3 - Network- & Transport-Layer Security (Privacy) Flashcards
define privacy
Oxford Dictionary: Privacy is “the state of being free from being observed or disturbed by other people and of being free from public attention.”
Privacy is recognized as a human right
Attacks on digital privacy are mainly passive
- Eavesdropping
- Traffic Analysis
Privacy today?
- Edward Snowden:
“A child born today will have no conception of privacy”
How To Preserve Privacy?
Access Control
- An attacker needs access to the communication medium to eavesdrop
- As we’ve seen, perfect access control is most often not really possible
Confidentiality
- Encryption ensures that nobody can read your messages
- Assumption: encryption cannot be broken!
But eavesdroppers still see your communication → Traffic Analysis
- Who communicates with whom and when?
- Do they communicate more often than usual? (If yes, something is suspicious)
- This is actually done in SIGINT (e.g. by the NSA)
Privacy In The Internet?
Internet communication is routed according to contracts between ISPs and countries (policy-based routing, BGP)
- Do you trust all networks your traffic passes on its routes?
Snowden’s global surveillance disclosure in 2013 revealed that states eavesdrop on our communication in a much larger scale than most people expected.
Even if your provider is trustworthy, your information almost always passes networks owned and controlled by someone else!
- Security is only as strong as the weakest link in the chain!
End-to-end encryption needed
End-to-end Encryption (E2EE)
The transport layer provides communications between application processes, i.e. end-to-end communication
- Perfect place to add E2EE functionality
Transport Layer Security (TLS)
- Based on its predecessor Secure Socket Layer (SSL)
- Originally designed to protect HTTP sessions
- But TLS can secure any protocol which uses TCP (e.g. SMTP)
SSL/TLS provides
- Peer entity authentication: Both (client and server), only the server, or none can be authenticated.
- User data confidentiality: On session establishment, different encryption algorithms (e.g. RC4, DES, AES) can be selected.
- User data integrity: A message authentication code (MAC) generated with a cryptographic hash function is appended to the user data.
TLS Support
TLS has become the de facto standard for secure Internet communications
Why not using TLS to encrypt all web traffic?
- Slows down web servers
- Breaks Internet caching
- Not all information needs to be encrypted
It is a best practice in the web to use TLS whenever you deal with sensitive data
- Many sites use TLS to encrypt communication by default
- Critical sites (like banks) use TLS to additionally authenticate their legal ownership to the user
TLS Protocol Architecture
TLS is structured as a layered and modular protocol architecture
1) Handshake: authentication and negotiation of parameters
2) Change Cipherspec: signaling of transitions in ciphering strategy
3) Alert: signaling of error conditions
4) Application Data: interface for transparent access to the record protocol
5) Record
- Fragmentation of user data into plaintext records of length < 214 Bytes
- Compression (optional) of plaintext records
- Encryption and integrity protection (both optional)
TLS Handshake
Client and server agree on algorithms and exchange
random values and cryptographic parameters to agree on a master secret. Certificates are used for authentication.
If the exchanged certificates are signed, the peer can be authenticated using a trusted third party (e.g. VeriSign)
Both parties hold a connection state
Also the parameters for these algorithms are known
Keys are derived from a 48-byte shared master secret
Default connection state is that no encryption, compression, or MAC will be used
Record Protocol
Content Type:
- Change Cipherspec. (20)
- Alert (21)
- Handshake (22)
- Application Data (23)
Version: the protocol version of SSL/TLS
Length: the length of the data in bytes must not exceed 2^14
Record Data Processing
Sender
1) Record layer receives data of arbitrary size from higher layers and fragments it in plaintext records carrying chunks of at most 214 bytes
2) All records are then compressed with the compression algorithm defined in the current connection state
3) A message authentication code (MAC) is then calculated using the MAC algorithm defined in the connection state and appended to the compressed fragment
- Ensures message integrity and authenticity, and the detection of missing, extra, or repeated messages
4) The record data and the MAC are encrypted using the encryption algorithm defined in the connection state
Receiver
- The record is decrypted, integrity-checked, decompressed, de-fragmented and delivered to the higher layer
TLS Peer Entity Verification
Clients (e.g. web browser) hold a set of root certificates (public keys) of the major certificate authorities
These authorities issue certificates to entities (e.g. websites) that wish to provide authenticated connections
- Certificates contain the domain name and/or IP address and are signed by the authority using public key cryptography
- Certificates can additionally contain the website’s legal owner which allows authentication of both, server and owner
As soon as the client (or the server) gets a certificate, it can check its validity by using the built-in signing authority’s root certificate
- If the application does not check the validity, the connection is still encrypted, but you don’t know who you are talking to!! → MITM
TLS Cipher Suite
Key Exchange (KE)
- RSA: the server certificate is used for KE
- Diffie-Hellman (DH) with authentication: the server’s certificate contains the DH parameters signed by the certificate authority
- Can additionally be client-authenticated
- Clients hold a set of root certificates of major certificate authorities
- Anonymous Diffie-Hellman: DHKE without using a certificate
- Vulnerable to MITM attacks
- Only used on explicit request of application layer
After the key exchange, encryption can be done using RC4, 3DES, or AES with 128 or 256 bit key length
MACs are generated using either MD5 (broken!) or SHA
The mandatory cipher suite that must be implemented is RSA for KE with AES-128 for encryption and SHA for MAC generation
Self-made Certificates
What if you want to set up an authenticated service?
- You have to buy a certificate from a trusted authority!
- VeriSign’s certificates cost 350€ to 1750€ per year!
- You can use self-signed certificates instead
Self-signed certificates can provide authentication only if you can distribute the certificate to users over a trustworthy
communication channel!
- Otherwise you usually get a warning that the connection is untrusted
- But applications usually allow to add the certificate
- Be careful! Could be a MITM attack!
TLS Summary
TLS security protocol operates on and requires a reliable transport service → TCP
Up to now, no major security protocol has been proposed to protect datagram-oriented transport protocols like UDP
TLS offers true end-to-end protection for user data exchanged between application processes
Furthermore, it interworks easily with packet filtering of today’s firewalls
Is E2EE Enough?
Are the certification authorities really trustworthy?
- Firefox includes 161 certificates!
- Certificates have been stolen! (e.g. DigiNotar)
- Certificate authorities are companies and may be forced to hand out certificates to governments!
Snowden’s documents revealed that the NSA stores metadata of millions of web users for up to a year, regardless of whether you are a target or not! [Guardian13]
- Metadata do not contain content-specific details which can be kept secret by using E2EE!
- Metadata rather contain things like who communicated with whom and when and from where?
- That’s enough information to, e.g., build your social graph or to find out about your habits!
So E2EE is apparently NOT enough!
For perfect privacy, we additionally need anonymity!
What is Anonymity?
Oxford dictionary: Anonymity is the “lack of outstanding, individual, or unusual features; impersonality”
In the digital world: unless you don’t tell anybody, no one should know who you are and where you come from
- Not even the host you are communicating with
- Not even the NSA
And this is where the Tor Project comes into play!
