1. Week 5
Sharing resources
Security principles
Security protocols

2. Agenda
• Sharing resources
• Network security principles
• Security protocols

3. How to achieve
max-min fairness ?
• Two possible approaches
• Modify the routers to reach max-min
fairness
• Modify the endhosts to reach max-min
fairness

4. Simple Router
output port
Buffer
Input links Output link
Buffer acceptance
accepts or rejects
incoming packets

5. Router output port
Q[1]
Q[2]
Q[3]
Q[N]
Flow identification
Input links
Output link
Flow identification
Identifies the flow
to which the arriving packet
belongs
Buffer acceptance
accepts or rejects
incoming packets
Queuing strategy
Logical organization of the
router's buffers
Scheduler
Chooses the packet to
be transmitted first on
the output link

6. Round robin
Flow 2
Flow 1
Flow 3
Flow 4
Flow 5
Flow 1
Flow 2
Flow 3
Flow N
Scheduler :
F1
F2
F3
F4
FN

7. Example
F1
F2
F3
Flow2 (L=2)
Flow1(L=1)
Flow3 (L=1) F1
F2
F3
Flow1 and Flow3 send packets of size 1
Flow 2 sends packets of size 2

8. Round-Robin
• Advantage
• Can provide fairness independently of the
characteristics of the flows
• Extensions like Deficit Round Robin
support variable length packets
• Drawback
• Difficult to scale to a very large number of
flows

9. Agenda
• Sharing resources
• Network security principles
• Crypto building blocks
• Client authentication
• Server authentication
• Key exchange
• Security protocols

10. The security landscape
• Legitimate users
• Attacker
B
Bob Alice
Terrence
T
A

11. Security threat: Privacy
• Security issue
• Alice sends a confidential message to Bob
• How to prevent Terrence from reading the
message ?
B
T
A

12. Authentication
• Security issue
• Terrence sends a message to Bob
impersonating Alice
• How to prevent Terrence from spoofing
messages or how can Bob verify that the
message originates from Alice and not
Terrence ?
B
T
A

13. Message
integrity
• Alice sends a message to Bob, but
Terrence changes the message before it
reaches Bob
• How to prevent Terrence from changing
the message or how to allow Bob to check
that the message sent by Alice was not
modified ?
B
T
A

14. Denial of
Service
• Terrence sends so many messages to
Bob that Bob is unable to process the
messages sent by Alice
• How to prevent Terrence from overloading
Bob so that Alice cannot contact Bob ?
B
T

15. Hash functions
• Properties
• Easy to compute H(Msg,key)
• Very difficult to find Msg2 :
H(Msg,k)=H(Msg2,k)
• Example hash functions
• MD5, MD4, SHA-1,SHA-256
Alice Bob
H H
m
key key
m,H(m,key)
insecure
channel

16. Can we use CRC as a hash function ?

17. MD5
0
0.5
1
1.5
2
2.5
3
3.5
4
4.5
16 64 256 1024 8192
MD5 - Throughput in Gbps
MD5

18. SHA1 and SHA256
0
1
2
3
4
5
6
7
16 64 256 1024 8192
SHA - Throughput in Gbps
SHA-1
SHA512
Benchmarks can be computed using openssl speed command

19. Secret-key crypto
• Examples : DES, AES, RC-4, IDEA,
CHACHA
Alice Bob
E D
m
key key
E(m,key)
insecure
channel
m

20. Cipher performance
0
0.5
1
1.5
2
2.5
3
3.5
4
4.5
16 64 256 1024 8192
Cipher - Throughput in Gbps
RC4
DES
AES
AES-256

21. Public-key crypto
• Each user maintains two keys
• A public key (PublicKey) which can be
made public and can be used by any
user to send him/her encrypted
messages
• A private key (PrivateKey) which is kept
secret and can be used to decrypt
information encrypted with the public

22. Public-key crypto
Encryption
• Examples
• RSA, ECC
Alice Bob
E D
m
PubBob PrivBob
E(m,PubBob)
unsecure
channel
m

23. Public-key crypto
Signatures
• Examples
• RSA, DSS
Alice Bob
S V
m
PrivAlice PubAlice
S(m,PrivAlice)
insecure
channel
yes
no

24. RSA
0
20000
40000
60000
80000
100000
120000
140000
160000
180000
512 1024 2048 4096
verify/s
sign/s

25. Agenda
• Sharing resources
• Network security principles
• Crypto building blocks
• Client authentication
• Server authentication
• Key exchange
• Security protocols

26. Password authentication
Alice Bob
Hello from Alice, password = blabla Info about Alice
pass=blabla
Never ever store
a password in
clear in a file
What are the security risks with
password based authentication ?

27. Attacks
• Man in the middle attack
Terrence
Alice Bob
Hello from Alice, password =
blabla
If Terrence can capture the
message, then he will know the
password and ...
Info from Alice, password =
blabla
Can we improve this by using hash
functions ?

28. Hashed Password
Alice Bob
Hello from Alice, password =
Hash(blabla)
Info about Alice
pass=Hash(blabla)
Is this solution secure against a MITM
attack ?

29. One-time passwords
• Server stores for each user
• username
• n /* number of allowed authentications */
• hashn(pwd) /*
hash3(pwd)=hash(hash(hash(pwd))*/
An implementation of this scheme is described in :
N. Haller, C. Metz, P. Nesser, M. Straw. A One-Time Password
System. RFC 2289.February 1998.

30. One-time passwords
• When user wishes to be authenticated
• Server sends stored value of n
• User sends hashn-1(pwd)
• Server compares hash(hashn-1(pwd))
with hashn(pwd)
• If equal, user is authenticated,
server decrements n and
remembers
hashn-1(pwd)

31. One time passwords
Alice Bob
Hello from Alice
My current n is 123
Password : Hash122(P)=VVBG
Info about Alice
n=123
Hash123(P)=ZROK
Info about Alice
n=122
Hash122(P)=VVBG
Can Terrence attack this protocol ?

32. One-time passwords
Alice Bob
My current n is 8
Password : Hash7(P)=ABCT
Info about Alice
n=122
Hash122
(P)=VVBG
Terrence impersonates Bob
Hello from Alice
Terrence already knows Hash7(P) !
and can compute HashN(P) with N>=7
Current n is 122
Hash121(P)=Z4FT
Hello from Alice
What can Alice do to counter this attack ?

33. Agenda
• Sharing resources
• Network security principles
• Crypto building blocks
• Client authentication
• Server authentication
• Key exchange
• Security protocols

34. Server Authentication
Alice Bob
Are you Bob ?
Yes, of
course
• A more secure protocol is necessary
• Solution
• Each server maintains a (public,private) key pair
• PubBob , PrivBob

35. Server authentication
• Is this a secure authentication (justify) ?
Alice Bob
Are you Bob ?
S(Yes,PrivBob)
PubBob,,PrivBob
Alice must already know PubBob

36. Server authentication
Alice Bob
Are you Bob ?
S(Yes,PrivBob)
PubBob,,PrivBob
Terrence
Please send PubBob
Possible Man in the Middle Attack
The two messages sent by Bob could
also have been sent by Terrence
Bob's key :
PubBob
Is this secure ?

37. Server authentication
• Public-key certificates
• To authenticate public keys, Alice and Bob
must trust a third party
• Certificates
l S(PubBob , PrivC)
Alice
Bob
Are you Bob ?
S(Yes,PrivBob)
S(PubBob , PrivC )
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
Charles
PubC,,PrivC
PubC,
Is this protocol secure (justify) ?

38. Are certificates sufficient ?
Alice Bob
Are you Bob ?
Terrence
Are you Bob ? Terrence copies the message sent
by Bob for later...
Terrence sends the saved copy
of Bob's message
S(Yes,PrivBob)
S(PubBob , PrivC )
S(Yes,PrivBob)
S(PubBob , PrivC )
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
PubC
,

39. Improved authentication
• RandomAlice is a nonce
Alice Bob
Are you Bob ?, RandomAlice
Terrence
Terrence copies the message sent
by Bob for later...
This is useless as the next request
sent by Alice will contain a different
random number
S(Yes,RandomAlice ,PrivBob)
S(PubBob , PrivC )
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
PubC

40. Agenda
• Sharing resources
• Network security principles
• Crypto building blocks
• Client authentication
• Server authentication
• Key exchange
• Security protocols

41. Key Exchange
• How can Alice and Bob safely exchange
a secret key in the presence of Terrence
?
B
T
A
T

42. Diffie-Hellman
key exchange
• Relies on modulo integer arithmetic
• All users agree on
• A modulus : p
• A base : g

43. Diffie-Hellman
key exchange
Alice Bob
A=ga mod p
B=gb mod p
a=random int
b=random
int
Secret=Ba mod p Secret=Ab mod p

44. Diffie-Hellman
g=5, p=23
Alice Bob
A=ga mod p=16
B=gb mod p=21
a=8
b=13
Secret=Ba mod p
=218mod 23=3
Secret=Ab mod p
=1613 mod 23=3

45. Diffie-Hellman
• Is this safe ?
• Mathematics
• Researchers have tried to break the
scheme for more than 4 decades
• Attackers
• Can Terrence find an attack against
Diffie-Hellman ?

46. A possible MITM
attack
Alice Bob
A=ga mod p
B=gb mod p
a=random int
b=random
int
SA=Ta mod p SB=Tb mod p
Terrence
t=random
int
T=gt mod p
T=gt mod p
SB=Bt mod p
SA=At mod p

47. Solving the MITM attack
• What can we do to prevent this Man in
the Middle Attack ?
• Pre-negotiated Shared secret
• Use public keys
• Public/Private keypair on Client
• Public/Private keypair on Server

48. Authenticated Diffie-
Hellman
Alice Bob
A=ga mod p
S(B=gb mod p, PrivBob)
Cert(PubBob , PrivC )
Secret=Ba mod p Secret=Ab mod p
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
Charles
PubC,,PrivC

49. Agenda
• Sharing resources
• Network security principles
• Security protocols
• Transport Layer Security (TLS)
• ssh

50. TLS in the stack
Physical layer Physical layer
Datalink Datalink
Network
Network
Physical layer
Datalink
Network
SDU
Transport Transport
Application Application
Segments
TLS TLS
Records

51. TLS building blocks
• Handshake
• Authenticate server
• Negotiate crypto parameters
• Negotiate encryption and authentication
keys
• Record protocol
• Transmit data securely

52. Phases of a TLS session
• Handshake
• Session establishment, key negotiation
• Data transfer phase
• Encrypted and authenticated records are
exchanged
• Session termination
• Data transfer stops and session
terminates

53. TLS handshake
Alice Bob
ClientHello (Ciphers, RandomAlice)
ServerHello(Ciphers,RandomBob )
Certificate(PubBob , PrivC )
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
PubC
E( PreMasterSecret , PubBob)
Alice chooses PreMaster Secret
Finished( H(handshake msgs,Key)
Finished( H(handshake msgs,Key))

54. X.509 Certificates
• C=country, O=organisation , OU=Organisation Unit, ST=State,
L=City
• CN=Common Name
• Sometimes DNS name for a server
• Key usage extensions
• digitalSignature, keyEncipherment, dataEncipherment,
keyCertSign, ...
• Optional Fields
• emailAddress, subjectAltName, ...

55. ClientHello message
• Protocol Version
• 32 bytes long random number
• 4 bytes Unix time (seconds since 01/01/1970)
• 28 bytes random number
• Session Id
• Each SSL session has an identifier which can be used
later to restart a session
• List of supported Ciphers
• List of supported Compression Methods

56. ClientHello
• Supported ciphers
• Authentication+Key
Exchange+Cipher+Hash
• TLS RSA WITH NULL MD5
• TLS RSA EXPORT WITH RC4 40 MD5
• TLS RSA WITH RC4 128 MD5
• TLS RSA WITH DES CBC SHA
• TLS RSA WITH 3DES EDE CBC SHA

57. ServerHello
• Protocol version
• Random
• Session Id
• Optional, sent by server if it allows
sessions to be resumed later
• Cipher Suite
• One of the client cipher suites
Compression Method

58. Handshake (cont.)
Alice Bob
ClientHello (Ciphers, RandomAlice)
ServerHello(Ciphers,RandomBob )
Certificate(PubBob , PrivC )
ServerHelloDone
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
PubC
ClientKeyExchange (E(PreMasterSecret, PubBob))

59. Data transmission
Data
Data(a) Data(b)
MAC MAC
Hash(Hkey) Hash(Hkey)
Rec.
Header Encrypted(Data(a)+MAC)
Rec.
Header Encrypted(Data(b)+MAC)
Encrypt(Ekey)
Encrypt(Ekey)
• Divide the byte stream in records
• Each record is authenticated • and encrypted

60. Record Authentication
• How to authenticate records ?
• Key
• Sequence number
• Data
• Cryptographic construction
• HMAC

61. Key Derivation
PreMaster
Secret
Client
Random
Server
Random
Master
Secret
Key Block
Client
MAC
Server
MAC
Client
Encrypt
Server
Encrypt
Client
IV
Server
IV

62. Session resumption
Alice Bob
ClientHello (Ciphers, Session:123)
ServerHello(Ciphers,Session:123 )
ChangeCipherSpec
Finished( H(handshake msgs,Key)
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
PubC,
Session 123 : MasterKey
ChangeCipherSpec
Finished( H(handshake msgs,Key)
Session 123 : MasterKey

63. TLS 1.3
• Why changing TLS ?
• TLS was considered to be too slow
• Two round-trip-times
• TLS was considered to be too complex
• Some attacks have affected TLS
• Privacy became a strong focus within
the IETF

64. Design objectives
• simplify the design by removing unused or unsafe
protocol features
• only a small number of cipher suites
• improve the security of TLS
• no compression or unsafe features
• improve the privacy of the protocol
• perfect forward secrecy
• reduce the latency of TLS

65. Perfect Forward
Secrecy
• Definition
• An encryption system has the property
of forward secrecy if plain-text
(decrypted) inspection of the data
exchange that occurs during key
agreement phase of session initiation
does not reveal the key that was used
to encrypt the remainder of the session.

66. Does TLS support
PFS ?
• Not when RSA is used
ClientHello (Ciphers, RandomAlice)
ServerHello(Ciphers,RandomBob )
Certificate(PubBob , PrivC )
E( PreMasterSecret , PubBob)
Alice chooses PreMaster Secret
T
Z
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
PubC
• Some TLS ciphers use Diffie-Hellman

67. Simplifying the
handshake
• Reduce the number of ciphers supported
• Less negotiation between client/server
• Diffie-Hellman is now required
• Client immediately starts Diffie-Hellman
before having validated the server
certificate

68. TLS 1.3 handshake
Alice Bob
ClientHello (ga mod p, RandomAlice)
ServerHello(gb mod p,RandomBob
)
Certificate(PubBob , PrivC )
Sign(DHkey,Handshake)
Finished
Encrypted Data
PubC, ,PubBob,,PrivBob
S(PubBob , PrivC )
PubC
Alice computes DHkey
Finished, Encrypted Data
Bob computes DHkey

69. Agenda
• Sharing resources
• Network security
• Security protocols
• Transport Layer Security (TLS)
• ssh

70. telnet

71. A telnet session
client server
Connect_req
Connect_resp
Connect_conf
username
Login:
Password:
mypass
• Is this secure ?

72. SSH
• Basic principles
• Public key used for authentication
• Each host (client/server) has a public
keypair
• Diffie Hellman for key exchange
• Secret key encryption for confidentiality

73. SSH
client
SSH-2.0-OpenSSH_6.9
SSH-2.0-OpenSSH_6.6.1
SSH2_MSG_KEXINIT
SSH2_MSG_KEXINIT
,PubServer,,PrivServer

74. SSH : key exchange
• Principles
• Diffie Hellman allows to securely
exchange keys
• but it needs to be authenticated !
• When you use ssh to access
UCLouvain’s servers, how do
you authenticate them ?

75. Key exchange
client
SSH2_MSG_KEXINIT
B=gb mod p
Sign(Hash(Vclient||Vserver||
KEXClient||KEXServer||PubServer||A||B||K)
SSH2_MSG_KEXINIT
A=ga mod p
,PubServer,,PrivServer
K=Ab mod p

76. User authentication
• How does the server authenticate the user ?
• Username/password
• Sent over the encrypted channel
• Public key authentication
• User has his/her public/private keypair
• Server knows user's public key and
sends challenge