Outline
•
Cryptography•
Attacks•
Security Properties•
Cryptographic Functions•
What is a security protocol ?•
Introduction to Scyther toolWafa Badreddine ProgRes - 4I014
What’s Cryptography ?
•
Cryptography = the science (art) of encryption•
Cryptanalysis = the science (art) of breaking encryption•
Cryptology = cryptography + cryptanalysis!3
Security Attacks
•
Passive attacks•
Obtain message contents•
Monitoring traffic flows•
Active attacks•
Replay previous messages•
Modify messages in transmit•
Add, delete messagesWafa Badreddine ProgRes - 4I014
Cryptography Goals (Security Properties)
•
Confidentiality (secrecy)•
Prevent Z from intercepting and reading the message content•
Only Alice and Bob should be able to understand the contents of the transmitted message!5
•
Authentification:•
Prevent Z from impersonating Alice Or Bob•
Both Alice and Bob need to confirm the identity of other entity involved in the communication•
Cryptography Goals (Security Properties)
Wafa Badreddine ProgRes - 4I014
•
Data Integrity:•
Prevent Z from modifying the message content•
The content of their communication is not altered, either maliciously or by accident, in transmission!7
Cryptography Goals (Security Properties)
•
Non-repudiation:•
An entity (Alice or Bob) is prevented from denying its previous commitments or actionsCryptography Goals (Security Properties)
Wafa Badreddine ProgRes - 4I014
How to ensure these security
properties during a communication between Alice & Bob ?
!9
Cryptographic Functions
•
Symmetric Cryptography: Secret key functions•
Asymmetric Cryptography: Public/Secret key functions•
Hash functionsSymmetric Cryptography
Symmetric Cryptography
•
Using a single key for encryption/decryption•
The plaintext and the ciphertext have the same sizeWafa Badreddine !13 ProgRes - 4I014
Symmetric Cryptography: Security Properties
•
Confidentiality: Prevent attackers from eavesdropping, only the entities knowing the key can decrypt it•
Authentication: Alice proves to Bob that she knows the keyAsymmetric Cryptography
Asymmetric Cryptography
•
Each individual has two keys•
a private key (d): not revealed to anyone•
a public key (e): preferably known to the entire worldWafa Badreddine !17 ProgRes - 4I014
Asymmetric Cryptography: Security Properties
•
Confidentiality: Nobody else can decrypt it•
Authentication: How it is ensured ? If the key of encryption is public?•
The public key is certified by a Certification Authority (CA)•
The public key is obtained from an electronic certificateWafa Badreddine !19 ProgRes - 4I014
How to guarantee the identity linked to the public key?
Electronic Certificate
Wafa Badreddine !21 ProgRes - 4I014
•
Digital Signatures•
Proving that a message is generated by a particular individual•
Non-repudiation: the signing individual can not be denied, because only him/her knows the private keyHash Functions
Hash Functions
•
A mathematical transformation that takes a message of arbitrary length and computes it to a fixed-length(short) numberWafa Badreddine ProgRes - 4I014
•
Let the hash of a message m be h(m)•
For any m, it is relatively easy to compute h(m)•
It is impossible to find m from h(m)•
It is computationally infeasible to find two values that hash to the same thing➡
Hash functions ensures message integrity!25
Security Protocol
Wafa Badreddine ProgRes - 4I014
Security protocol:
a set of crypto-primitives exchanged between the communication actors
!27
What is a security protocol ?
What is a security protocol ?
Example 1:
Wafa Badreddine !29 ProgRes - 4I014
Example 2: TLS (overview) (next course)
Scyther Tool
Wafa Badreddine ProgRes - 4I014
Introduction
•
Scyther is a tool for the automatic verification, falsification and the analysis of security protocols•
Verify the correctness of the security protocol written in Scyther•
Analyze security protocols to identify potential attacks and vulnerabilities, able to detect several possible attacks•
Generate a graph for each attack corresponding to the mentioned claim•
Scyther can be freely downloaded•
The latest stable version of Scyther is v1.1.3, which was released on April 4, 2014!31
•
The tool can be used in three ways:•
Verify whether the security claims in the protocol description hold or not•
Automatically generate appropriate security claims for a protocol and verify them•
A n a l y z e t h e p r o t o c o l b y p e r f o r m i n g c o m p l e t e characterization.Wafa Badreddine ProgRes - 4I014
•
Verification of claims•
The input language of Scyther allows for specification of security properties in terms of claim events•
i.e., in a role specification one can claim that a certain value is confidential (secrecy) or certain properties should hold for the communication partners (authentication).➡
Scyther can be used to verify these properties or falsify them.!33
•
Automatic claims:•
If the protocol specification contains no security claims,➡
Scyther can automatically generate claims.•
At the end of each role, authentication claims are added, claiming that the supposed communication partners must have performed the protocol as expected.•
Similarly, secrecy claims are added for all locally generated values (nonces) and variables.•
This augmented protocol description is then analyzed by Scyther as in the previous case (Verification of claims).Wafa Badreddine ProgRes - 4I014
•
Characterization:•
For protocol analysis, each protocol role can be “characterized”•
Scyther analyzes the protocol, and provides a finite representation of all traces that contain an execution of the protocol role.•
In most cases, this representation consists of a small number (1-5) of possible execution patterns. By manually inspecting these patterns, one can quickly gain insight in the potential problems with the protocol and modify it if necessary.•
For example, given the Needham-Schroeder protocol, Scyther determines that there are only two patterns for the responder role:•
one is the correct behaviour of the protocol,•
the other is the well-known man-in-the-middle attack.•
Hence, there are no other possible ways of executing the responder role.!35
•
The tool provides a graphical user interfaceWafa Badreddine ProgRes - 4I014
•
Language used to write protocols in Scyther is:•
Security Protocol Description Language (SPDL)•
Each actor of the security protocol is written in a role with SPDL•
The targeted security properties are verified thanks to the Scyther claims!37
Fonction de hachage
Nouveau Type
Variables et leurs types (locales)
Fresh: Aléatoire Nonce: Une seule fois
Actions
Wafa Badreddine ProgRes - 4I014
•
For authentication & non-repudiation between A and B:•
Alive: Aliveness•
Weakagree: Weak agreement•
Nisynch: Non-injective synchronization•
Niagree: Non-injective agreement!39
What are Scyther claims? (Formal Definitions)
•
Alive: Aliveness•
A protocol guarantees to an initiator A « aliveness » of an agent B if, whenever A (acting as initiator) completes a run of the protocol, apparently with responder B, then B has previously been running the protocol.Wafa Badreddine ProgRes - 4I014
•
weakagree: weak agreement•
A protocol guarantees to an initiator A « weak agreement » with another agent B if, whenever A (acting as initiator) completes a run of the protocol, apparently with responder B, then B has previously been running the protocol, apparently with A. Note that B may not necessarily have been acting as responder!41
•
Niagree: Non-injective agreement•
A protocol guarantees to an initiator A « non-injective agreement » with a responder B, on a set of data items ds (where ds is a set of free variables appearing in the protocol description)•
If, whenever A (acting as initiator) completes a run of the protocol, apparently with responder B, then B has previously been running the protocol, apparently with A, and B was acting as responder in his run and the two agents agreed on the data values corresponding to all the variables in ds.Wafa Badreddine ProgRes - 4I014
•
Nisynch: Non-injective synchronization•
Ensures that messages are transmitted exactly as prescribed by the protocol.•
whenever A (initiator) completes running the protocol with B (responder) and B has been running the protocol with A, then, all messages are received exactly as they were sent, in the exact order described by the protocol•
It is a Strong Authentication!43
•
For Confidentiality•
Secret•
For authentication & non-repudiation between A and B:• Nisynch: Non-injective synchronization
• Niagree: Non-injective agreement
• Alive: Aliveness
• Weakagree: Weak agreement
Wafa Badreddine !45 ProgRes - 4I014
Few seconds :-)
Wafa Badreddine !47 ProgRes - 4I014
Attack i1
Attack i2
Wafa Badreddine !49 ProgRes - 4I014
Attack i3
