ch-15 Key-Management IN CNS STUDENTSASEE

VERY GOOD

1. 15.1
Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
Chapter 15
Key Management

2. 15.2
Objectives
To explain the need for a key-distribution center
To show how a KDC can create a session key
To show how two parties can use a symmetric-key
agreement protocol to create a session key
To describe Kerberos as a KDC and an
authentication protocol
Chapter 15
To explain the need for certification authorities
for public keys
To introduce the idea of a Public-Key
Infrastructure (PKI) and explain some of its duties

3. 15.3
15-1 SYMMETRIC-KEY DISTRIBUTION
Symmetric-keycryptographyismoreefficientthan
asymmetric-keycryptographyforencipheringlarge
messages.Symmetric-keycryptography,however,
needsasharedsecretkeybetweentwoparties.The
distributionofkeysisanotherproblem.
15.1.1Key-Distribution Center: KDC
15.1.2Session Keys
Topics discussed in this section:

4. 15.4
15.1.1 Key-Distribution Center: KDC
Figure 15.1 Key-distribution center (KDC)

5. 15.5
FlatMultipleKDCs.
15.1.1 Continued
Figure 15.2 Flat multiple KDCs

6. 15.6
HierarchicalMultipleKDCs
15.1.1 Continued
Figure 15.3 Hierarchical multiple KDCs

7. 15.7
AKDCcreatesasecretkeyforeachmember.Thissecret
keycanbeusedonlybetweenthememberandtheKDC,
notbetweentwomembers.
15.1.2 Session Keys
A session symmetric key between two parties is
used only once.
Note

8. 15.8
ASimpleProtocolUsingaKDC
15.1.2 Continued
Figure 15.4 First approach using KDC

9. 15.9
Needham-SchroederProtocol
15.1.2 Continued
Figure 15.5
Needham-Schroeder
protocol

10. 15.10
15.1.2 Continued
Figure 15.6
Otway-Rees protocol
Otway-ReesProtocol

11. 15.11
15-2 KERBEROS
AbackbonenetworkallowsseveralLANstobe
connected.Inabackbonenetwork,nostationis
directlyconnectedtothebackbone;thestationsare
partofaLAN,andthebackboneconnectstheLANs.
15.2.1Servers
15.2.2Operation
15.2.3Using Different Servers
15.2.4Kerberos Version 5
14.2.5Realms
Topics discussed in this section:
Kerberosisanauthenticationprotocol,andatthesame
timeaKDC,thathasbecomeverypopular.Several
systems,includingWindows2000,useKerberos.
OriginallydesignedatMIT,ithasgonethroughseveral
versions.

12. 15.12
15.2.1 Servers
Figure 15.7 Kerberos servers

13. 15.13
AuthenticationServer(AS)
Theauthenticationserver(AS)istheKDCinthe
Kerberosprotocol.
15.2.1 Continued
Ticket-GrantingServer(TGS)
Theticket-grantingserver(TGS)issuesaticketforthe
realserver(Bob).
RealServer
Therealserver(Bob)providesservicesfortheuser
(Alice).

14. 15.14
15.2.2 Operation
Figure 15.8 Kerberos example

15. 15.15
NotethatifAliceneedstoreceiveservicesfromdifferent
servers,sheneedrepeatonlythelastfoursteps.
15.2.3 Using Different Servers

16. 15.16
Theminordifferencesbetweenversion4andversion5
arebrieflylistedbelow:
15.2.4 Kerberos Version 5
1)Version5hasalongerticketlifetime.
2)Version5allowsticketstoberenewed.
3)Version5canacceptanysymmetric-keyalgorithm.
4)Version5usesadifferentprotocolfordescribingdata
types.
5)Version5hasmoreoverheadthanversion4.

17. 15.17
KerberosallowstheglobaldistributionofASsandTGSs,
witheachsystemcalledarealm.Ausermaygetaticket
foralocalserveroraremoteserver.
15.2.5 Realms

18. 15.18
15-3 SYMMETRIC-KEY AGREEMENT
AliceandBobcancreateasessionkeybetween
themselveswithoutusingaKDC.Thismethodof
session-keycreationisreferredtoasthesymmetric-
keyagreement.
15.3.1Diffie-Hellman Key Agreement
15.3.2Station-to-Station Key Agreement
Topics discussed in this section:

19. 15.19
15.3.1 Diffie-Hellman Key Agreement
Figure 15.9 Diffie-Hellman method

20. 15.20
15.3.1 Continued
The symmetric (shared) key in the Diffie-Hellman
method is K = g
xy
mod p.
Note

21. 15.21
15.3.1Continued
Letusgiveatrivialexampletomaketheprocedureclear.Our
exampleusessmallnumbers,butnotethatinarealsituation,the
numbersareverylarge.Assumethatg=7andp=23.Thesteps
areasfollows:
Example 15.1
1.Alicechoosesx=3andcalculatesR
1=73mod23=21.
2.Bobchoosesy=6andcalculatesR
2=76mod23=4.
3.Alicesendsthenumber21toBob.
4.Bobsendsthenumber4toAlice.
5.AlicecalculatesthesymmetrickeyK=43mod23=18.
6.BobcalculatesthesymmetrickeyK=216mod23=18.
7.ThevalueofKisthesameforbothAliceandBob;
g
xy
modp=718mod35=18.

22. 15.22
15.3.1Continued
Letusgiveamorerealisticexample.Weusedaprogramtocreate
arandomintegerof512bits(theidealis1024bits).Theintegerp
isa159-digitnumber.Wealsochooseg,x,andyasshownbelow:
Example 15.2

23. 15.23
ThefollowingshowsthevaluesofR
1,R
2,andK.
15.3.1 Continued
Example 15.2Continued

24. 15.24
15.3.1 Continued
Figure 15.10 Diffie-Hellman idea

25. 15.25
SecurityofDiffie-Hellman
15.3.1 Continued
DiscreteLogarithmAttack
Man-in-the-MiddleAttack

26. 15.26
15.3.1 Continued
Figure 15.11 Man-in-the-middle attack

27. 15.27
15.3.2 Station-to-Station Key Agreement
Figure 15.12 Station-to-station key agreement method

28. 15.28
15-4 PUBLIC-KEY DISTRIBUTION
Inasymmetric-keycryptography,peopledonotneedto
knowasymmetricsharedkey;everyoneshieldsa
privatekeyandadvertisesapublickey.
15.4.1Public Announcement
15.4.2Trusted Center
15.4.3Controlled Trusted Center
15.4.4Certification Authority
15.4.5X.509
15.4.6Public-Key Infrastructures (PKI)
Topics discussed in this section:

29. 15.29
15.4.1 Public Announcement
Figure 15.13 Announcing a public key

30. 15.30
15.4.2 Trusted Center
Figure 15.14 Trusted center

31. 15.31
15.4.3 Controlled Trusted Center
Figure 15.15 Controlled trusted center

32. 15.32
15.4.4 Certification Authority
Figure 15.16 Certification authority

33. 15.33
15.4.5 X.509
Certificate
Figure15.17showstheformatofacertificate.

34. 15.34
CertificateRenewal
Eachcertificatehasaperiodofvalidity.Ifthereisno
problemwiththecertificate,theCAissuesanew
certificatebeforetheoldoneexpires.
15.4.5 Continued
CertificateRenewal
Insomecasesacertificatemustberevokedbeforeits
expiration.
DeltaRevocation
Tomakerevocationmoreefficient,thedeltacertificate
revocationlist(deltaCRL)hasbeenintroduced.

35. 15.35
15.4.5 Continued
Figure 15.17 Certificate revocation format

36. 15.36
15.4.6 Public-Key Infrastructures (PKI)
Figure 15.19 Some duties of a PKI

37. 15.37
TrustModel
15.4.6 Continued
Figure 15.20 PKI hierarchical model

38. 15.38
15.4.6Continued
ShowhowUser1,knowingonlythepublickeyoftheCA(the
root),canobtainaverifiedcopyofUser3’spublickey.
Example 15.3
Solution
User3sendsachainofcertificates,CA<<CA1>>and
CA1<<User3>>,toUser1.
a.User1validatesCA<<CA1>>usingthepublickeyofCA.
b.User1extractsthepublickeyofCA1fromCA<<CA1>>.
c.User1validatesCA1<<User3>>usingthepublickeyofCA1.
d.User1extractsthepublickeyofUser3fromCA1<<User3>>.

39. 15.39
15.4.6Continued
SomeWebbrowsers,suchasNetscapeandInternetExplorer,
includeasetofcertificatesfromindependentrootswithouta
single,high-level,authoritytocertifyeachroot.Onecanfindthe
listoftheserootsintheInternetExploreratTools/Internet
Options/Contents/Certificate/Trustedroots(usingpull-down
menu).Theuserthencanchooseanyofthisrootandviewthe
certificate.
Example 15.4

40. 15.40
15.4.6 Continued
Figure 15.21 Mesh model

41. 15.41
15.4.6Continued
AliceisundertheauthorityRoot1;Bobisundertheauthority
Root4.ShowhowAlicecanobtainBob’sverifiedpublickey.
Example 15.5
Solution
BobsendsachainofcertificatesfromRoot4toBob.Alicelooksat
thedirectoryofRoot1tofindRoot1<<Root1>>and
Root1<<Root4>>certificates.UsingtheprocessshowninFigure
15.21,AlicecanverifyBob’spublickey.