PROTOCOLS etc. Cryptographic protocol: A set of specified steps (involving cryptographic tools) taken by two or more parties in order to accomplish a specified goal (and thus solves some problem). * Typically cryptography is used to solve problems involving secrecy, authentication, integrity, and adversarial or dishonest people of all sorts. * A protocol involves two or more parties. which may be people or machines * One person can execute an algorithm, but generally not a protocol (except perhaps in cases of split personality or time travel) * Everyone involved in a protocol knows all the steps. * Everyone agrees to follow it. * A protocol is complete - there is supposed to be a specified action for every situation that may arise. * Each step generally involves some sort of computation or transmission of information. * Parties in a protocol may be friends, deadly adversaries, nearly anonymous business transactors, or trust-but-verify acquaintances. * Goals (beyond simple secrecy) can involve sharing strictly limited information jointly producing a secret that none can do individually convincing each other of their identity simultaneously signing a contract... * And doing so in a way that prevents or detects cheating, eavesdropping, and generally prevents damage from malicious or negligent behavior. BASIC PRINCIPLE: It should not be possible to do more or learn more than is specified by the protocol. * Lots of protocols in daily life: paying for goods at a store playing poker talking on the phone voting in an election * Many of these rely on face-to-face presence and social structures for their security. * Anonymity and deception are, in may ways, much easier to accomplish on a computer network than in person, as we have not yet have thousands of years of social evolution to learn how to deal with them. * We must deal with the near certainty that some of the people we deal with on computer networks, the managers, and even the designers of some networks, may not be honest. * Formal protocols allow us to examine ways in which they can be subverted, and take steps to guard against this. * Also allow abstraction of a process from its implementation. The players: (compliments of Bruce Schneier) Alice: First participant (A) in protocols Bob: Second participant (B) in protocols Carol: Participant (C) in three and four party protocols Dave: Participant (D) in four party protocols (or maybe teD) Eve: Evil Eavesdropper Mallory: Malicious (Man-in-the-Middle) active attacker Trent: Trusted arbitrator Walter: Warden - guards Alice and Bob in some protocols Peggy: Prover Victor: Verifier Types of protocols A. Arbitrated protocols: A disinterested party, known to and trusted by both Alice and Bob acts as intermediary to make it difficult for Alice and Bob to cheat each other. For example, in real life a lawyer might help Bob buy a car from Alice when Bob does not trust Alice to give him the title, and Alice does not trust Bob to give her a valid check, using the following protocol 1. Alice give the title to the lawyer (Trent) 2. Bob gives the check to Alice 3. Trent waits a specified time for the check to clear, and then gives the title to Alice. 4. If the check does not clear within the specified time, Alice presents proof of this to Trent, who returns the title. A notary public is another sort of arbitrator - one who can attest to the validity of a signature, for example. Arbitrators can work on computer networks, and there are many examples of arbitrated protocols, but there are some problems * People may find it more difficult to trust a faceless something on the net, than a human they can meet face to face. (though they might eventually build up trust in some agent if they could be sure that was whom they were dealing with) * There is some overhead cost in maintaining an arbitrator - possibly high if a human is involved - that must be paid somehow. * Arbitrated protocols have an inherent delay * The arbitrator is a bottleneck * The arbitrator is target for anyone attempting to subvert the network, and annoyingly large amounts of damage could result if the arbitrator were subverted. B. Adjudicated protocols Basically a potentially arbitrated protocol, where the arbitrator, here called an adjudicator (or judge) is called in only in the case of a dispute. What is needed here is a protocol that leaves enough of a paper (or electronic) trail to allow a judge to make a decision. For example, Alice and Bob might draw up a contract agreeable to both of them, sign it, and maybe even get a couple of friends on each side to witness the signing. Both keep a copy. Later, if there is a dispute, both can present their evidence, and call witnesses, before a judge. C. Self-enforcing protocols The idea is that the protocol itself guarantees fairness, prevents disputes, and detects any attempt to cheat in time to allow the protocol to be terminated without the cheater gaining an advantage. This is the most desirable situation, but also more difficult to achieve, and such protocols are not known for all problems Attacks on protocols * Passive attacks A third party (Eve) eavesdrops on some or all of the protocol, and attempts to obtain information they are not intended to have. Generally difficult to detect, (except in the case of certain quantum communication techniques), so generally protocols are designed to be as secure as possible against it. Different levels of eavesdropping: Does Eve see only communication sent between parties? or is she also watching keystrokes or reading decrypted messages?. * Active attacks A third party (Mallory) attempts to alter the protocol to his own advantage - pretending to be someone else, intercepting and retransmitting messages, or retransmitting altered versions, changing information stored in a computer, etc. Goals could be corrupting information, obtaining unauthorized information, disrupting service etc. etc. Mallory might be anyone, up to and including the system administrator. * Cheaters One (or more) parties in the protocol might attempt to subvert the protocol to gain more information or to accomplish something more than than is specified by the protocol. There can be passive cheaters, who follow the protocol, but attempt to gain extra information, and active cheaters, who disrupt the protocol in an attempt to accomplish their nefarious ends. It is (unsurprisingly) hard to make a secure protocol if most participants are active cheaters... Cryptographic tools employed in protocols 1. Symmetric cryptosystems (DES etc.) We know a bit about these already. Summary of main points * Security should lie in the key * Keys must be distributed in secret, and are as valuable as all the information they encrypt * Having a key compromised (broken, stolen, extorted, bribed) permits all sorts of mayhem through messages read, and messages faked, * N users need O(n^2) keys to communicate securely. 2. One-way functions * Functions that are easy to compute, but hard to invert. * Lots of proposed one-way functions, many do seem hard to invert, but there are lots of examples of ideas that looked good and were later broken. * No proof that any actually exist. 3. Trap-door one-way functions * Functions that are one-way, unless one knows the secret that allows them to be inverted. * Such functions are at the heart of public key systems such as RSA * Difficulty of factoring, discrete logs, various NP complete problems have been used as a basis for trapdoor functions. * Again, no mathematical proof that such functions actually exist. 4. One-way hash functions * One way functions that map plaintexts (preimages) of arbitrary size many-to-one to a fixed size output string or "fingerprint" in a way that makes it difficult to find a preimage that matches any particular fingerprint. * Other names: compression function, contraction function, message digest, fingerprint, cryptographic checksum, message integrity check (MIC), manipulation detection code (MDC)... * Many uses in cryptographic protocols, some suggested by preceding names. * Basic utility is in verifying that someone has a particular object without actually sending a full description of the object. * Fingerprint size must be long enough to prevent brute-force searches for messages that produce a given fingerprint. * Must not only prevent arbitrary inversion, but prevent generation of two (related) messages that generate the same fingerprint. * A Message Authentication Code (MAC) is a one-way hash function that can only be verified using a secret key. 5. Public-key cryptosystems (RSA etc.) We know a bit about these already as well. Summarizing the main points. * Each person has a public key, and a private key. Standard use is that Alice encrypts a message for Bob using Bob's public key, and Bob decrypts it with his private key * Often the public and private keys can both encrypt and decrypt, so that they can be used (e.g.) for digital signatures as well as message encryption. (more on this later) * Easily extended to networks of many users with only O(n) keys needed for secure communication among n users. * Public-key systems are slow compared to symmetric systems (by a factor of 1000 or more). They are also vulnerable to chosen plaintext attack if the number of possible messages is modest. 6. Hybrid cryptosystems (PGP etc.) * Public key system is used to exchange a "session key" for a symmetric system, which is then used to encrypt and transmit the bulk of the data. * Reduces problems of key distribution, and amount of potential damage if symmetric key is compromised without incurring cost of using public key system for all encryption. * Simplest protocol 1. Bob sends Alice his public key (or she gets it from a database) 2. Alice generates a random session key, encrypts it with Bob's private key, and sends it to Bob. 3. Bob decrypts Alice's message using his private key to recover the session key 4. Alice and Bob encrypt further communication using the session key and a symmetric system.