Improvements to TESLA Using Secret Sharing Scheme ECE 646: Cryptography and Network Security...
-
Upload
samantha-justina-ferguson -
Category
Documents
-
view
218 -
download
0
Transcript of Improvements to TESLA Using Secret Sharing Scheme ECE 646: Cryptography and Network Security...
Improvements to TESLAUsing Secret Sharing Scheme
ECE 646: Cryptography and Network SecurityProfessor: Dr. Jens-Peter Kaps
Project TeamKrishna Chaitanya Thirumalasetty
KamalEldin MohamedLieyong Yang
Nick Ton
December 19, 2006
Agenda
Overview & MotivationTESLA Protocol
• Protocol Overview• Sender Setup • Receiver Authentication• DoS Attack
Improving DoS Attack• Instant Key Disclosure (TIK)• Staggered TESLA• Public Key Cryptography (PKC)
Group Multicast Authentication (GMA)• Shamir’s Secret Sharing• Analytical Approach• Experimental Approach• Design & Implementation• Results
Conclusion References
Research Motivation
• Our Observation:• TELSA protocol are weak against Denial-of-Service (DoS)
attacks
• Our Goal:• Analyze and implement improvements to TESLA
• Our Approach:• Group Multicast Authentication (GMA) using Shamir
Threshold Scheme
TESLA – Overview
Timed Efficient Stream Loss-Tolerant Authentication• Broadcast authentication protocol for message authenticating
• Published in IEEE Security and Privacy 2000, NDSS 2001 [PCST]
• Uses symmetric key cryptography• Asymmetric key cryptography via time• Based on initial loose time synchronization• MAC is attached to each packet• Delayed-disclosure of keys
MAC (Ki , M)
M
timeti-1 ti ti+1
F(Ki)Authentic
Commitment
Ki
is disclosed
1- Verify Ki
2- Verify MAC3- M is authentic
TESLA – Sender Setup
time
interval i -1 interval i interval i +1 interval N
Ki+1KiKi-1 KN
K’i+1K’iK’i-1 K’N
F’ F’ F’ F’
• Break time in intervals of same duration
• Determine key chain length N, picks the last key KN randomly
• Using a One Way Pseudo Random Function F compute Ki = F(Ki+1), assign one key to each interval
• Use F' to derive the key to compute MAC K’i= F’(K’i)
Key generation
Key disclosure
TESLA – Receiver Authentication
Ki+1KiKi-1
K’i+1K’iK’i-1
F’ F’ F’
Mi-1, Ki-2 MAC(K’i-1, Di-1)
Di-1
Mi , Ki-1 MAC(K’i, Di)
Di
Mi+1, Ki MAC(K’i+1, Di+1)
Di+1
Pi-1 Pi Pi+1
authenticated authenticated after reception of Pi+1
not yet authenticated
• When the receiver gets packet Pi,it can not verify the MAC since it does not yet know Ki from which it can compute K’i
• Packet Pi+1 discloses Ki and allows the receiver to:
verify that Ki is correct, e.g., F(Ki) = Ki-1
compute K’i and check the authenticity of packet Pi by verifying the MAC of Pi
TESLA DoS Attack – Receiver Side
Sender• Delayed release of authentication keys
Receiver• Limited buffer size• Delayed Authentication
Attacker• Flood the multicast group with bogus
traffic!
…Serious DoS Attack…
Existing Solutions
Exiting Solutions Towards Tesla DoS Attack
• Key Disclosure Delay Invites DoS Attack
• TESLA with Instant Key Disclosure (TIK)• Eliminate the authentication delay• Rely on precise synchronization
• Staggered TESLA • Shorten the key delay• Multiple, staggered authentication keys
• Efficient Multi-Chained Stream Signature (EMSS)
New Public Key Solution Coming
• New Emerging Algorithms• Elliptic Curve Cryptography (ECC)
– ECC 163 signature verification takes 480 ms on custom designed hardware nodes
• NTRUEncrypt and NTRUSign– NTRU 251 Vs RSA 1024 on Palm (Encrypt 42:1 Decrypt 333:1)– NTRU 251 Vs ECC 163 on Palm (Encrypt 52.5:1 Decrypt 9:1)
• Faster & Smaller Chips – Moore’s Law
• Sensor Nodes Harvest Energy From Environment
Group MAC Authentication (GMA)
• Group MAC of each packet MACKg (Pj)
• Original Tesla Packet Pj = {M j || i || MACK’i(Mj) || K{i-d}}
• New Packet Pj’ = Pj|| MACKg(Pj)
GMA MAC
TESLA MAC Message||Key||ID
Pj
Pj’
MACKg (Pj) MACK’i(Mj)
Our Solution
Group Multicast Authentication
(GMA)
Shamir’s Secret Sharing
Secret Sharing Scheme• Secret is shared by a trust group – everyone has responsibility • Address the problem of key distribution• Allows multiple users to recover secret
Secret Sharing Scheme has two phase:• Dealer Phase where secret shares are generated• Reconstruction Phase where secrets are combined to reconstruct the
original secret
Secret S is shared by n users, each one has Si, 1< i ≤ n• Iff any member in a group knows T or more shares
– can reconstruct the secret S
• Else– Secret is not recoverable
Shamir Threshold SchemeDealer Phase:
1.Choose a very large prime number p, where p > max(S,n)2.Let a0 = S, where S is the secret3.Pick a coefficient of a polynomial function ai = [0,p)
• a1, ….,at-1, 0<aj <p-1
4.Compute the polynomial function to get S(i) Reconstruction Phase
• Must have sufficient number of shares (ai)
S (i) = a0+ a1i1 + a2i2 +…+ at-1it-1
S (0) =a0=SS (1) = a0+ a111 + a212 +…+ at-11t-1
S (2) = a0+ a121 + a222 +…+ at-12t-1
……
S(t-1) = a0+ a1(t-1)1 + a2(t-1)2 +…+ at-1(t-1)t-1
• t-1 functions can not solve for secret S
• Lagrange interpolation formula to Reconstruct the secret Key a0=S
GMA Protocol: Setup
• Each node is pre-configured with a routing table• Only knows neighboring node
• Upstream nodes generate session keys for downstream nodes
• Each node is seeded with a secret share Si
• Si is created from secret S
• Each node is initialized with a threshold t ≤ N• N is the total number of secrets shares
GMA Protocol: Secret Share Transmission
1. Node 1 Initiates• Creates session keys K12 and K13
• Send secret share S1
2. Node 2 and Node 3 Initiates• Uses K12 and K13 to send S2 and S3
• Create session keys K24 and K35
• Node 2 sends S1, S2
• Node 3 sends S1, S3
3. Node 4 and Node 5 Responds• Uses K24 and K35 to send S4 and S5
4. Node 2 and Node 3 Responds• Retransmit S4 and S5 to Node 1
1
32
4 5
Nodes send/receive until threshold is reached
GMA Protocol: Broadcast Authentication
1. Once a node has reached threshold• Each node calculates secret S
• Use the secret to broadcast
2. Sender Message Encryption• MAC(x) = MACS(H(x))
• y = ES(x)||MACS(x)
3. Receiver Message Decryption• x = Ds(y)
• Compare MAC(Ds(y)) = MAC(x)
1
32
4 5
Analytical Approach
Manually simulated secret share exchange
• Analyzed for 10 node hierarchical network
• Analyzed 3 types of topology
• Observed the following:
– Node 0 (broadcast node) is first to achieve threshold
– Leaf nodes are last to receive all shares
– Independent of topology
– Each node on average re-broadcast (t-1)n
Experimental ApproachJustification
• Provide evidence to support or reject analytical observations
• Determine performance and efficiency metrics– Timing data (convergence time, round-trip time)
Methodology• Develop GMA protocol in the NS2 • Other simulation framework were available
(omnet++, simlink, …etc.)
Implementation Design
Risk Reduction Strategies• Simplify protocol
– Identify essential operations within the GMA protocol
• Divide Conquer– Divided the GMA protocol into:
• Secret Share Exchange
• Multicast Authentication
Testing Strategies• Automate test scenarios with python/shell scripts
Protocol Implementation
class GMA_Agent : public Agent {public:GMA_Agent() : GMA_Agent(“Agent/GMA_Agent”) {}recv( Packet *, Handler *);}
Class GB_Agent….
TclObject
Agent
Agent/TCP
TclObject
Agent
GMA_Agent
NsObject
OTclC++ Class mirror
Additional Integration Steps
Define new packetGMA_Packet
Add new packet protocol ID
into packet.h
Add new packettype into
ns-default.tcl
Add an entry fornew packet type
ns-packet.tcl
Modify ns2Makefile
header
dataip header
GMA header
GB header
cmn headerseqno_
scr_addr_
data_
qLength_
ack_
Packet Implementation
Additional modifications to NS2
Experimental Results
Performed simulation• Random topology for:
– 50, 100, 200 nodes
• Bandwidth 10 kbps
• Share size 128 bits
• Collect convergence time for secret share exchange
• Collect round-trip time for Node-0 acknowledgement
Conclusion• Share size is dependent upon
network size and bandwidth
• Round-trip broadcast authentication is exponentially proportional to the network size
Secret Share Exchange Convergence Time Size
Round Trip time
ConclusionGMA Protocol
• Can be viable augmentation to TELSA protocol• Does provide protection against DoS attack
– Instant authentication of packets• Performance degrades exponentially for large network
topology
Further Research & Development• Further analysis of the protocol setup• Secrecy of key exchange using AVISPA
– Automated Validation of Internet Security Protocols and Applications
• Solving the scalability problem through better implementation of the GMA protocol
• Improvements to group key management
References • A. Perrig, R. Canetti, J. Tygar, and D. Song, “The TESLA broadcast authentication protocol”, RSA
CryptoBytes, 2002.• R. Canetti, J. Garay, G. Itkis, D. Micciancio, M. Naor, and B. Pinkas, “Multicast security: A
taxonomy and some efficient constructions”, in INFOCOMM’99, 1999.• S. Cheung, “An efficient message authentication scheme for link state routing”, in Proceedings of
the 13th Annual Computer Security Applications Conference, December 1997, pp. 90–98.• F. Bergadano, D. Cavagnino, and B. Crispo, “Chained stream authentication”, in Proceedings of the
7th Annual Workshop on Selected Areas in Cryptography, August 2000, pp. 144–157.• B. Briscoe, “FLAMeS: Fast, loss-tolerant authentication of multicast streams,” Technical report, BT
Research, 2000.• A. Perrig, J. Tygar, “Secure Broadcast Communication in Wired and Wireless”, Kluwer Academic
Publishers, Norwell, MA 2003.• A. Perrig, R. Canetti, D. Song, and J. D. Tygar, “Efficient and secure source authentication for
multicast”, in Proceedings of Network and Distributed System Security Symposium, February 2001.• Adrian Perrig, Robert Szewczyk, Victor Wen, David Culler, J. D. Tygar, “SPINS: Security Protocols
for Sensor Networks”, in Proceedings of Seventh Annual International Conference on Mobile Computing and Network, July 2001
• Donggang Liu, Peng Ning, “Multi-Level µTESLA: A Broadcast Authentication System for Distributed Sensor Networks”, ACM Transactions on Embedded Computing Systems (TECS), Vol. 3, No. 4, pages 800--836, November 2004
• Kui Ren, Kai Zeng, Wenjing Lou, and Patrick J. Moran, "On broadcast authentication in wireless sensor networks", Lecture Notes in Computer Science, vol. 4138, pp. 502-514. International Conference on Wireless Algorithms, Systems, and Applications (WASA 2006), Xi'an, China, August 15-18, 2006
Questions?