Transcript Overview of Key Establishment Techniques: Key Distribution, Key Agreement and PKI Wade Trappe.

Overview of Key Establishment
Techniques:
Key Distribution, Key Agreement and PKI
Wade Trappe
Lecture Overview

We now begin our look at building protocols using the basic
tools that we have discussed.

The discussion in this lecture will focus on issues of key
establishment and the associated notion of authentication

These protocols are not real, but instead are meant to serve just
as a high-level survey

Later lectures will go into specific protocols and will uncover
practical challenges faced when implementing these protocols
Key Establishment: The problem

Securing communication requires that the data is encrypted
before being transmitted.

Associated with encryption and decryption are keys that must be
shared by the participants.

The problem of securing the data then becomes the problem of
securing the establishment of keys.

Task: If the participants do not physically meet, then how do the
participants establish a shared key?

Two types of key establishment:
– Key Agreement
– Key Distribution
Key Distribution



Key Agreement protocols: the key isn’t determined until after
the protocol is performed.
Key Distribution protocols: one party generates the key and
distributes it to Bob and/or Alice (Shamir’s 3pass, Kerberos).
Shamir’s Three-Pass Protocol:
– Alice generates a  Z*p and Bob generates b  Z*p .
– A key K is distributed by:
Alice
K1  K a mod p
K 2  K1b mod p
1
a
K3  K 2  mod p
Bob Calculates:
1
b
K  K3  mod p
Bob
Basic TTP Key Distribution
KDC
Kb
Ka
Step 1Step 2
Step 3
Step 4
Step 5
1. A Sends: {Request || IDA || IDB || N1}
2. KDC Sends: EKa[ KAB|| {Request || IDA || IDB || N1}||EKb(KAB, IDA)]
3. A Sends: EKb(KAB, IDA)
4. B Sends: EKAB(N2)
5. A Sends: EKAB(f(N2))
Key Agreement



In many scenarios, it is desirable for two parties to exchange
messages in order to establish a shared secret that may be used
to generate a key.
The Diffie-Hellman (DH) protocol is a basic tool used to
establish shared keys in two-party communication.
Two parties, A and B, establish a shared secret by:
A  B : g a mod p
  mod p  g
A: g

b a
B  A : g b mod p
ab
mod p
  mod p  gab mod p
B: g
a b
The security of the DH scheme is based upon the intractibility
of the Diffie-Hellman Problem:
a
Given a prime p, a generator g of Z*p, and elements g mod p and g b mod p ,
it is computationally difficult to find g ab mod p.
Intruder In The Middle

The Intruder-in-the-Middle attack on Diffie-Hellman is based upon
the following strategy to improve one’s chess ranking:
– Eve challenges two grandmasters, and uses GM1’s moves against GM2.
Eve can either win one game, or tie both games.

Eve has z  Z*p and can perform the Intruder-in-the-Middle attack by:
Alice
Eve
g a mod p
Begins DH
g z mod p
Calculates
  mod p
K AE  g
az
Encrypts data
with KAE
EK AE DATA 
Bob
g b mod p
Calculates
K AE , K BE
Decrypts data
with KAE, uses
data and
encrypts with
KBE
Begins DH
g z mod p
Calculates
 
z
K BE  g b mod p
EK BE DATA 
Decrypts data
with KBE
Station-to-Station Protocol

Digital signatures can be used to prevent this protocol failure (STS
Protocol).

A digital signature is a scheme that ties a message and its author
together.
– Private sig( ) function and Public ver( ) function.
Alice
g a mod p
Bob
 
g b mod p , E K sig B g b , g a

Calculates
  mod p
K g
a b
Calculates
 a
sig B g b , g a 
K  g b mod p
Decrypts to get:
Verifies sig
 
E K sig A g a , g b

Verifies sig
Distribution of Public Keys

There are several techniques proposed for the distribution of
public keys:
– Public announcement
– Publicly available directory
– Public key authority
– Public key certificates
Public Announcement



Idea: Each person can announce or broadcast their public key to
the world.
Example: People attach their PGP or RSA keys at the end of
their emails.
Weakness:
– No authenticity: Anyone can forge such an announcement
– User B could pretend to be User A, but really announce User B’s
public key.
Public Directory Service


Idea: Have a public directory or “phone book” of public keys.
This directory is under the control/maintenance of a trusted third
party (e.g. the government).
Involves:
– Authority maintains a directory of {name, PK}
– Each user registers public key. Registration should involve
authentication.
– A user may replace or update keys.
– Authority periodically publishes directory or updates to directory.
– Participants can access directory through secure channel.

Weaknesses:
– If private key of directory service is compromised, then opponent
can pretend to be directory service.
– Directory is a single point of failure.
Public Key Authority

Idea: More security is achieved if the authority has tighter
control over who gets the keys.

Assumptions:
– Central authority maintains a dynamic directory of public keys of
all users.
– Central authority only gives keys out based on requests.
– Each user knows the public key of the authority.

Weaknesses:
– Public Key Authority is a single point of failure.
– User has to contact PK Authority, thus the PK Authority can be a
bottleneck for service.
Public Key Authority, protocol
PK Auth
Step 4
A
Step 1Step 2
Step 5
Step 3
Step 6
Step 7
1. A Sends: {Request || Time1}
2. PK Auth: EdAuth[ eB|| {Request || Time1}]
3. A Sends B: EeB(IDA||N1)
4 and 5. B does steps 1 and 2.
6. B Sends: EeA(N1||N2)
7. A Sends: EeB(N2)
B
Public Key Certificates


Idea: Use certificates! Participants exchange keys without
contacting a PK Authority in a way that is reliable.
Certificates contain:
– A public key (created/verified by a certificate authority).
– Other information.




Certificates are given to a participant using the authority’s
private key.
A participant conveys its key information to another by
transmitting its certificate.
Other parties can verify that the certificate was created/verified
by the authority.
Weakness:
– Requires secure time synchronization.
Public Key Certificates, overview
Cert Auth
Give eA securely to CA
A
Securely give eB to CA
CertB = EdAuth{Time2||IDB||eB}
CertA = EdAuth{Time1||IDA||eA}
CertA
Cert B
Requirements:
•Any participant can read a certificate to determine the name and public key of the certificate’s
owner.
•Any participant can verify that the certificate originated from the certificate authority and is not
counterfeit.
•Only the certificate authority can create and update certificates.
•Any participant can verify the currency of the certificate.
B
X.509 PK Certificates


X.509 is a very commonly used
public key certificate framework.
The certificate structure and
authentication protocols are used
in:
– IP SEC
– SSL
– SET

X.509 Certificate Format:
– Version 1/2/3
– Serial is unique within the CA
– First and last time of validity
Version
Cert Serial #
Algorithm & Parms
Issuer Name
Validity Time:
Not before/after
Subject Name
PK Info: Algorithm,
Parms, Key
...
Signature (w/ hash)
X.509 Certificate Chaining





Its not feasible to have one CA for
a large group of users.
Suppose A knows CA X1, B knows
CA X2. If A does not know X2’s
PK then CertX2(B) is useless to A.
If X1 and X2 have certified each
other then A can get B’s PK by:
– A obtains CertX1(X2)
– A obtains CertX2(B)
– Because B has a trusted copy
of X2’s PK, A can verify B’s
certificate and get B’s PK.
Certificate Chain:
– {CertX1(X2)|| CertX2(B)}
Procedure can be generalized to
more levels.
CertX1(X2)
CertX2(X1)
X1
X2
A
B
{CertX1(X2)|| CertX2(B)}