Decrypt
(public key)
Retrieve public key
Download distribution
Key server
Mirror site

15. Verify Software
Software User
Hash
Decrypt
(public key)
Retrieve public key
Download distribution
Key server
Mirror site

16. Verify Software
Software User
Hash
Decrypt
(public key)
=
Verified / Altered
Retrieve public key
Download distribution
Key server
Mirror site

17. Mirror Sites
• Voluntarily distribute software releases of other organizations
to provide faster access.
• Not managed by the original author organizations.
• Encouraged to download bundle from mirrors.
• Encouraged to download hash and signatures only from the
original.

18. PKI vs PGP
• PKI
• uses CA to vet and bind public
keys to user ID.
• takes longer to register/verify
• is centralized thus have SPOF.
• costs fee from CA.
• PGP
• uses Web of Trust (Key servers)
to vet and bind public key to
user ID.
• is hard to revoke keys
• is distributed.
• is free.

19. Misc. How much is encryption safe?
• SHA-1 was cracked by Google 2017.
• … This took the equivalent processing power as 6,500 years of single-CPU computations and
110 years of single-GPU computations …
• 110 years of single-GPU
== 1 year of 110 GPUs
== 24 hours of 40,150 GPUs
== 1 hour of 963,600 GPUs
== 1 minute of 57,816,000 GPUs
== 10 seconds of 346,896,000 GPUs (== 9,435,571,200,000 KRW for only GPUs…)