Security Internet Protocols
1
Outline of Course
1. Introduction 2. Secure TCP/IP Protocols (IPSec) 3. Secure Sockets Layer (SSL), Transport Layer Security (TLS) 4. Secure HTTP 5. Basic WWW Security
2
Protocol Stack at Outset
What we have to start with
HTTP
FTP
SMTP
TCP IP
Can be at just about any point
3
Where can we put security?
HTTP FTP SMTP
HTTP FTP SMTP
TCP AH IP
Network approach
ESP
SSL/PCT/TLS TCP IP
Transport approach
SET
S-HTTP S/MIME HTTP FTP
PGP
SMTP
TCP IP
Application approach
TCP IP
Presentation approach
4
IPSec - Network Approach
Sponsored by IETF IPSec working group Scheduled to be integral component of IPv6 Supports strong authentication and encryption at layer 3 Bi-directional tunnel Packet filtering is primary access control method Requires Public Key Infrastructure (PKI)
5
IP Layer Security
Functionality
AH (Authentication Header): integrity and authenticity ESP (Encrypted Security Payload): confidentiality, optional authentication & integrity
Security Association (for each pair of hosts): determined by destination IP address and the SPI (Security Parameters Index)
Specification of the crypto methods to be used by SPI Keys to be used by the crypto methods for that SPI The hosts and other entities associated with this traffic
Key Management
Manual Keying (required) Key Management Protocols (in flux)
6
IPSec AH Packet Format
IPv4 AH Packet Format
IPv4 Header Authentication Header Higher Level Protocol Data
IPv6 AH Packet Format
IPv6 Header Hop-by-Hop Authentication Higher Level Other Headers Routing Header Protocol Data
IPv6 AH Header Format
Next Header Length Security Parameters Index Authentication Data (variable number of 32-bit words)
7
Reserved
IPSec Authentication
SPI: identifies the security association to use for this packet
type of crypto checksum, how large it is, and how it is computed
authentication data
hash of packet contents include IP header as as specified by the transform indicated by the SPI treat fields which change hop-by-hop (TTL, header checksum) as zero
Keyed MD5 Hash is default
MD5 Hash
Secret Key
Key
Headers and data being sent
Key
8
IPSec ESP Packet Format
IPv4 ESP Packet Format
Unencrypted Other IP IP Header Headers Encrypted ESP Header Encrypted Data
ESP Header Format
Security Association Identifier Opaque Transform Data, variable length
DES + MD5 ESP Format
Security Parameters Index (SPI) Initialization Vector (optional) Replay Prevention Field (incrementing count) Payload Data (with padding) Authentication checksum
9
IPSec Encryption
ESP Modes
Tunnel-mode: payload in a whole IP datagram, mobile-IP Transport Mode: payload is a higher level IP protocol, e.g., TCP/UDP
DES with CBC is default Key Management * ISAMKP/Oakley (mandatory) ISAMKP - association management protocol
Oakley - key management exchange message(s) to establish long-lived context
* Simple Key-Management for Internet Protocols -SKIP (elective) * Photuris
10
Header Usage and Security
IPSec standards recommend using the AH to protect the ESP
AH validates both the IP addresses and the message contents
Omitting the ESP
without the ESP, it is possible to eavesdrop on the authenticated data (this is a threat when resusable, secret passwords are used)
Omitting the AH
ESP does not generally protect against modification ESP is vulnerable to header cut-and-paste attack
attacker takes out the ESP out of packets and inserts a new ESP destined for another machine (when IPSec proxy is used) another solution is to assign unique security associations to different pairs of communicating hosts (burden on administrators)
11
IPSec Issues
Benefits:
Integrated directly into IP stack Uses public key technology Proposed IETF standard Security model for IPv6 Supports strong authentication and encryption mechanisms Expected to be widely deployed in internetworking devices Supports only IP traffic
Concerns:
IETF working group slow to establish consensus Client deployment dependent on Microsoft Competing key management standards Requirement for public key infrastructure Router Vendors are central to deployment Users vs Addresses
12
Transport Approach - SSL/TLS
SSL: Secure Sockets Layer TLS: Transport Layer Security SSL Version 1: Was quickly replaced by SSL v2. Not in use today. SSL Version 2: Has some security problems. Still supported. PCT: Microsoft's response to SSL 2.0. Fixes some problems, but has been supplanted by SSL 3.0. SSL Version 3: Complete redesign of SSL. Fixed the problems in previous versions and added many features TLS: Under development IETF standard based on SSL 3.0 with enhancements.
13
What problem does SSL Solve?
Allows secure communications between two computers, provided that at least one has a certificate trusted by the other (avoids manin-the-middle when possible). Isolates application developers from the complexities and dangers of cryptosystem design. Supports authentication, encryption, and key exchange Reliable connections via various secure hash functions Efficient, extendible, easy to integrate, not ASN.1 based, secure, open, interoperable. End-to-end armored pipe only, not signed letter and sealed envelope model.
14
A simple SSL-like protocol
Problem: A user wants to shop at a merchant's server -- but the server doesn't know anything about the user. Phase 1: Handshake to produce a shared secret K. 1. User requests, obtains, and verifies Server's certificate
2. User creates a 160-bit value K at random 3. User computes K encrypted with server's public key and sends the result to S. 4. Server decrypts with its private key to recover K. 5. Server hashes K and sends the result to user. 6. User also hashes K and verifies the value from server.
15
Simple SSL-like protocol, cont
Phase 2: Secure communications using a shared secret K. Data to be exchanged is broken into packets. Prior to transmission, each packet of data is encrypted and MAC'ed:
Communications are encrypted using K to ensure that data are private from eavesdropping Communications are MAC'ed using K to ensure that data are secure against tampering and modification
The recipient decrypts the packet and verifies the MAC. An incorrect MAC indicates a fatal error.
16
SSL Protocols
The handshake Protocol: negotiates the use of new crypto algorithms and keys. The record protocol: functions as a layer beneath all SSL messages and indicates the encryption and integrity protection being applied to the data. The alert protocol: when errors have occurred or when a session is being ended.
17
SSL Handshake: Protocol
Handshake Protocol Goals:
Negotiate security parameters, Authenticate server to client (server name must match name in certificate to prevent man-in-the-middle attacks) Authenticate client to server (if requested by server), Create a secret (the "Master Secret" shared between the participants)
Negotiated protocol parameters
Protocol version (e.g., SSL 3.0, TLS 3.1, etc.) CipherSuite (crypto algorithms, etc. ) Compression method (e.g., none)
18
SSL Handshake: CipherSuite
The CipherSuite defines the cryptographic algorithms, key sizes, etc CipherSuite Parameters:
Encryption Algorithm: none, RC4-40, RC4-128, RC2-40, IDEA-128, DES-40, DES, TripleDES Public Key algorithm: RSA, Fortezza, or Diffie-Hellman (with RSA, DSS, or, no certificates* ) Hash Function: MD5, SHA
* Certificate-less handshakes are vulnerable to man-in-the-middle attacks. In some environments, anonymous Diffie-Hellman is helpful -- but in most cases, any support for anonymous ciphersuites would be a massive security flaw 19
Client
SSL Handshake: Steps
1. Client sends ClientHello message. 2. Server acknowledges with ServerHello message. 3. Server sends its certificate.
Server Certificate
Server
MasterSecret
4. Server requests client's certificate 5. Client sends its certificate. 6. Client sends ClientKeyExchange message
Server's Private Key
Server's Public Key
7. Client sends a Certificate Verify message. 8. Both send ChangeCipherSpec messages. 9. Both send Finished messages.
20
Digital Signature
SSL Handshake:Resuming Sessions
Goal: minimize the number of SSL handshakes since:
Private key operations take server time Network round trips are slow (2 per handshake)
If two parties have recently communicated, they already have a shared master. If both parties agree, the old master secret can be reused. This is called resuming a session. A Hack: Adding state to a stateless protocol (http) Resuming can be done even if the parent session is still alive to split sessions (e.g., to have 4 simultaneous connections, do the handshake once then "resume" three new sessions).
21
SSL Record Layer
Defines how application data (payload) is:
broken into packets encrypted and decrypted MAC'ed and verified
SSL ciphertext MAC Content Padding SSL compressed SSL Plaintext Real application data Four keys are used and derived from the MasterSecret:
Server write key Client write key Server write MAC secret Client write MAC secret
22
Record Layers:
SSL Plaintext - type, SSL version, length, data SSL compressed compressed (SSL plaintext) SSL Ciphertext - encrypted (MAC and SSLcompressed)
Strengths of the SSL
Bruteforce Attack
128 bits or more can be said to be safe in the foreseeable future.
Dictionary Attack
for instance, take HTTP "get" command and use every possible key to precompute encrypted form of the plaintext. SSL protects by having very large key spaces (even export version is actually 40 bit with 88 bits disclosed)
Replay Attack
Attack works by rerunning the messages sent earlier SSL defeats it by using a 128-bit nonce value that is unique to that connection
Man-In-the-Middle Attack
SSL uses signed certificates to authenticate the server's public key
23
Weaknesses of the SSL
Using weak encryption when strong is required
Does not work with export version
24
Weaknesses of the SSL, cont
Certificate problems
not signed by a trusted Certificate Authority expired certificates (No certificate revocation list (CRL) in spec!) Only real server authentication is that the DNS name in the URL matches the name in the certificate if you are fooled into using a wrong name (www.isbankasi.com.tr instead of www.isbank.com.tr) you'll never know
Only using SSL for forms not all or most of your site
no caching of SSL by default therefore performance issues what's wrong with this picture:
https://www.company.com/order_form.cgi <FORM ACTION="http://www.company.com/process_order.cgi" METHOD=POST>
25
Web Spoofing
Web spoofing is pretending to be somebody else's web site Allows traffic to be intercepted and changed All Web traffic must pass through attacker's proxy
somebody puts a false link in a popular Web page by choosing DNS name very close to the real one (www.isbankasi.com.tr instead of www.isbank.com.tr)
Users must be careful to detect it Can NOT be stopped -- even with SSL
unless you are using client side certificates (which hardly anybody is)
26
Web Spoofing
you.com
Browser
good.com
WWW Server
Link
2
4
bad.com
http://bad.com/http://good.com/file
7
Modified URL
1
WWWserver
Call good.com to get file Change data in the copy of file Return to you.com
5 3 6
http://good.com/file Normal URL
27
SSL - What To do
Use SSL version 3
SSL 2.0 used the same crypto keys for encryption and for keyed hash a succesful brute force attack also lets the attacker forge data SSL 3.0 uses separate keys for encryption and integrity Better of prevention a replay in SSL 3.0
Use client certificates
Web spoofing can only be stopped using client certificates Strong user authentication (better than reusable passwords)
Do not use anonymous Diffie-Hellman for key exchange
can not protect against man-in-the-middle attack
28
SSL Tools
Netscape Reference Implementation
http://www.netscape.com/newsref/std/sslref.html API and libraries (UNIX and PC native versions) Not exportable outside USA
SSLeay (from Australia)
Developed by Eric Young (http://www.psy.uq.oz.au) Some implementation bugs SSLeay-0.6.6-> SSLv2, SSLeay-0.8.0-> SSLv3, SSLeay-0.9.0-> TLS v1 Not a reference implementation, but can be used by anybody
SSLP Reference Implementation (University of Bristol)
Not completed yet.
29
SSL Examples - SSLeay
> ssleay SSLeay>help 'help' is a bad command, valid commands are verify asn1parse req dgst dh enc gendh errstr ca crl rsa dsa dsaparam x509 genrsa s_server s_client speed s_time version pkcs7 crl2pkcs7 sess_id ciphers Message Digest commands - see the dgst command for more details md2 md5 sha sha1 mdc2 Cipher commands - see the enc command for more details base64 des des3 desx idea rc4 rc2 bf cast rc5 des-ecb des-ede des-ede3 des-cbc des-ede-cbc des-ede3-cbc des-cfb des-ede-cfb des-ede3-cfb des-ofb des-ede-ofb des-ede3-ofb idea-cbc idea-ecb idea-cfb idea-ofb rc2-cbc rc2-ecb rc2-cfb rc2-ofb bf-cbc bf-ecb bf-cfb bf-ofb cast5-cbc cast5-ecb cast5-cfb cast5-ofb cast-cbc rc5-cbc rc5-ecb rc5-cfb rc5-ofb quit
30
SSLeay - s_client
SSLeay>s_client usage: client args -host host - use -connect instead -port port - use -connect instead -connect host:port - who to connect to (default is localhost:4433) -verify arg - turn on peer certificate verification -cert arg - certificate file to use, PEM format assumed -key arg - Private key file to use, PEM format assumed, in cert file if not specified but cert file is. -CApath arg - PEM format directory of CA's -CAfile arg - PEM format file of CA's -reconnect - Drop and re-make the connection with the same Session-ID -pause - sleep(1) after each read(2) and write(2) system call -debug - extra output -nbio_test - more ssl protocol testing -state - print the 'ssl' states -nbio - Run with non-blocking IO -quiet - no s_client output -ssl2 - just use SSLv2 -ssl3 - just use SSLv3 -tls1 - just use TLSv1 -no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol -bugs - Switch on all SSL implementation bug workarounds -cipher - prefered cipher to use
31
Garanti Bank SSL Connection
SSLeay>s_client -host www.garanti.com.tr -port 443 CONNECTED(00000004) depth=0 /C=TR/L=Istanbul/O=Garanti Bankasi/CN=www.garanti.com.tr/2.5.4.17=80670 verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /C=TR/L=Istanbul/O=Garanti Bankasi/CN=www.garanti.com.tr/2.5.4.17=80670 verify error:num=21:unable to verify the first certificate verify return:1 --Server certificate -----BEGIN CERTIFICATE----MIIB8TCCAV4CBQLzABWcMA0GCSqGSIb3DQEBAgUAMF8xCzAJBgNVBAYTAlVTMSAw HgYDVQQKExdSU0EgRGF0YSBTZWN1cml0eSwgSW5jLjEuMCwGA1UECxMlU2VjdXJl IFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05NzA2MTMwMDAwMDBa Fw05ODA2MTQyMzU5NTlaMGcxCzAJBgNVBAYTAlRSMREwDwYDVQQHEwhJc3RhbmJ1 bDEYMBYGA1UEChMPR2FyYW50aSBCYW5rYXNpMRswGQYDVQQDExJ3d3cuZ2FyYW50 aS5jb20udHIxDjAMBgNVBBETBTgwNjcwMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB ALZOrR1/e1UxtewMTsLRbUrKrKfrO5cazennpPfSJMf+59rUySUrG7pRQZGZi0Fy bbEIIaoUl4ZFSFeB8azxMHcCAwEAATANBgkqhkiG9w0BAQIFAAN+AIXlbhJOsAqt KAPBQ7jg+wjwoODpyK37n1dFb/4gLE7Msa/MeBzkfNzzH46hL1L5zdRnDNk7rxvu ZHJ44s5oitgXAoDYEFNf6S9W1ahak2Zx4fuvHX+gcuBt0RBfF7DdjrhIPiokrLFr s3LKmozsBxfTJrZ2Zj4VVKTOsYrm -----END CERTIFICATE-----
32
Garanti Bank SSL Connection
subject=/C=TR/L=Istanbul/O=Garanti Bankasi/CN=www.garanti.com.tr/2.5.4.17=80670 issuer=/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority --No client certificate CA names sent --Ciphers common between both SSL endpoints: EXP-RC4-MD5 EXP-RC2-CBC-MD5 DES-CBC-MD5 --SSL handshake has read 641 bytes and written 236 bytes --New, SSLv2, Cipher is DES-CBC-MD5 Server public key is 512 bit SSL-Session: Protocol : SSLv2 Cipher : DES-CBC-MD5 Session-ID: 67629BE086FF9770E756936A0FA9C266 Master-Key: 02BBBAD44879FDCE Key-Arg : EA38DB2BF3787992 Start Time: 865663347 Timeout : 300 (sec)
33
How does TLS differ from SSL?
TLS 1.0 is based on Netscape's SSL 3.0 protocol Includes minor improvements after two years of market experience Clearer and more precise specification MAC changes Cleaner handling for the lack of a client certificate Greater Flexibility
Additional error and warning alerts Separation of Record and Handshake Layers Makes possible additional Record Layer clients
Mandatory Ciphersuite
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
34
SSL/TLS Problems
Doesn't work well with proxies and filters Adds additional computational overhead at server & client Adds extra network round trips (e.g., for handshake) Key management can be expensive (often requires hardware) Migration from non-public key infrastructure is non-trivial Requires a certification authority with with appropriate policies International export restrictions complicate everything, general purpose full strength SSL products can not be exported Any experience at all in building, maintaining and operating secure systems? Especially in Turkey?
35
The future of SSL / TLS
Microsoft, Netscape, etc. have all announced support for SSL 3.0 and are shipping products. SSL will be replaced by the IETF TLS standard. All major web companies are expected to use TLS for their session layer security. For now, TLS changes will be minor. Better support for passwords, symmetric keys, pre-encrypted data may be added eventually. SSL/TLS may eventually be replaced by a more complete public key infrastructure protocol, but not anytime soon.
36
Secure HTTP (s-http)
It's lost -- no body is implementing it We include it here to illustrate design issues Different protocol, similar to http Functionality
Transaction Confidentiality, authenticity, integrity, non-repudiation of origin
Goals Flexibility, multiple modes of operations, multiple key management
techniques multiple trust models, multiple crypto algorithms and encapsulation formats, negotiation
37
s-http Layering
Uses new HTTP method "SECURE" URLs aren't sent in the clear s-http modes: signature, authentication, encryption, freshness (challenge-response) s-http message:
request/status line headers encapsulated content
another s-http message an http message data
38
S-http Negotiation Fields
privacy-domain (PKCS-7 or PEM) certificate types (X.509 or X.509v3) privacy enhancements (sign, encrypt, or auth) signature algorithms (RSA or NIST-DSS) Message-digest algorithms (RSA-MD2, RSA-MD5, NIST-SHS, RSA-MD5-HMAC, NIST-SHS-HMAC) Symmetric content algorithms (DES-CBC, RC2-CBC, DESEDE-CBC, etc) Symmetric-header-algorithms - same as above but f...