CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob...

31
CSE 484 / CSE M 584: Computer Security and Privacy Autumn 2019 Tadayoshi (Yoshi) Kohno [email protected] Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Franzi Roesner, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials ...

Transcript of CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob...

Page 1: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

CSE 484 / CSE M 584: Computer Security and Privacy

Autumn 2019

Tadayoshi (Yoshi) Kohno

[email protected]

Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Franzi Roesner, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials ...

Page 2: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Announcements

• My office hours – 11/13 (Wed), 11:30am, CSE1 403– 11/20 (Wed), 2:30pm, CSE1 403– 11/27 (Wed), None– 12/4 (Wed), 12:30pm, CSE1 403

• HW 2 available (due 11/15)• Lab2 out or soon to be out; to be discussed at quiz

section this week (11/7)• Final Project checkpoint on Friday (11/8) (group

members, brief description)– https://courses.cs.washington.edu/courses/cse484/19au/

assignments/final_project.html

11/4/2019 CSE 484 / CSE M 584 – Autumn 2019 2

https://courses.cs.washington.edu/courses/cse484/19au/assignments/final_project.html
Page 3: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Cryptography Summary Thus Far

• Goal: Privacy– Symmetric keys:

• One-time pad, Stream ciphers

• Block ciphers (e.g., DES, AES) modes: EBC, CBC, CTR

– Public key crypto (e.g., RSA)

• Goal: Integrity– MACs, often using hash functions (e.g, MD5, SHA-256)

• Goal: Privacy and Integrity– Encrypt-then-MAC

• Goal: Authenticity (and Integrity)– Digital signatures (e.g., RSA, DSS)

11/4/2019 CSE 484 / CSE M 584 3

Page 4: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Session Key Establishment

11/4/2019 CSE 484 / CSE M 584 5

Page 5: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Modular Arithmetic

11/4/2019 CSE 484 / CSE M 584 6

• Given g and prime p, compute: g1 mod p, g2 mod p, … g100 mod p

– For p=11, g= 10• 101 mod 11 = 10, 102 mod 11 = 1, 103 mod 11 = 10, …

• Produces cyclic group {10, 1} (order=2)

– For p=11, g=7• 71 mod 11 = 7, 72 mod 11 = 5, 73 mod 11 = 2, …

• Produces cyclic group {7,5,2,3,10,4,6,9,8,1} (order = 10)

• g=7 is a “generator” of Z11*

– For p=11, g=3• 31 mod 11 = 3, 32 mod 11 = 9, 33 mod 11 = 5, …

• Produces cyclic group {3,9,5,4,1} (order = 5)

Page 6: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Diffie-Hellman Protocol (1976)

• Alice and Bob never met and share no secrets

• Public info: p and g

– p is a large prime, g is a generator of Zp*

• Zp*={1, 2 … p-1}; for all a in Zp* there exists i s.t. a=gi mod p

• Modular arithmetic: numbers “wrap around” after they reach p

11/4/2019 CSE 484 / CSE M 584 7

Alice Bob

Pick secret, random X Pick secret, random Y

gy mod p

gx mod p

Compute k=(gy mod p)x=gxy mod p Compute k=(gx mod p)y=gxy mod p

Page 7: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Why is Diffie-Hellman Secure?

• Discrete Logarithm (DL) problem: given gx mod p, it’s hard to extract x

– There is no known efficient algorithm for doing this

– This is not enough for Diffie-Hellman to be secure!

• Computational Diffie-Hellman (CDH) problem:given gx mod p and gy mod p, it’s hard to compute gxy mod p

– … unless you know x or y, in which case it’s easy

• Decisional Diffie-Hellman (DDH) problem:

given gx mod p and gy mod p, it’s hard to tell the difference

between gxy mod p and gr mod p where r is random

11/4/2019 CSE 484 / CSE M 584 9

Page 8: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Properties of Diffie-Hellman

• Assuming DDH problem is hard (depends on choice of

parameters!), Diffie-Hellman protocol is a secure key establishment protocol against passive attackers– Common recommendation:

• Choose p=2q+1, where q is also a large prime

• Choose g that generates a subgroup of order q in Z_p*

– Eavesdropper can’t tell the difference between the established key and a random value

– Often hash gxy mod p, and use the hash as key (K = Hash(gxy mod p))

– Can use the new key for symmetric cryptography

• Diffie-Hellman protocol (by itself) does not provide authentication– Party in the middle attack (often called “man in the middle attack”)

11/4/2019 CSE 484 / CSE M 584 10

Page 9: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

More on Diffie-Hellman Key Exchange

• Important Note: Examples use discrete logs modulo integers.

• Significant advantages in using elliptic curve groups – groups with some similar mathematical properties (i.e., are “groups”) but have better security and performance (size) properties

11/4/2019 CSE 484 / CSE M 584 - Fall 2017 11

Page 10: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Summary of Public Key Crypto

• Encryption for confidentiality– Anyone can encrypt a message

• With symmetric crypto, must know secret key to encrypt

– Only someone who knows private key can decrypt

– Key management is simpler (or at least different)• Secret is stored only at one site: good for open environments

• Digital signatures for authentication– Can “sign” a message with your private key

• Session key establishment– Exchange messages to create a secret session key

– Then switch to symmetric cryptography (why?)

11/4/2019 CSE 484 / CSE M 584 12

Page 11: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Stepping Back Again, Context

• Increasing security can shift adversarial actions

11/4/2019 CSE 484 / CSE M 584 - Autumn 2019 13

Page 12: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Improved Security, Increased Risk

• RFIDs in car keys:

– RFIDs in car keys make it harder to hotwire a car

– Result: Car jackings increased

11/4/2019 CSE 484 / CSE M 584 14

Page 13: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Improved Security, Increased Risk

• RFIDs in car keys:

– RFIDs in car keys make it harder to hotwire a car

– Result: Car jackings increased

11/4/2019 CSE 484 / CSE M 584 15

Page 14: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Where is Crypto Used? Everywhere?

• Definitely the Web

• Now Transitioning to Web Security (returning to crypto and the web later)

11/4/2019 CSE 484 / CSE M 584 - Autumn 2019 16

Page 15: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Network

Big Picture: Browser and Network

5/4/2018 CSE 484 / CSE M 584 17

Browser

OS

Hardware

websiterequest

reply

Page 16: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Where Does the Attacker Live?

5/4/2018 CSE 484 / CSE M 584 18

Network

Browser

OS

Hardware

websiterequest

replyWeb

attacker

Network attacker

Malware attacker

Mitigation: SSL/TLS (crypto) (not this lecture)

Mitigation: Browser security model (today)

Page 17: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Web Attacker

• Controls a malicious website (attacker.com)

– Can even obtain SSL/TLS certificate for site

• User visits attacker.com – why?

– Phishing email, enticing content, search results, placed by an ad network, blind luck …

• Attacker has no other access to user machine!

• Variation: good site honest.com, but:

– An iframe with malicious content included

– Website has been compromised

5/4/2018 CSE 484 / CSE M 584 19

Page 18: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Two Sides of Web Security

(1) Web browser

– Responsible for securely confining content presented by visited websites

(2) Web applications

– Online merchants, banks, blogs, Google Apps …

– Mix of server-side and client-side code

• Server-side code written in PHP, Ruby, ASP, JSP

• Client-side code written in JavaScript

– Many potential bugs: XSS, XSRF, SQL injection

5/4/2018 CSE 484 / CSE M 584 20

Page 19: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

All of These Should Be Safe

• Safe to visit an evil website

• Safe to visit two pages at the same time

• Safe delegation

5/4/2018 CSE 484 / CSE M 584 21

Page 20: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Browser Security Model

Goal 1: Protect local system from web attacker Browser Sandbox

Goal 2: Protect/isolate web content from other web contentSame Origin Policy

(plus sandbox)

5/4/2018 CSE 484 / CSE M 584 22

Page 21: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Browser Sandbox

Goals: Protect local system from web attacker; protect websites from each other

– E.g., safely execute JavaScript provided by a website

– No direct file access, limited access to OS, network, browser data, content from other websites

– Tabs and iframes in their own processes

– Implementation is browser and OS specific* *For example, see: https://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md

5/4/2018 CSE 484 / CSE M 584 23

From Chrome Bug Bounty Program

https://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md
Page 22: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Same Origin Policy

Goal: Protect/isolate web content from other web content

5/4/2018 CSE 484 / CSE M 584 24

Website origin = (scheme, domain, port)

[Example from Wikipedia]

Page 23: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Same Origin Policy

Goal: Protect/isolate web content from other web content

5/4/2018 CSE 484 / CSE M 584 25

Website origin = (scheme, domain, port)

[Example from Wikipedia]

Page 24: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Same Origin Policy is Subtle!

• Some examples of how messy it gets in practice…

• Browsers don’t (or didn’t) always get it right...

• We’ll talk about:

– DOM / HTML Elements

– Navigation

– Cookie Reading

– Cookie Writing

– Iframes vs. Scripts

5/4/2018 CSE 484 / CSE M 584 26

Page 25: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

HTML + Document Object Model

<html> <body>

<h1>This is the title</h1>

<div>

<p>This is a sample page.</p>

<script>alert(“Hello world”);</script>

<iframe src=“http://example.com”>

</iframe>

</div>

</body> </html>

5/4/2018 CSE 484 / CSE M 584 27

body

h1

p

div

script iframe

Document Object Model (DOM)

body

Page 26: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Same-Origin Policy: DOM

Only code from same origin can access HTML elements on another site (or in an iframe).

www.bank.com

www.bank.com/ iframe.html

www.evil.com

www.bank.com/ iframe.html

www.bank.com (the parent) can access HTML elements in the iframe (and vice versa).

www.evil.com (the parent) cannot access HTML elements in the iframe (and vice versa).

5/4/2018 CSE 484 / CSE M 584 28

http://www.example.com/
http://www.example.com/iframe.html
http://www.evil.com/
http://www.example.com/iframe.html
http://www.example.com/
http://www.evil.com/
Page 27: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Question: Who Can Navigate a Frame?

5/4/2018 CSE 484 / CSE M 584 29

window.open("https://www.google.com/...")window.open("https://www.attacker.com/...", "awglogin")

awglogin

If bad frame can navigate sibling frames, attacker gets password!

Solution: Modern browsers only allow a frame to navigate its “descendent” frames

Older Issue

Page 28: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Browser Cookies

• HTTP is stateless protocol

• Browser cookies used to introduce state– Websites can store small amount of info in browser

– Used for authentication, personalization, tracking…

– Cookies are often secrets

5/4/2018 CSE 484 / CSE M 584 30

Browser

Server

POST login.phpusername and pwd

GET restricted.html

Cookie: login_token=13579

HTTP Header: Set-cookie:login_token=13579;domain = (who can read) ;expires = (when expires)

Page 29: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Same Origin Policy: Cookie Reading

• Websites can only read/receive cookies from the same domain

– Can’t steal login token for another site

5/4/2018 CSE 484 / CSE M 584 31

www.email.com

www.ad.com

Email.com’sServer

Ad.com’sServer

www.email.com’scookie

www.ad.com’scookie

http://www.bar.com/
http://www.foo.com/
Page 30: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Same Origin Policy: Cookie Writing

Which cookies can be set by login.site.com?

login.site.com can set cookies for all of .site.com (domain suffix), but not for another site or top-level domain (TLD)

5/4/2018 CSE 484 / CSE M 584 32

allowed domains

login.site.com

.site.com

disallowed domains

othersite.com

.com

user.site.com

Page 31: CSE 484 / CSE M 584: Computer Security and Privacy...Diffie-Hellman Protocol (1976) •Alice and Bob never met and share no secrets •Public info: p and g –p is a large prime, g

Problem: Who Set the Cookie?

5/4/2018 CSE 484 / CSE M 584 33

Browser

login.site.com

evil.site.com

cse484.site.com

Set-Cookie:Domain: .site.comValue: userid=alice, token=1234

Set-Cookie:Domain: .site.comValue: userid=bob, token=5678

Cookie: userid=bob, token=5678

Not a violation of the SOP!


Announcements: Questions? This week: Discrete Logs, Diffie -Hellman, ElGamal

Announcements: Questions? This week: Discrete Logs, Diffie -Hellman, ElGamal

Diffie-Hellman Key Exchange

Diffie-Hellman Key Exchange

Diffie-Hellman, discrete logs, the NSA, and you

Diffie-Hellman, discrete logs, the NSA, and you

KEY MANAGEMENT DIFFIE-HELLMAN KEY EXCHANGE ELLIPTIC CURVE ARITHMETIC

KEY MANAGEMENT DIFFIE-HELLMAN KEY EXCHANGE ELLIPTIC CURVE ARITHMETIC

E-th roots and static Diffie-Hellman using index calculus

E-th roots and static Diffie-Hellman using index calculus

A Signature Scheme as Secure as the Diffie Hellman Problem

A Signature Scheme as Secure as the Diffie Hellman Problem

Rsa and diffie hellman algorithms

Rsa and diffie hellman algorithms

How to Backdoor Diffie-Hellman

How to Backdoor Diffie-Hellman

Diffie-Hellman Key Exchange CSCI 5857: Encoding and Encryption.

Diffie-Hellman Key Exchange CSCI 5857: Encoding and Encryption.

Diffie-Hellman without Difficulty (Extended Version) · Diffie-Hellman without Difficulty (Extended Version) Mödersheim, Sebastian Alexander Publication date: 2011 Document Version

Diffie-Hellman without Difficulty (Extended Version) · Diffie-Hellman without Difficulty (Extended Version) Mödersheim, Sebastian Alexander Publication date: 2011 Document Version

01 and 06 Oct 2003, Intro RSA, Diffie-Hellman, public-key issues

01 and 06 Oct 2003, Intro RSA, Diffie-Hellman, public-key issues

Intercambio de Llaves Diffie Hellman

Intercambio de Llaves Diffie Hellman

Efficient algorithms for supersingular isogeny Diffie-Hellmancraigcostello.com.au/wp-content/uploads/SIDH-Nijmegen.pdf · Efficient algorithms for supersingular isogeny Diffie-Hellman

Efficient algorithms for supersingular isogeny Diffie-Hellmancraigcostello.com.au/wp-content/uploads/SIDH-Nijmegen.pdf · Efficient algorithms for supersingular isogeny Diffie-Hellman

Key Exchange Methods Diffie-Hellman and RSA

Key Exchange Methods Diffie-Hellman and RSA

Pre- and post-quantum Diffie–Hellman from groups, actions ... · in §§2-5. We discuss modern elliptic-curve Diffie–Hellman in §7; this dispenses with the underlying group on

Pre- and post-quantum Diffie–Hellman from groups, actions ... · in §§2-5. We discuss modern elliptic-curve Diffie–Hellman in §7; this dispenses with the underlying group on

Security Issues in the Diffie-Hellman Key Agreement Protocol

Security Issues in the Diffie-Hellman Key Agreement Protocol

Public key cryptography RSA Algorithm Diffie-Hellman key exchange.

Public key cryptography RSA Algorithm Diffie-Hellman key exchange.

The computational and decisional Diffie-Hellman ... · Basic DDHBasic CDHNeed for extensionExtended CDHExtended DDHConclusion The computational and decisional Di e-Hellman assumptions

The computational and decisional Diffie-Hellman ... · Basic DDHBasic CDHNeed for extensionExtended CDHExtended DDHConclusion The computational and decisional Di e-Hellman assumptions

Agenda Cryptography ??. Encryption. Symmetric Encryption. Asymmetric Encryption. Diffie-hellman. Hashing. Digital signature. Authentication Protocols.

Agenda Cryptography ??. Encryption. Symmetric Encryption. Asymmetric Encryption. Diffie-hellman. Hashing. Digital signature. Authentication Protocols.

Diffie hellman

Diffie hellman