Weeks 4-5: Protocols

Question 1

What are the eleven Protocol Goals?

Answer 1

1.) Keys are secret and fresh.
2.) Both parties are authenticated.
3.) Forward secrecy.
4.) No weak cipher used.
5.) Protocol should not be complex.
6.) Minimum possible damage from key leakage (No key compromise impersonation attacks).
7.) No offline guessing attacks against weak secrets.
8.) No “state machine” attacks (attacks in error handling).
9.) Open public design process.
10.) Post compromise security.
11.) Reveals as little meta data as possible.

Question 2

What is the Needham-Schroeder public key protocol + one disadvantage of it?

Answer 2

1. A -> B: EB(Na, A)
   Can be MITM’d here.
2. B -> A: EA(Na, Nb) -> Add identity B here to fix.
3. A -> B: EB(Nb)

Question 3

What is Forward Secrecy?

Answer 3

When messages are safe from an attacker who has a recording of a protocol run and long-term keys of the principals.

Question 4

What is Diffie-Hellman?

Answer 4

• Alice and Bob pick rA + rB and find tA(= g^rA mod p) and tB respectively.
• Exchange these numbers.
• Calculate tA^rB mod p and tB^rB mod p.

Key = g^rArB mod p

Question 5

What is Station-to-Station Protocol?

Answer 5

1. A -> B: g^x
2. B -> A: g^y, {SB(g^y, g^x)}g^xy
3. A -> B: {SA(g^x, g^y)}g^xy
4. B -> A: {M}g^xy

Forward secrecy - g, x and y not stored after run.

Question 6

What is TLS (1.2)?

Answer 6

1. C -> S: Nc
2. S -> C: Ns, CertS
3. C -> S: Es(K_Seed), {Hash1}KCS
4. S -> C: {Hash2}KCS

Where Hash = hash of entire run
and KCS = session key.

Question 7

How was TLS fixed to include forward secrecy?

Answer 7

TLS-DHE.

1. C -> S: Nc, Possible Ciphersuites
2. S -> C: Ns, g^x, CertS, SignS(#(Nc, Ns, g^x)), CipherSuite
3. C -> S: g^y, {#(prev. messages)}K
4. S -> C: {#(prev. messages)}K

Where K = kdf(Nc, Ns, g^xy)

Question 8

What is a Key Compromise Impersonation Attack?

Answer 8

With static client certificate - attack can control client’s key.

Attack is successful if attack can pretend to be any server - forces to static DH, attacker knows client key.

E.g: Client certificate in a place of work - MITM.

Question 9

What is one downside of DHE?

Answer 9

No authentication - must be done separately.

Question 10

Why is TLS 1.2 a mess?

Answer 10

Too many cipher suites/options - lots of attacks.
2 round trips before sending data.
Complexity allows for mistakes in implementations - attacks.

Question 11

How does TLS 1.3 improve over 1.2?

Answer 11

Only 5 very secure ciphers.
All ECDH (forward secrecy).
Few modes of operation (e.g. RSA, not static DH).
Hides server name from passive eavesdroppers.
Starts sending data after one round trip of messages.

Question 12

What is TLS 1.3?

Answer 12

C -> S: ClientHello
S -> C: ServerHello, {Certificate}, {CertVerify}, {Finished}
C -> S: {Finished}, Data encrypted with kdf5(g^xy, log5)
S -> C: Data encrypted with kdf6(g^xy, log5)

Question 13

How does ECDH work?

Answer 13

• A + B agree on curve and point P.
• A generates random n and sends nP, B generates random M and sends mP.
• A does n(mP), B does m(nP) - Key = nmP.

Only way to find m/n is through brute force.

Question 14

Why must a curve be picked carefully for ECDH?

Answer 14

There may be small subgroups, e.g. 16P = P - no security (brute forceable).

Question 15

What are some downsides of WPA?

Answer 15

Anyone can read nonces, and with the password, can generate the key required to decrypt traffic - no forward secrecy.
Can brute force keys offline with Na, Nb and some encrypted traffic.

Question 16

Describe the KRACK attack on WPA2?

Answer 16

Key reinstallation attack.

Access point replays message 3.
Client assumes previous messages were lost, resets IV.

Same counter in two packets with diff. plaintexts.
cipher_text2 XOR E(cipher_text1) = plain_text2

Question 17

How does WPA3 improve over WPA2?

Answer 17

Added “Dragonfly” protocol sets up a shared secret based on password, prior to standard four-way handshake.
This results in forward secrecy.

Rekeying also removed (no more KRACK attack).

Question 18

Explain the Dragonblood attack on WPA3?

Answer 18

Can see how long it took for password -> EC point.

Compare <MAC client, MAC access point, password> and real EC point iterations to see if they are the same password - 75% chance to rule out a password.

Attacker can change MAC address and try again until password is found.

Question 19

Why is it hard to discover n in nP for ECDH?

Answer 19

No efficient divide operation for eliptic curves.

Question 20

What are the benefits of Rekeying (in WireGuard)?

Answer 20

If attacker gets the key, they will lose access after rekeying (unless they actively MITM the handshake).
Stops large amount of traffic getting encrypted with the same key (stops side channel/yet to be discovered cryptoo attacks).

Question 21

What is AEAD?

Answer 21

Authenticated Encryption with Additional Data.

AEAD(key, counter/iv, plaintext, additional data) = ciphertext