Lecture 11-Kerberos, Network Security

Question 1

What is the main most important point of zero knowledge proofs?

Answer 1

It gives you a way to mutually authenticate when both parties don’t trust each other. Password authentication: you can give up your password to a bad guy. Public key cryptography: Bob can get Alice to sign anything if he goes rogue.

Question 2

When if the Fiat-Shamir protocol insecure?

Answer 2

If Eve knows Bob’s challenge in advance, she can manipulate the math involved in the Fiat-Shamir protocol to give Bob what he’s looking for. But even then the probability of being right is only 50% so increasing the number of iterations will reduce her probability.

Question 3

Where is Fiat-Shamir used in practice?

Answer 3

Watermark verification: show presence of watermark without revealing info about it and also prevent duplicating watermark

Videocrypt: a way to authenticate subscriber for satellite DirecTV before showing movie

Question 4

Kerberos

Answer 4

It is an authentication infrastructure used to authenticate users to servers and servers to users and relies on symmetric key encryption and is based on TTP

Question 5

Needham-Schroeder

Answer 5

-basis for Kerberos (essentially works with TTP assigning shared key + ticket to Alice and Alice sends ticket to Bob so he can decrypt it and get the shared key as well)

Question 6

What is the difference between a ticket granting ticket and a service ticket?

Answer 6

A tgt is requested first since you need to send a tgt as part of your request for a service ticket. A service ticket is essentially Alice’s way of wanting to talk to Bob

Question 7

What are realms in Kerberos?

Answer 7

Different “departments.” If you want access to another realm you have to get your realm to vouch for your identity through a TGT.

Question 8

What are some Kerberos limitations?

Answer 8

Not scalable, if you guess password you can guess the keys generated, requires clock sync

Question 9

How does PGP provide confidentiality?

Answer 9

Alice sends email using symmetric key encryption

Question 10

How does PGP provide integrity?

Answer 10

Alice digitally signs the message and sends Bob both the message and the signature. Bob applies Alice’s public key to verify the signed digest and compares the hash of the message with his own hash

Question 11

How does PGP use trust to validate keys?

Answer 11

If it is signed by enough valid keys, it is fully valid

Question 12

SSL

Answer 12

Also known as Transport Layer Security and it provides server authentication, data encryption, client authentication

Question 13

What is the difference between TLS connection and TLS session?

Answer 13

Connection is transient, peer-to-peer communication link. Session is an association between client and server and is created by the Handshake Protocol (a session has multiple connections)

Question 14

What are the two phases of TLS?

Answer 14

Handshake protocol: authenticate each other, negotiate encryption and MAC algorithms, negotiate cryptographic keys to be used

Record-layer protocol: Use the shared key for secure communication

Question 15

How does the TLS handshake work?

Answer 15

First there is TCP authentication, then Alice sends a nonce. Bob sends public key, certificate, and his nonce. Alice verifies Bob’s pk. Alice generates pre-master secret and can transit secret value to Bob. (Which is then used to generate the four keys)

Question 16

Why does TLS use 4 keys?

Answer 16

First you need separate keys for MAC-ing and encryption. Next each direction needs a separate key. All this prevents reflection attacks

Question 17

Would it be ok to MAC the whole messages instead of each message fragment separately?

Answer 17

Can’t do this. There are message size constraints so the message would need to be fragmented. If you wait to MAC on all of it you’d need to wait for all the pieces to get in. If something gets corrupted along the way, since there’s no separate MAC you wouldn’t know which fragment so the whole thing would need to be sent again.

Question 18

What is IPSec?

Answer 18

A set of protocols and algorithms used to secure IP data at the network layer

Question 19

Security Association

Answer 19

-comes under IPSec. It is a set of parameters to establish a one way relationship between sender and receiver

Question 20

Authentication Header

Answer 20

Part of IPSec. Provides integrity, authentication

Question 21

Overall layer organization

Answer 21

PGP is application layer, TLS is transport level, IP/IPSec is network level security

Question 22

Network vs Transport layer?

Answer 22

Network layer relays logical communication between hosts. Transport layer provides logical communication between processes on different hosts.