{[ promptMessage ]}

Bookmark it

{[ promptMessage ]}

CSC 607 Meeting 3 Charts

CSC 607 Meeting 3 Charts - Security in Computing – CSC...

Info iconThis preview shows page 1. Sign up to view the full content.

View Full Document Right Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: Security in Computing – CSC 607 Wireless Security – WCM 605 Meeting 3 Tue, Jan 12, 2010 1/12/2010 1/12/2010 1 Week 2 Schedule Tue 1/12 30 minute quiz Network Security Securing email Network Security Protocols – Key Establishment & Authentication Form Teams for Week 2 Small Group Projects Thu 1/14 Week 1 Small Group Project Presentation Network Security Protocols –Encryption & Integrity Protocols Review for Mid­Term Exam Week 2 Reading – Pfleeger & Pfleeger 4th Edition Chapters 2 and 7 Chandra Chapter 2 (all) and Chapter 3, pp 67­75 Written Assignment A due by midnight, Saturday, Jan 17 1/14/2010 1/14/2010 2 Network Security 1/12/2010 1/12/2010 3 Key Network Security Topics 1/12/2010 1/12/2010 Threats/Vulnerabilities in Networks Network Security Controls 4 Threats/Vulnerabilities in Networks All Threats are Against THE FOUR KEY AREAS: • • • • Confidentiality Integrity Availability Non Repudiation Threats are Applied Against: • Data •Hardware Threats are Applied By: • Nature • Non­malicious Humans 1/12/2010 1/12/2010 •Software •Accidents •Malicious Attackers 5 What Makes Networks Vulnerable 1/12/2010 1/12/2010 Networks Support Anonymity of the Attacker Attacks May Come From Many Origins and May Be Directed Against Many Targets Sharing on Networks Makes Access Control Difficult A Network Is a Very Complex System Networks May Have Unknown (Unknowable) Perimeters Communications May Take Unknown Paths Through a Network 6 Kinds of Attacks – Kinds Eavesdropping/Wiretapping Eavesdropping/Wiretapping Eavesdrop – Overhear without any extra effort Wiretap – Intercept through some effort • Cable Wiretap Take advantage of inductance to capture electromagnetic signals radiated from wires Turn a host on a LAN into a packet sniffer • Microwave Take advantage of natural spread in signal Interleaving of messages on shared facility provides protection • Satellite Easy to eavesdrop Heavy multiplexing makes ID of particular target hard • Optical Fiber Much more secure than cable • Wireless Easy to intercept Easy to steal service Encryption (WEP with 104 bit key) improves security • 85% don’t bother to even enable WEP 1/12/2010 1/12/2010 7 Kinds of Attacks – Impersonization & Spoofing Impersonization • Guess valid ID/authentication on a target • Learn valid ID/authentication from interception through eavesdropping or wiretapping • Exploit flaws to avoid authentication • Target a system that doesn’t require authentication • Target systems with well­known ID schemes • Target systems with trusted authentication schemes for network management, maintenance and operation Spoofing • Masquerading – one host pretends to be another • Session Hijacking – grab control after a session starts • Man­in­the­middle attacks (very similar to hijacking) 1/12/2010 1/12/2010 8 Attacks on Messages Message Confidentiality Threats • • • Misdelivery through hardware/software flaw or human error Exposure at intermediate network point Traffic Flow Analysis to identify unusually heave traffic allowing inference of sensitive information Message Integrity Attacks • Falsification Change some/all content or combine selected pieces Replace with false message Replay old message Change apparent source Destroy or delete message • Noise 1/12/2010 1/12/2010 Hardware/Software prevents most noise problems 9 Kinds of Attacks – Active or Mobile Kinds Code Code Active or Mobile code = code that is pushed to a client for execution • Cookies Take up space on your disk Encrypted info about you that you can’t see Info is forwarded to servers you don’t know without your permission • Scripts (replace communication from client) Malicious user monitors browser/server communication Sees how changed web page entry affects browser and how server reacts Malicious user then manipulates server’s actions, e.g. using CGI script to obtain a password, or initiate action • Java Code Hostile applet can harm client’s system • Not screened for safety • Runs with privileges of invoking user • ActiveX – Microsoft’s answer to Java Authentication verifies source of code but not it’s correctness or safety • Auto Exec by Type 1/12/2010 1/12/2010 Malicious, executable file under nonobvious file type 10 Summary of Threats to be Summary Controlled Controlled 1/12/2010 1/12/2010 Intercepting data in traffic Accessing programs or data at remote hosts Modifying programs or data at remote hosts Modifying data in transit Inserting communications Impersonating a user Inserting a repeat of a previous communication Blocking selected traffic Blocking all traffic Running a program at a remote host 11 Network Security Controls – Network Overview* Overview 1/12/2010 1/12/2010 Build in security through architectural controls – PLANNING! Use Encryption to protect confidentiality Use Error Protecting Codes and Cryptographic Checksums to protect content Integrity Use Strong Authentication methods to ensure accuracy in identifying users and processes Use Access Controls to enforce the what and how of security policy Use Alarms and Alerts to protect against attacks in progress Use Traffic Flow Security to protect against unwarranted inferences from heavy traffic * See Table 7­7, pages 454­457 in Pfleeger & Pfleeger, Security in Computing for full list 12 Architectural Controls Architectural Segmentation Segmentation Isolate key applications in separate network segments 1/12/2010 1/12/2010 Alternate segmentation mechanism: separate access by user function 13 Architectural Controls Architectural Redundancy Redundancy Find and eliminate single points of failure Make your network “failsafe” • Allows functions to be performed on more than one node • If one node fails, another takes over its processing responsibilities (failover mode) 1/12/2010 1/12/2010 14 Encryption Controls Two kinds of controls: • Link Encryption • End­to­end encryption Often combined with other controls Probably the most important and versatile tool for network security 1/12/2010 1/12/2010 15 Link Encryption 1/12/2010 1/12/2010 Protects a message in transit Message is in plaintext inside intermediate hosts Different routes for different packets give added protection Especially appropriate when transmission line is point of greatest vulnerability Usually performed on all links if it is performed at all 16 End-to-End Encryption 1/12/2010 1/12/2010 Protects a message in transit Protects a message inside intermediate hosts Applied to “logical links”­ channels between two processes above the physical path Can be applied selectively one application/message at a time See Table 7­5, page 435 in Pfleeger & Pfleeger, Security in Computing for full fuller comparison of Link Encryption vs. End to End Encryption 17 Virtual Private Networks (VPNs) An application of Link Encryption • Link encryption can give network users the sense that they are on a private network, even when their network is part of a public network Virtual Private Networks are created when a firewall interacts with an authentication service inside a network perimeter • Firewall sits between two networks or network segments • Firewall filters all traffic between a protected (“inside”) network and less trustworthy “outside” 1/12/2010 1/12/2010 18 Public Key Infrastructure (PKI) Another extension of Encryption Enables users to implement public key cryptography • Usually applied in a large, distributed setting Provides identification and access control on per user basis • • • • • Creates certificates associating user with her/his public key Passes out certificates from a database Signs certificates for added credibility Confirms or denies validity of certificates Invalidates certificates as appropriate Not a standard, but a set of policies, products and procedures with room for interpretation! 1/12/2010 1/12/2010 19 Other Encryption Controls SSH (Secure Shell) • Protects against spoofing attacks and modification of data in transit SSL (Secure Socket Layer) • Protects communication between a web browser and server Server Authentication Optional Client Authentication Encrypted channel between server and client • The most widely used secure communication protocol on the Internet 1/12/2010 1/12/2010 20 Coming Attractions – IP Security Coming Protocol (IPSec) Protocol Part of IPv6, being deployed Addresses issues with spoofing, eavesdropping and session hijacking Implemented at the IP layer • No changes required to TCP, UDP, and Applications layers Similar to SSL but greater flexibility Uses concept of a security association • The set of security parameters for a secured channel 1/12/2010 1/12/2010 Very efficient key management 21 Content Integrity Controls Encryption protects against malicious modification that changes content in a meaningful way Content integrity controls protect against: • Malicious or nonmalicious modification that changes content in a way that is not necessarily meaningful • Nonmalicious modification that changes content in a way that will not be detected Two kinds of Content Integrity Controls: • Error Correcting Codes Protect against modification during course of transmission, e.g. due to malfunctioning equipment, noise, etc. • Simplest – parity check • Others include hash codes and Huffman codes • Cryptographic Checksums (also called Message Digest) 1/12/2010 1/12/2010 Protects against attacker modifying the error detection mechanism along with the data itself 22 Strong Authentication Controls 1/12/2010 1/12/2010 Authentication is generally more difficult in a networked environment Both ends of a communication may need to be authenticated to each other 23 Strong Authentication Mechanisms • One­Time Passwords Based on use of a password token – a device that generates passwords in a way that cannot be predicted • Challenge­Response Systems 3 step process: 1) user authenticates, 2) remote system “challenges”, 3) device generates response to challenge which user then enters • Digital Distributed Authentication Can authenticate nonhuman entities using public/private asymmetric keys to establish secure channel using symmetric key • Kerberos 1/12/2010 1/12/2010 Designed to withstand attacks in distributed environments 24 Access Controls Access Control Lists (ACL) on Routers • Tends to degrade performance of router to unacceptable level • Logging would further degrade performance, but without logging, there is no way to know if anything is being blocked • Attacker disguises source address anyway Firewalls • More effective than ACLs on Routers • Can look at whole packet; not just source and destination 1/12/2010 1/12/2010 Alarms and Alerts – Intrusion Detection Systems placed inside a network Honeypots are designed to detect an attacker 25 Traffic Flow Security Control by disguising traffic flow • Pad traffic to ensure steady flow of traffic everywhere, or • Onion Routing A wraps message in package for D to send to B. A wraps message to D in package for C to send to D, and sends whole package to C. 1/12/2010 1/12/2010 26 Firewall The Firewall is: • Always invoked • Tamperproof • Small enough/simple enough for rigorous analysis Filters ALL traffic between protected network and less trusted network Usually runs on a dedicated device • No non­firewall functions on a firewall Protects only the perimeter of its environment • Only minor control exercised over content admitted 1/12/2010 1/12/2010 Firewalls are targets for attackers 27 Types of Firewalls Packet Filtering Gateways or Screening Routers • Blocks addresses in protected networks and/or certain protocols • Accepts/rejects on packet by packet basis Stateful Inspection Firewalls • Maintains state information from one packet to the next; defeats multiple packet attacks Application Proxies (Proxy Server) • Eliminates improper requests to applications • Any external transaction that requests something from the corporate network must enter through the proxy server • Proxy servers are more advanced but make external accesses slower Guards – extends concept of App Proxies Personal Firewalls • Runs on a workstation 1/12/2010 1/12/2010 • Each does different things • No one is “right” or “wrong” • Can be combined for stronger protection 28 Firewalls (continued) 1/12/2010 1/12/2010 29 Firewalls (continued) 1/12/2010 1/12/2010 30 Intrusion Detection Systems (IDS) Firewalls protect the perimeter, IDS take care of what gets in IDS cope with harm that cannot be prevented in advance (attacks in progress) IDS Functions • • • • • • • • 1/12/2010 1/12/2010 Monitoring users and system activity Auditing system configuration for vulnerabilities and misconfigurations Assessing integrity of critical system and data files Recognizing known attack patterns in system activity Identifying abnormal activity through statistical analysis Managing audit trails and highlighting user violation of policy or normal activity Correcting system configuration errors Installing and operating traps to record info about intruders No single IDS does all these functions 31 Intrusion Detection System Types Signature Based • Perform simple pattern matching and report matches • Attackers will try to mask signatures • First time attack with new signature cannot be detected Heuristic • Looks for behavior that is “out of the ordinary” • Limited by amount of information the system has seen • Most IDS run in stealth mode • Real systems typically blend the two types • All raise an alarm requir­ ing human intervention • Administrator tunes for acceptable level of false results 1/12/2010 1/12/2010 “Commercial IDS are pretty good at identifying attacks” 32 Secure E-Mail E­Mail is very public • Exposed at every point between sender’s workstation and recipient’s screen Secure E­Mail is about adding confidentiality and integrity protection Controls Against Threats Threats to E­Mail Messages • • • • • • • • • • 1/12/2010 1/12/2010 Interception (confidentiality) Interception (blocked delivery) Interception and subsequent replay Content modification Origin modification Content forgery by outsider Origin forgery by outsider Content forgery by recipient Origin forgery by recipient Denial of message transmission • • • • • • • • • • Encryption None Encryption plus protocol Encryption Public key encryption Encryption Public key encryption Public key encryption Public key encryption Public key encryption 33 Secure E-Mail Requirements Message Confidentiality Message Integrity Sender Authenticity Nonrepudiation • Not needed for every message • Ideal system allows selection of whatever is desired from above list 1/12/2010 1/12/2010 34 Design for Secure E-Mail Systems Standard developed by the Internet Society (ISOC) Design Goal: Allow security­enhanced messages to travel as ordinary messages through existing Internet • All protection occurs within the body of a message 1/12/2010 1/12/2010 35 The ISOC Secure E-Mail Process The Confidentiality Confidentiality 1. User encrypts entire message with a symmetric key 2. Sender encrypts the symmetric key using receivers public key and attaches to message* 3. Sender adds plaintext headers 3 2 1 Can use multiple encryption algorithms including DES, Triple DES, AES, RSA, and Diffie­Helman for key exchange Question: Does this provide for non­repudiation? A version is available that uses only symmetric keys, but requires previous agreement on a symmetric key between sender and receiver * 1/12/2010 1/12/2010 36 Secure E-Mail – Message Integrity Encrypted E­Mail messages ALWAYS carry a digital signature • Ensures authenticity and nonreupdiability of sender • Integrity is also ensured through a hash function in the digital signature (Message Integrity Check or MIC) 1/12/2010 1/12/2010 37 Secure E-Mail Issue – Key Secure Management Management Certificate Scheme (Chapter 2) works well for key exchange and associating an entity verifiably with a public key The issue is with building an acceptable hierarchy • Works fine within an organization • The problem is with interorganizational secure E­Mail 1/12/2010 1/12/2010 38 Secure E-Mail Programs PGP (“Pretty Good Privacy” • • • • Originally free Now commercial, but free package still available Works like the ISOC standard Addresses the key distribution issue through a “ring of trust” No mandated policy for establishing trust Each user decides how much to trust each key received S/MIME • • • The Internet standard for secure e­mail attachments Very similar to PGP Uses a different key exchange mechanism from PGP Uses hierarchically validated certificates • Likely to dominate the secure e­mail market 1/12/2010 1/12/2010 39 Network Security Protocols 1/12/2010 1/12/2010 Key Establishment Protocols Authentication Protocols Encryption Protocols Integrity Protocols 40 Components of Key Establishment Symmetric Key Cryptography (SKC) • Key Generation • Key Distribution Public Key Cryptography (PKC) • For two users communicating over an unsecure channel … 1/12/2010 1/12/2010 Both users establish a public key/private key pair At the end each user has a private key that has NEVER been transmitted Public key may be available to an eavesdropper An additional layer of security is needed to prevent “man­in­the­ middle” attacks 41 SKC Key Generation Basic Requirements • SKC Key must be random • SKC Key must be long enough to prevent a successful brute force attack Any random string or number can be used so long as: • Both communicating users know the key • ONLY both communicating users know the key 1/12/2010 1/12/2010 42 SKC Key Distribution Issue Replay The number of keys required in a Symmetric Key System can quickly become unmanageable • Number of keys required grows according to the square of the number of users Number of keys needed is n * (n­1) / 2 where n= No. of users • Each symmetric key must be kept secret! • Manual configuration of keys does not scale well • Manual configuration of keys is highly susceptible to human error 1/12/2010 1/12/2010 43 Most Common Approach to SKC Key Most Distribution Distribution Centralized Key Distribution Center • • • Trusted, centralized 3rd party Stores keys for all nodes in network Each node is configured with ONLY its own key Process 1. Alice establishes secure session with KDC using Alice’s SKC key and requests secure session with Bob 2. KDC establishes secure session with Bob, using Bob’s SKC key 3. KDC generates new session key and sends to both Alice and Bob 4. Bob and Alice use new key to generate a new secure session between them Major Drawbacks • • 1/12/2010 1/12/2010 SKC is a major bottleneck KDC represents a single point of failure 44 PKC Key Distribution Recall that one key is kept private • Never sent over the network Distribution of the public key is the issue Possible approaches: • Bob asks for Alice’s public key; she sends • Each user broadcasts their public key to all nodes Sounds logical; should not compromise security But it can compromise security • “Stay tuned” for why • Use a Certificate Authority (CA) – Trusted 3rd Party CA maintains public keys as part of a “Certificate” • Solves the problems associated with “broadcast to all nodes” Basic tenet of PKC: Security lies in the private key – not in the public key 1/12/2010 1/12/2010 45 “Secure” vs. “Trusted” Secure • Unchangeable ­ an absolute statement • No “shades of gray” Something is secure or it is not secure • Security is an aspect of Quality • Level of Security is an assertion by developer/designer/manufacturer Trusted • Often grows (or diminishes) with time based on: Evidence Experience • Meets intended security requirements • Quality is “high enough” • Users confidence in quality is justified • Level of Trust is an assessment by receiver/user 1/12/2010 1/12/2010 46 Certificates Digital certificate ­ electronic document, • Establishes credentials during transactions • Similar to a passport Typical digital certificate contains • • • • • 1/12/2010 1/12/2010 Your name, A serial number or other credential information Expiration date(s) of certificate Copy of your public key Digital signature of certificate­issuing authority. CA first computes hash of the above information CA then encrypts all with CA’s PRIVATE key CA maintains certificates in encrypted form 47 Use of a Certificate Authority (CA) Bob requests Alice’s Certificate CA sends to certificate to Bob encrypted with CA’s private key Bob decrypts certificate with CA’s public key CA’s public key is WELL­KNOWN • • • No one else can forge Alice’s certificate Bob has CA’s public key Bob trusts CA Bob can get any users public key securely from CA providing: CA approach eliminates possibility of man­in­ the­middle attack 1/12/2010 1/12/2010 48 Reference Organization 1/12/2010 1/12/2010 49 Signed Certificates 1/12/2010 1/12/2010 50 In Class Exercise Referring to the organization chart #19 create a certificate for Mukesh, including the passing it up through the various people who add information to the certificate all the way up to the President. Make up the first 8 hex characters of Mukesh’s and Debbie’s public keys and their 5 character hashes but use the other values from #20. write your results below and submit it when you have finished. 1/12/2010 1/12/2010 51 Observations on Public Key Distribution Observations by Certificate Authority by Each node must KNOW CA’s public key • Configure each node separately or • Publish CA’s public key in a “well­known” medium CA is still a single point of failure • Similar to KDC in this regard CA is not actively involved in user sessions • Not a performance bottleneck System is secure so long as CA’s private key cannot be obtained by an attacker • Impossible to issue “false” certificates 1/12/2010 1/12/2010 52 Recall - Principles of Asymmetric Key Recall Cryptography (ASK) Cryptography Mathematical Representation of ASK: • DKd(EKe(M))=M Exploits math of trapdoor one­way functions Property of one way function f(x) • Easy to compute f(x), if you know x • Extremely difficult to compute x if you know f(x) • New Example: f(x) = gx (Relatively easy to compute) Inverse involves doing discrete logarithms (very difficult) Properties of trapdoor one­way function • Easy to compute f(x), IF you know x • Extremely difficult to compute x if you know f(x) UNLESS you know some secret ­ y • Mathematical Representation of Trapdoor Functions 1/12/2010 1/12/2010 x f(x) :: Easy f(x) x :: Very Difficult f(x) + Y x :: Easy 53 Diffie-Hellman Key Exchange 1. 2. 3. 4. 5. A selects large prime n, generator g, and random number x A computes: Sx = gx mod n A sends Sx, g and n to B B generates random y, computes gy mod n and sends result (Sy) to A A computes (Sy)x = gxy mod n B computes (Sx)y = gxy mod n Now A and B both know Sxy = gxy mod n, the shared secret key (Alice) 1/12/2010 1/12/2010 •Only A knows x •Only B knows y •g, n, Sx, and Sy are not kept secret •It is very hard for E to compute x or y (requires discrete logarithms) (Bob) 54 Diffie-Hellman is Susceptible to Man-InThe-Middle Attacks A sends g, n, Sx Eve captures 1. Eve sends g, and n but a different S, Sk to B. Only Eve knows k 1. 1. 1. 1. (Alice) A and E have shared secret gxp mod n 1. B and E have shared secret gky mod n (Eve) • • • • 1/12/2010 1/12/2010 Eve sends a different S, Sp to A. Only Eve knows p Bob sends Sy to A but it doesn’t reach A. Eve captures Sy A and B think they are talking to each other E can eavesdrop without A’s or B’s knowledge E can hijack the two sessions completely Attack works because of lack of separate authentication mechanism between A and B (Bob) 55 Enhanced Diffie-Hellman Key Enhanced Exchange (Static) Exchange Generator g, and large prime n are fixed 2. CA creates two certificates of form EkiCA{gxmod n, Alice} for Alice and EkiCA{gymod n, Bob} for Bob 3. Alice knows her private key x. She derives Sy from Bob’s certificate and computes (Sy)x 4. Bob knows his private key y. He derives Sx from Alice’s certificate and computes (Sx)y Now A and B both know Sxy = gxy mod n, the shared secret key 1. (Alice) 1/12/2010 1/12/2010 •Only A knows x •Only B knows y •g, n, Sx, and Sy are all kept secret •Man­in­the­middle attack is defeated (Bob) 56 Enhanced Diffie-Hellman Key Enhanced Exchange (Dynamic) Exchange Generator g, and large prime n are established dynamically 2. CA creates two certificates of form EkiCA{g, n, gxmod n, Alice} for Alice and EkiCA{g, n, gymod n, Bob} for Bob 3. Alice knows her private key x. She derives Sy from Bob’s certificate and computes (Sy)x 4. Bob knows his private key y. He derives Sx from Alice’s certificate and computes (Sx)y Now A and B both know Sxy = gxy mod n, the shared secret key 1. (Alice) 1/12/2010 1/12/2010 •Only A knows x •Only B knows y •g, n, Sx, and Sy are all kept secret •Man­in­the­middle attack is defeated (Bob) 57 Rivest-Shamir-Adelman (RSA) Rivest-Shamir-Adelman Encryption Encryption Combines number theory with the difficulty in computing the prime factors of large numbers Two keys for encryption • Interchangeable; either key can be the public key • Once chosen, the other key must be kept private • Keys can be applied in either order: each key “undoes the other” Newer, more powerful, and more generic than Diffie­Hellman • Can be used for encryption • Can be used for digital signatures (integrity) 1/12/2010 1/12/2010 58 Authentication and Authentication Authentication Protocols Authentication 1/12/2010 1/12/2010 59 Authentication: Important Definitions Authentication = The Process of Verifying that a node or user is who they claim to be One primary use = reliable implementation of access control • Access control = a primary defense mechanism in network security • Builds inherent protection into system 1/12/2010 1/12/2010 60 Address-Based Authentication Each node has an address Allow only a predetermined set of addresses access in or out of network • First step in controlling access • Assumes user = node address Typically uses MAC or IP address Weaknesses: • User = Node may not be good assumption • Assumes MAC or IP address is fixed Assumes can’t be altered or spoofed (bad assumption) • MAC address may be harder to spoof • Spoofing an IP address is usually trivial 1/12/2010 1/12/2010 • Not sufficient by itself • Good deterrent when used with other access control mechanisms •Example: Authentication Protocols 61 User Authentication Much of the protection that a Network OS can provide depends on knowing who the user is General authentication can be based on: • • • 1/12/2010 1/12/2010 Something only the user knows Something only the user has (e.g. badge) Something only the user is (identifying characteristic) 62 Passwords 1/12/2010 1/12/2010 The most common method for user ID Can be reasonably secure • System should require <ID, password> pair to be entered BEFORE giving any feedback • Additional information known only to user can be required for increased security Challenge/Response mechanism add­on can add significantly to level of trust Human shortcomings can seriously degrade the level of protection • Too easy to guess, i.e. “weak” passwords 63 Most Common Methods of Attacks Most on Passwords on Brute Force Attack: Try all possible passwords 1/12/2010 1/12/2010 Try many possible passwords Try passwords most likely for the user Search system for list of passwords Ask the user Decreasing difficulty • Will always work • Usually too time consuming for the attacker 64 Time to Search All Possible Time Passwords Passwords Number of passwords of length 3 characters or less = 18,278 • 18.278 seconds to check at one password per millisecond Passwords of length 4 characters or less • About 4 minutes to check Passwords of length 5 characters or less • About 3.5 hours to check All words in 80,000 word English dictionary of most common words • 80 seconds 1/12/2010 1/12/2010 65 In Class Exercise In 1/12/2010 How long would it take to check all passwords of length 6 characters or less consisting of lowercase Latin alphabetic characters + numbers from 0 to 9 at 200 passwords checked per microsecond? Show your calculations and write your answer below and submit. 66 Answer to Class Exercise Answer Number of passwords of length 6 or less = 361 + 362 + 363 + 364 + 365 + 366 = 36 + 1296 + 46,656 + 1,679,616 + 60,466,176 + 2,176,782,336 = 2,238,976,116 ≈ 2.239 x 109 2.239 x 109 passwords / 200 password/10­6 second = 2.23 X 10 seconds = 22.39 seconds Note: 3 GHz processor can execute around 5 X 109 instructions per second. Assume 10 instructions to test one password ­> 2 X 108 passwords / second or 200 passwords per microsecond 1/12/2010 67 Password Selection Disciplines Use characters other than just A­Z Choose long passwords Avoid actual names or words • 300 million theoretical “words” of length 6, but only 150,000 in a good collegiate dictionary Choose an unlikely password Change the password regularly • The longer it is in use, the longer an attacker has to try to guess it 1/12/2010 1/12/2010 Don’t write it down Don’t tell anyone else 68 Wh4t Sh0u1d Hum4n5 D0? Think about 7­8 word phrase Select number, character, special character for letters Mix lower case and upper case Stronger Passwords • Can still be remembered 1/12/2010 1/12/2010 “Eselsbrücke“ – a way to remember Example: Phrase – “I will learn 10x new security techniques in 2007.” Password extracted – 1wL10*n3t2k7 69 Class Exercise Class 1/12/2010 Try out the approach on the last slide. Submit your phrase and password, and let’s discuss 70 ...
View Full Document

{[ snackBarMessage ]}

Ask a homework question - tutors are online