Network systems security by mort anvari lecture13

Web Security Network Systems Security Mort Anvari Web Security    Web is now widely used by business, government, and individuals But Internet and Web are vulnerable Have a variety of threats      integrity confidentiality denial of service authentication Need to add security mechanisms 10/19/2004 TCP/IP Protocol Stack Application Layer Transport Layer Network Layer • Each layer interacts with neighboring layers above and below • Each layer can be defined independently • Complexity of the networking is hidden from the application Data Link Layer 10/19/2004 Security At What Level?    Secure traffic at various levels in the network Where to implement security? Depends on the security requirements of the application and the user Basic services need to be implemented:      Key management Confidentiality Nonrepudation Integrity/authentication Authorization 10/19/2004 TCP/IP Protocol Stack   Provides services to the application layer Services:  Connection-oriented or connectionless transport  Reliable or unreliable transport  Security 10/19/2004 Application Layer Transport Layer Internetwork Layer Network Access Layer Transport Layer Security  Advantages:   Does not require enhancement to each application Disadvantages:    Obtaining user context gets complicated Protocol specific > need to duplicated for each transport protocol Need to maintain context for connection (not currently implemented for UDP) 10/19/2004 Transport Layer Security Protocols  Connectionless and connection-oriented transport layer service:  Security Protocol (SP4) – NSA, NIST  Transport Layer Security (TLSP) – ISO  Connection-oriented transport layer service:  Encrypted Session Manager (ESM) – AT&T Bell Labs  Secure Socket Layer (SSL) – Netscape Communications  Transport Layer Security (TLS) – IETF TLS WG Most popular transport layer security protocols 10/19/2004 SSL  SSL versions:  1.0: serious security flaws – never released to public  2.0: some weaknesses (man-in-the-middle attack) – in Netscape Navigator 1.0-2.x  3.0: no serious security flaws – in Netscape Navigator 3.0 and higher, MS Explorer 3.0 and higher 10/19/2004 SSL     Intermediate security layer between the transport layer and the application layer Based on connection-oriented and reliable service (e.g., TCP) Able to provide security services for any TCPbased application protocol, e.g., HTTP,FTP, TELNET, POP3, etc Application independent 10/19/2004 SSL Services   SSL provides  Client- server authentication (public-key cryptography)  Data traffic confidentiality  Message authentication and integrity check SSL does not provide  Traffic analysis  TCP implementation oriented attacks 10/19/2004 10 SSL Alert Protocol   Use two-byte message to convey SSL-related alerts to peer entity First byte is severity level   Second byte is specific alert    warning(1) or fatal(2) Always fatal: unexpected_message, bad_record_mac, decompression_failure, handshake_failure, illegal_parameter Other alerts: close_notify, no_certificate, bad_certificate, unsupported_certificate, certificate_revoked, certificate_expired, certificate_unknown Compressed and encrypted like all SSL data 10/19/2004 20 SSL Handshake Protocol  Allow server and client to     authenticate each other negotiate encryption and MAC algorithms negotiate cryptographic keys to be used Comprise a series of messages in phases     Establish Security Capabilities Server Authentication and Key Exchange Client Authentication and Key Exchange Finish 10/19/2004 21 SSL Handshake Messages 10/19/2004 22 SSL Handshake C  S: S  C: C  S: S  C: 10/19/2004 CLIENTHELLO SERVERHELLO [CERTIFICATE] [SERVERKEYEXCHANGE] [CERTIFICATEREQUEST] SERVERHELLODONE [CERTIFICATE] CLIENTKEYEXCHANGE [CERTIFICATEVERIFY] CHANGECIPHERSPEC FINISH CHANGECIPHERSPEC FINISH 23 C  S: CLIENTHELLO SSL Handshake   CLIENTHELLO message is sent by the client  When the client wants to establish a TCP connection to the server,  When a HELLOREQUEST message is received, or  When client wants to renegotiate security parameters of an existing connection Message content:  Number of highest SSL understood by the client  Client’s random structure (32-bit timestamp and 28-byte pseudorandom number)  Session ID client wishes to use (ID is empty for existing sessions)  List of cipher suits the client supports  List of compression methods the client supports 10/19/2004 24 S  C: SERVERHELLO [CERTIFICATE] [SERVERKEYEXCHANGE] [CERTIFICATEREQUEST] SERVERHELLODONE SSL Handshake   Server processes CLIENTHELLO message Server Respond to client with SERVERHELLO message:  Server version number: lower version of that suggested by the client and the highest supported by the server  Server’s random structure: 32-bit timestamp and 28byte pseudorandom number  Session ID: corresponding to this connection  Cipher suite: selected by the server for client’s list  Compression method: selected by the server from client’s list 10/19/2004 25 S  C: SERVERHELLO [CERTIFICATE] [SERVERKEYEXCHANGE] [CERTIFICATEREQUEST] SERVERHELLODONE } SSL Handshake Optional messages:  CERTIFICATE:  If the server is using certificate-based authentication  May contain RSA public key  good for key exchange  SERVERKEYEXCHANGE:  If the client does not have certificate, has certificate that can only be used to verify digital signatures, or uses FORTEZZA token-based key exchange  CERTIFICATEREQUEST:  Server may request personal certificate to authenticate a client 10/19/2004 26 C  S: [CERTIFICATE] CLIENTKEYEXCHANGE [CERTIFICATEVERIFY] CHANGECIPHERSPEC FINISH SSL Handshake  Client processing:  Verifies site certification  Valid site certification if the server’s name matches the host part of the URL the client wants to access  Checks security parameters supplied by the SERVERHELLO 10/19/2004 27 C  S:  [CERTIFICATE] CLIENTKEYEXCHANGE [CERTIFICATEVERIFY] CHANGECIPHERSPEC FINISH SSL Handshake Client messages:  CERTIFICATE  If server requested a client authentication, client sends  CLIENTKEYEXCHANGE  Format depends on the key exchange algorithm selected by the server  RSA: 48-byte premaster secret encrypted by the server’s public key  Diffie-Hellman: public parameters between server and client in SERVERKEYEXCHANGE and CLIENTKEYEXCHANGE msgs  FORTEZZA: token-based key exchange based on public and private parameters  Premaster key is transformed into a 48-byte master secret, stored in the session state 10/19/2004 28 C  S:  [CERTIFICATE] CLIENTKEYEXCHANGE [CERTIFICATEVERIFY] CHANGECIPHERSPEC FINISH SSL Handshake Client messages:  CERTIFICATEVERIFY  If client authentication is required  Provides explicit verification of the use’s identity (personal certificate)  CHANGECIPHERSPEC  Completes key exchange and cipher specification  FINISH  Encrypted by the newly negotiated session key  Verifies that the keys are properly installed in both sites 10/19/2004 29 S  C: CHANGECIPHERSPEC FINISH SSL Handshake  Server finishes handshake by sending CHANGECIPHERSPEC and FINISH messages  After SSL handshake completed a secure connection is established to send application data encapsulated in SSL Record Protocol 10/19/2004 30 SSL Handshake to Resume session CLIENTHELLO SERVERHELLO CHANGECIPHERSPEC FINISH C  S: CHANGECIPHERSPEC FINISH C  S: S  C: 10/19/2004 31 SSL Change Cipher Spec Protocol  A single message with only one byte “1”  Cause pending state to become current, hence updating the cipher suite in use 10/19/2004 32 Transport Layer Security (TLS)   Specified as IETF standard RFC 2246 Similar to SSLv3 but with minor differences        in record format version number use HMAC for MAC a pseudo-random function expands secrets has additional alert codes some changes in supported ciphers changes in certificate negotiations changes in use of padding 10/19/2004 33 Next Class  Kerberos and authentication 10/19/2004 34 ... on data written by client Server write key: key used for data encryption by server and decryption by client Client write key: key used for encryption by client and decryption by server Initialization... transport  Reliable or unreliable transport  Security 10/19/2004 Application Layer Transport Layer Internetwork Layer Network Access Layer Transport Layer Security  Advantages:   Does not require... Complexity of the networking is hidden from the application Data Link Layer 10/19/2004 Security At What Level?    Secure traffic at various levels in the network Where to implement security?