A Tutorial on Network Protocols - Cryptography and Network Security Video Lecture - Computer Science Engineering (CSE)

you
okay welcome to today's class so today
we shall be discussing about network
protocols so we essentially have been
studying about various primitives in
cryptography but this is the kind of
first objective I will first place where
we will try to combine or use the
cryptographic primitives and try to
build up a protocol for for security so
the protocol essentially there are
certain objectives in a protocol so the
first thing is to understand what are
the objectives in a protocol okay so and
there are various kinds of protocols
also existing in the literature so
presently we shall try to understand a
category or a type of protocols okay so
let us try to understand what are the
objectives that we shall be considering
in this class so the so first of all we
will try to essentially understand what
are the important and implicit
assumptions which are there in a
cryptographic protocol or what are the
requirements from a cryptographic
protocol so we shall actually consider a
five stage design of a three party
protocol for key establishment where we
shall see that some of the important
concerns are confidentiality
authentication and the fact that an
adversary can be an insider - and also
about the replay of old messages so
these are some of the things which some
of these things we have actually seen
previously but we shall see again them
and see them again in the context of a
protocol so not also another thing that
we essentially will be considering a
three-party protocol in this case but
there are various protocols which can
also be to parties but we the objective
of this particular discussion is to
understand the basic properties which
are required there in a protocol okay so
we shall be also understanding or
discussing about Needham Schroeder's
protocol and the Karbala protocol which
are very famous protocols in this domain
and we shall conclude with some
discussions so the first thing is that
what are the keys which exist in a
protocol so there are essentially two
types of keys which exist one which is a
long term key and the other which is a
session key now the long term key is
generally generated by a more costly
process which is could be like
diffie-hellman and it is stored in
protected places and it is generally
well preserved the idea is that
the cost of a long term key is quite
high so therefore it is probably
determined or established by a public
key exchange which is actually which
comes with an accompanying cost I mean
there is a cost on the network there is
a cost in terms of computation so
therefore the protocol or the systems we
will try to protect this long term keys
and change them less frequently as
opposed to that we have something we
just called as a session key which is
actually used to change per session and
changed much more regularly so the idea
is that these session keys are actually
more vulnerable are more prone or more
subjected to crypt analysis because
since what we do essentially we use we
generally setup or use a public key
protocol to set up a long term key and
then use this long term key to generate
session keys now this session key is
used for bulk encryption like for bulk
data encryption like when we are
actually using maybe a private key or a
symmetric key algorithm
and the idea is that therefore the
observer or the attacker actually sees
lot of cipher text which are generated
or used by the session key
so therefore the session key is actually
the the prime target of a standard
cryptanalytic approach okay so therefore
that implies that the session key needs
to be changed more regularly okay so in
our case also you will see that we will
assume that there are some long term
keys which are being already prepared or
stored in a tamper-proof place and it is
used to generate the session key we is
actually something sometimes also called
ephemeral the or the short-lived key
okay so so therefore the other the
context that we are considering right
now is actually there are two parties or
true legitimate entities that is Alice
and Bob and there is a third entity
which is that trusted server so the
trusted server actually has got
knowledge about Alice and Bob and it
tries to perform a key establishment
between a and B so therefore the
objective of a and B is to essentially
establish us new session key called kab
okay and this KB will be used for
further communication between Alice and
Bob right so that is the basic context
and the objectives of the key
establishment product
is that at the end of this particular
protocol kab should be known to only a B
and of course s because s is the trusted
server and also a and B should know that
kab is newly generally that is kab
should not be an old key it should be
kind of a fresh okay so that I these are
the two primary objectives behind this
protocol okay so now let us try to build
up this protocol and try to build up
this protocol in stays okay so the first
attempt could be a very simple attempt
so it could be like that is this a and B
which are actually the legitimate entity
entities and s is the trusted server
okay so what I could do is that a could
request s and say that I want to
generate a session key KB which I will
use for my further communications with
the party B so in a very near situation
s can directly send back kab and you
know that a can again we send it back to
be saying that ok this is the key which
s has send me and we will use it for
further communication
now obviously you understand that this
is a very nave protocol and therefore it
can be subjected to various kinds of
attacks okay now the attack we can if we
try to kind of write it in the form of a
security assumption we know that this
protocol is weak because we know that
the adversary is able to eavesdrop all
the messages that is these channels are
not at all trusted channels right so
since these channels are not trusted
channels and eavesdropper can simply
observe this traffic KB and get the
session key so of course this is not
what is intended so the obvious idea is
to use encryption right and that is the
second attempt so what we do is that we
send again a sense to s that it wants to
communicate with B and so it sends this
identifier a and B so note that these
identifiers could be in the form of
maybe your IP address or any anything
which indicates the particular ID the
particular user okay so we are
considering these two entities and a and
B are unique identifiers in the network
for the users a and B right and which s
also is aware of so
there4s is a trusted server now what is
does is that s takes kab or generate
somehow a KB and encrypts it by the long
term key so as we told that the long
term keys are there okay so the long
term keys have already been established
by some defilement kind of technique
which we have seen in our previous
classes and KB is communicated to a and
of course this is encrypted by K s and K
BS which are long term keys so therefore
you know that s is aware of the fact
that a and B are legitimate users right
and therefore it has in from from some
database it retrieves the value of K s
and K BS and encrypts it and gives it
back to a and B so now a also has the
long term key so a has a long term key
called K s and therefore it can take
this traffic and it can decrypt this and
obtain the value of K B right and what
it does is that the other part of the
traffic that is kab which is encrypted
by K BS it just communicates in a
ciphertext with along with the
identifier that is a so from the face of
this we know that the previous problem
is elevated that is the the key is not
being transferred in the in cleared
right and also be is aware of the fact
that it is establishing the key with a
so this is a better protocol definitely
like that than the previous protocol but
still it is vulnerable to attacks okay
the attack is possible because of this
assumption which is quite practical in
normal network is that the attacker is
able to alter messages using any
information available it is also able to
read out messages generate an insert
completely new message so which means
that the attacker is not necessarily a
passive attacker but it can be an active
attacker as well
right so it is capable of altering
messages it is capable of inserting new
messages and it is kind of it is not it
is just not passively observing the
network but it can also inject some
other extra information into the network
okay
so therefore what happens is a possible
attacked like this so let us consider
that there is
there is an adversary called C and we we
essentially see what she does is this
that is when a is being I mean when when
s communicates to a this encryption that
is K be encrypted with K s and K a be
encrypted with k vs what and therefore
we know that a communicates or rather
tries to send to be ka B which is
encrypted by K BS okay and a so what she
does is that instead it takes the first
part but modifies the second part and
makes it something like D right so what
what is the problem the problem is B
thinks that me takes the first part and
of course decrypts it and thinks that
that K every K is actually meant for
communicating with D so therefore you
see that a and B so that therefore the
second so therefore you remember the
objective of the of this protocol the
second objective was that at the end of
the protocol both an A and B should be
convinced that they are establishing a
new key and should know with whom they
are communicating right but in this case
there is a problem the problem is that B
thinks that it is communicating with D
and therefore what may happen is that
all use I mean what will happen is that
B may leak some information which is
meant only for D to a right so because b
may actually end up in communicating
things which are actually meant for
being only sent to D because it thinks
that it is using KB for communicating
with B can actually end up in leaking
those information to the user a so
therefore you see that this is an
example where C or the adversary does
not necessarily know the session key at
the end of the thing but it has
definitely sabotage the intention of the
protocol right the protocol was meant to
establish a key between a and B and it
was also meant to make sure that a knows
that it is communicating with B and B
knows that it is communicating with a
right so therefore this is a valid
immunity of this protocol the other
possible valid ability could be this
protocol where here C is not necessarily
an external you have external user but
it could be an
cider also okay so what may happen is
that see nose or rather see has got I
mean s nose that C is a valid user and
therefore there is a long term key we
just meant for see also in the database
of s so there could be like a long term
key which is k CS which is maintained in
the database of s so when a sense to s a
comma b seek may come in between the
traffic traffic and we modify the
traffic a comma b to a comma c right and
what may happen is that in this process
s will understand or think that it is
actually communicating with the rather
it is it is actually supposed to
generate a key which is meant for
communication between a and C and
therefore what it will do is that it
will generate a key or a session key
which is ka c and come and encrypt it
with Kas which is for a and also an the
other part will be with k CS which is
meant for c right and now when this
particular message comes to see what c
we will do is that it will take the
second part and decrypt it with k CS
because it has got k CS and obtain the
value of KC right and therefore what is
our next what it may do is that it may
be nine lis or harmless we just
communicate this traffic to a now a has
got no way of understanding that this is
not what it intends right to receive
because you see that this is also
nothing but a bit string this is also
nothing but a bit string right so
therefore there is no way of that a can
I actually understand well this is not
what is intended to be sent okay so
therefore it will take the first part
and it will decrypt it by KS and will
communicate back the next part that is
ka C encrypted with k CS and send it to
be right but note one thing that it may
happen that if you send this part to B
then B will decrypt it by its own key
right because B has got K BS and what
may happen is that it may get something
which is completely arbitrary right and
therefore may not be there may be a
problem so what C make know is that C me
instead come and
that traffic and block it from
being sent to B so therefore you see
that B has got no way of understanding
that there has been a problem and at the
end of the protocol what is happening is
that a who thinks that it is actually
communicating with B is actually
communicating with C so C is in this
case masquerading as B to a okay so C is
actually masquerading as B to a and
therefore it is obtaining all the
information which a actually sends for B
right so therefore you see that a thinks
he is communicating with B while he is
actually communicating with C so C knows
KCK AC and thus can masquerade as B to a
and obtain all the information which a
sends for B so therefore you see that
the assumption is that inside us can be
attackers or they can combine with
outsiders to pose attacks
so therefore the attacker need not be an
external agent but could be an insider
who has got a long term session key
established with the trusted server so
what is the implication of these two
protocols or rather these two protocol
attacks the implication is that we have
to use the identifier a and B inside the
encrypted packets okay
so therefore what I mean therefore the
idea is that the encryption algorithm in
this case has to be used for data
integrity and not for content
confidentiality so the previously we
have seen that we have used the
encryption algorithm for confidentiality
that was the first step but in this case
we have to are actually using the
encryption algorithm for data integrity
because we want to convince me that it
is actually communicating with a and I
want to convince a that it will actually
communicating with B right
so therefore the in this case the idea
is that a sends to s again a comma B but
when s sends back a message it takes
this B and a and puts it in the
plaintext and encrypts it along with Kb
okay so therefore you see that the
identifier is encrypted along with the
session key which has being generated
okay so now you see that the previous
attack will not work right because you
see sits mean between and modifies it
then it cannot generate because when the
even even decrypted it'll immediately
understand it it is be with whom he is
communicating right so therefore you see
that if see actually poisons or injects
a wrong message that will be immediately
be detected right and therefore the the
previous attack will not hold okay
so therefore what a does is that it just
takes the second part that is KB and a
and encrypts it I mean which has been
encrypted by K BS and just realize it
that to be so therefore the previous
problem is quite nicely solved okay so
here we see that the confidentiality is
achieved because since in the encryption
has been used an adversary cannot even
drop authentication has been enforced
because and an adversary cannot actually
alter the messages right but then we can
have a new security assumption the
assumption is based upon the fact that
there could be a scenario where the
adversary is aware of previous session
keys okay so it it could be like an
adversary was actually a member of the
group at some point of time but has left
that okay so now when again this attack
the moment when we are considering this
particular protocol at that point these
adversaries actually outside the group
but it knows a previously generated
session so these are typically called as
replay attacks okay so let us again
consider this particular protocol in the
light of this kind of scenario right so
let us consider that there is an
adversary see which does this so what
she does is that here see is replying
Macias which it has actually observed in
an old run of the protocol wire
eavesdropping so it could be either he
was dropping on it could be like it has
been a part of the previous protocol
okay
so however a has got no way of detecting
this and let's see what happens so
therefore a since this message a comma B
to C and he remember that C was actually
or rather a thinks that it is actually
communicating with s the trusted server
but instead C comes and receives the
message and instead of allowing the
message to go to s and come back to S
it actually replace up an old observed
message the old absurd message is what
it is K - a B which is an old session
key right and which has been encrypted
by KS along with the identifier B and K
- a B along with the identifier a which
has been encrypted by K BS so now you
note that this is an old traffic which
has been generated okay so this message
is been communicating to communicated
back to a so the what a does is that it
just takes the second part and
communicates and send it in to send it
to B now what is the problem the problem
here is that C has actually knowledge of
this K - a B which is an old generated
session right and therefore the session
key which has been actually established
between a and B is actually already
known to that verse right so therefore
in this case we are not able to enforce
the criteria that we want a and B to
establish a new key and not an old right
so remember that one of the objectives
of our protocol was that a and B should
actually generate a new key and not an
old carefresh key right the reason is
this because it may happen that Alt key
has leaked right and if the old key s
leaked that should not actually affect
my communication or the security of the
communication at this point right so
therefore here that the problem is that
you know that a has got no way of
detecting this right and ends up in
establishing an old session key so you
also can note that here C may not even
know the old key okay so we are
considering the fact that okay C may not
even known known the world key but then
again it has sabotage the basic purpose
of the protocol the purpose one of the
important purpose of the protocol was
that was establishment of a new session
key
the reason being very simple that is if
you ensure that always the old session
keys or the old session key is generated
and a new session key is not generated
then the East dropper can actually
obtain a lot of cipher texts which are
being generated by the same old key
right and then it can actually try out
various other cryptanalytic methods and
try to actually I mean
get the information about the key by
some other means right
so that's a basic purpose of changing
the T right because we want to ensure
that if I change the key then the
cryptanalyst is not actually getting
access to a large number of cipher texts
which have been generated by the same
key the same session key so if in this
case an adversary ensures that an old
key is being generated a new keys not
allowed to generate then that's also we
will say as a vulnerability of the
protocol a weakness in the protocol okay
so the in order to solve this kind of
protocol attacks the thing which is used
is some concepts like n ones or nonce
okay which are actually nothing but some
randomly generated fresh entities fresh
bit strings okay
people also use timestamps like that
maybe the that the time of the day right
so there are various other methods but
so idea is that an inverse is being
generated which is nothing but a random
value which is generated by one party
and return to that party to show that a
message is newly generated okay so what
may happen is that a sends to s a B
comma in a so the previous thing you see
that which was a comma B now we have
added a fresh n once which is n a now
what we do is that when s sends back the
message to a it takes the key ka B which
is the session key along with B along
with this na which is again sent back so
that when a decrypts it it's get back
this na and knows that it is the new
thing which has been generated right so
therefore the message which has been
received back is actually corresponding
to this message and hence in this fresh
alright and along with it is this thing
that is K B comma a which has been
encrypted by K BS and the whole thing
has been encrypted by K s okay so often
this small entity this is this K B comma
a which has been encrypted by K BS he is
called a ticket okay
so it is called a ticket like a wants to
communicate with me but in order to do
so it actually obtains a ticket from s
okay so it obtains two things you know
prints the session key along with the
ticket these are the two essential
things which it
Taine's from the Cerberus so what it
obtains is the session key kab along
with the ticket kV comma a which has
been encrypted by K BS so therefore you
see that when this traffic comes to a it
can use this long term key called KS and
decrypt and obtain back the value of kab
along with you need to also obtain the
value of Na be sure that this is not
already play and a new thing and also
this message this entity B which means
that it is actually Indian it is
communicating with B itself right and it
is there is no active adversary sitting
between a and s this is guaranteeing
that fact right so now what it does is
that it also obtains this ticket and it
is unable to decrypt this because KBS is
not known to a and it sends back the
ticket to B now you note that B knows
the value value of the long term key
which is K BS so it decrypts it obtains
kab which is the session key along with
the identifier a right now what it does
further is that it actually generates a
fresh MB which is again an N once
encrypts it with kab which is the new
session key and sends it to a now what
it does is that a decrements this NB
minus and obtains NB minus 1 again
encrypts it with kab and sends it back
to be ok now you note that this exchange
ensures to be or rather gives a
guaranteed to be that this is a freshly
generated key okay and it also ensures
to be that a is actually knowledgeable
about kab right that is a actually knows
KB right because whenever it decrypts
that it decreases by Kb it knows that
actually the thing which has used to
encrypt is the session key K B right so
it's a kind of key confirmation in the
context of B the B is confirmed that a
is actually having a knowledge of the
session key K B okay now this is a very
famous protocol and called as a Needham
and Schroeder's protocol okay so we see
that stage by stage we can actually
derive this Needham Schroeder's protocol
now this protocol is actually a central
I mean either it's a central to what we
know as the carbon hose protocol okay so
that is the next thing which we will
consider but before we go into that let
us consider yet another attack which can
take place because of the communication
between a and B the attack could be like
this that is the previous protocol
assumed that only a can correctly answer
the fourth challenge of me right but it
may happen again that C may know an old
key which is K - a B right
so therefore when B since I mean so if
you consider the previous protocol the
previous protocol this message was what
K B comma a encrypted with K BS right so
what will happen is that C may come in
between this communication and the main
information that is K - a B comma a
which has been encrypted by K BS now you
see that when BB creeps it actually
obtains K - AV which is again an old
right
so therefore when it encrypts or does
the freshness it really does not solve
the problem right because again we see
that a and B or rather at least B is
actually Jenna or rather obtaining the
old right which is again violating the
objective of the protocol so therefore
we need to again change this protocol
slightly and the change is as follows it
communicates to s a comma B comma n a
comma n B and s communicates to a this
message that is ka B comma B comma na
encrypted with KS and the other part is
K B comma a comma n B comma B just be
encrypted by K BS okay so now when a
obtains this first part it can actually
decrypt by using its long term key
obtain the session key K B and that's
idea so therefore you see that this is
obtained and when it sends back this
thing so this message that is the second
part then we again use the this is the
key K BS and decryption again off of
tends back in the session key K B right
however the previous protocol actually
tried to do something more than this
protocol so therefore the previous
protocol also try to ensure that there
is key confirmation for a right
so but however this protocol is actually
a lesser protocol or actually obtains
less but obtains it in a secured vessel
right the objective of a protocol is to
actually state some objectives and
achieve them right and if you state some
objectives and you are unable to achieve
them and actually open up some more
vulnerabilities then that's not a very
safe protocol to use okay so here you
see that there is a difference between
the previous protocols and this one the
difference is that the first message is
actually initiated by B right so in the
previous cases the messages were
initiated by a but in this case this
message is initiated by B and then it
has been communicated okay so that's one
change or other difference from between
the compared to the previous protocols
so now let us see some of the
discussions about protocol architectures
like it is so therefore this is a very I
mean well-known fact that it is not
possible to establish a new session key
if you don't have a prior Lea developed
knowledge as like what I mean to say
that if you want to agree upon a new
information then there has to be some
information which you have exchanged
previously okay it's a well-known fact
that is if I want to make a new session
key you have to assume that there is a
long term so that's basically very
central to the protocol that we are
discussing okay so therefore it is not
possible to establish an authenticated
session key without existing secure
channels already being available now and
in order to do this establishment do you
use servers like in the previous case we
have seen some cases of online servers
where our servers are actually part of
the protocols but in some other cases
there may be offline servers the offline
servers may actually give something
which is known as public keys and can
distribute it along among the network
okay so it could be like a public key
infrastructure or a PKI as commonly
called okay so so therefore there can be
offline servers there can be online
servers and depending upon that there
are various kinds of protocols right
so now let us see one very famous
protocol which is used in distributed
networking it is called as the carbonyls
protocol now you if you have followed
the Needham Schroeder's protocol you
will see that there is a very strong
application of the idea their idea in
this protocol so here there is a key
distribution center and consider that
there is a user client see who wants to
actually use some application which is
there in the server s so in order to do
so it has to communicate with this key
distribution center and often tickets
okay so tickets are kind of like will
enable you to access a particular
service okay so what it does is that it
first communicates with the Kerberos
server so the key distribution center
has made of two servers one is called
the Kerberos server the other is called
the ticket granting server or the TGS
okay so what the user client does is
that it sends request to this Carrboro
server and asks for a ticket to
communicate to the ticket granting
server so this - actually is the ticket
for TGS for communication with the
ticket granting server then the client
actually communicates with the ticket
granting server and does a request for
the actual server ticket like the cert
ticket for the service which it wants
from this server s so then the ticket
granting server gives it back the gives
our ticket to the user client the user
client they're actually requests for the
service and obtains the corresponding
response or the service this is a broad
idea so you see that this is actually
straightaway an application of the
Needham Schroeder's protocol because in
the read intruders protocol so this was
the central server and this was a and
this was B you can imagine like this
okay similarly when you are
communicating to communicate with this
then this is a this is B and this is the
central server s right so you see the
analogy right between that Needham
Schroeder's protocol and the car
Burroughs protocol so so there are three
phases in this as you see okay the first
phase is like this the user actually
communicates with the client
and sends its own identifier which is
you the the client then sends back to
the to K that is so that you see that
what we are saying is that we are
actually dividing this user and the
client into two entities okay so there
is something like you can imagine like I
am sitting or what a machine which is my
which is the which is actually the
client and I am the user okay so the
user logs into this client and wants to
use this service right so there is an
amount of authentication between the
user and the client as well right
so therefore what the user sends that
what I send to the client is my own
identified so it could be in the form of
a logging right and what the client
sends back sends to K that is the
Kerberos server is these two things that
is is identifier of the user along with
the identifier of the ticket granting
service where it wants to communicate
with okay so on received of this
information the Kerberos server
generates a session key which is called
as K ut Jesus so K u TGS is the session
key which is used which is to be used by
the user or the client to communicate
with the ticket granting service okay so
remember the previous Needham
Schroeder's protocol so the PDA previous
theorem products products protocol imply
that the this Kerberos server has a key
has a long term key for the ticket
granting service as well as a long time
key for the client right so therefore
these are the long term peace so the
long term keys are I mean there are two
long term keys right so you understand
that there is one key which is the KD GS
k TDS means it is the long term key for
of the of the of the Kerberos server for
the ticket granting service and there is
another long term key which is the k you
which is which is maintained by the
Kerberos server for the user you okay so
what it does is this that is first on
received of this information the
Kerberos server generates session key
called kayuu TGS which is to be used
between the user and the TGS the k TK u
TGS is
the session key okay so and it also
creates a ticket
tu TGS so that means that it is for user
knew to communicate with the ticket
granting service and the ticket actually
comprises of the user you the identifier
of the user you the TGS which is the
server of the the identifier of the
ticket granting service or the server
and also the session key which is kayuu
TGS along with the timestamp and the
life of this ticket okay so there is a
kind of life or expiry date of this
ticket okay and this entire ticket has
been encrypted by K TGS which is a long
term key which is maintained by the
server K that is Carrboro server for the
ticket granting service okay so Katie GS
is a key which is shared between K and
TGS so it's again a long term T TGS has
previously a knowledge of KT G's
KT the the the ticket granting service
is always already aware of this Katie
jeez okay so therefore immediately when
the ticket granting service receives
this packet it can actually decrypt this
by Katie's yes and obtain the value of
the session key K u comma TGS all right
and since this and when this Carrboro
server sends to the client it sends this
k u TGS along with this ticket tu TGS
along with this identifier of the ticket
granting service and the timestamp and
the life it encrypts this packet by this
long term key k u so therefore again the
client or the user is aware of this key
right and therefore it will actually
decrypt this and obtain the value of the
session key all right and the idea is
that the client uses its key which is
generated from a password which could be
by a one-way function and decrypt this
corresponding message and if this
authentication is successful then that
client will store the session key that
ticket and other information for future
use okay so it will store this ticket as
well as these k u comma TGS for further
use okay
so therefore what the client does now is
that it has to communicate with what
with the ticket context
servus right because it has to convey
the the convey what convey the session
key to the ticket granting service so
what it does is that it sends the tu
cama tedious like this because use note
that this tube comma tedious is already
encrypted right so you don't need to
encrypt it and also the identifier of
the server so now you see that it is
sending the identifier of the of s
because s is now the service which it
wants right s is this one s is this
service identified okay so now when it
sends this information to the TGS it
also sends that I want to actually
communicate with the server and I want
the corresponding ticket for
communicating with the server right so
now what it does is that along with it
it also gives or generates an
Authenticator the Authenticator is very
simple it actually uses the session key
called ko TGS the session key means the
session key between the user and the
ticket granting service and generates a
timestamp along with the its own
identifier that is the clients
identifier and sends it along with this
message to the ticket granting service
now you see that from this ticket the
client sorry the ticket granting service
actually obtains a value of of ke u
comma TGS which is the session key right
and it can immediately decrypt this
Authenticator because this authenticated
is been encrypted using ke u comma TGS
and obtains back this value of timestamp
right obtains the knowledge and gets the
timestamp which has been used in this
message right and therefore when in the
next message when the ticket granting
service communicates back with the
client it actually uses this timestamp
to indicate again that is a fresh
message and not a case of replay which
has been send it right and therefore you
see that the corresponding ticket now
the ticket granting service is actually
sending a message back to the user and
sending what sending the ticket for
communicating with the server along with
the session key which the user will
actually use to communicate with the
server right so there are two things we
are needed to be communicated one is
say shonky and the ticket the other
thing is the ticket right and therefore
when it sends it it will send this
corresponding cake C comma s and also
the time and along with the time stamp
to indicate that it is not a case of the
replay attack and also the life of the
ticket right so this is actually sent
along with KC comma s what is KC
Akamai's it is a session key between the
client and the server right so there are
two important things along with the S
which is the identifier of the server
along with the timestamp and the life
right so you see that everything has got
its importance
right the ticket has got is important
importance every place where you are
using the encryption also has got a
meaning right so on receiving this
message the client will decrypt and
obtain the session key KC comma s and
the corresponding ticket which is TC
comma s which can be used for further
request service from the server so
immediately when C receives this it has
actually you obtain the corresponding
session key and also the ticket right so
now what the client will do is that it
will communicate with the server s and
it will send simply that ticket TC comma
s along with an authenticated which is
again similarly generated like the
previous of indicator only this time you
are encrypting by the corresponding
session key which is case C comma s and
encrypting the corresponding timestamp
right so the idea is that when the
server receives it it obtains the
corresponding session key and if it once
you can again send back the
Authenticator
I mean corresponding timestamp so that
it is again clear that there is again no
case of replay between the client and
the server right so therefore one
received of this the server decrypts the
ticket TC comma s and obtains the
session key KC comma s which is used to
decrypt Authenticator the server s takes
whether the message is fresh or not
right because the server is can check
whether the messages is fresh because it
has because you see that how the ticket
has been generated because the ticket
also has a timestamp
ok and the message that you are saying
is authenticated also at the timestamp
right so therefore you can immediately
under
and that whether the authenticator also
the timestamp so you understand that the
server is will check whether the message
is fresh or not because it can compare
these two things yeah and see the life
of that ticket right so the timestamp
and the life are used to check that it
is indeed a fresh message and prevail
and actually prevent replay kind of
analysis right so this is the broad idea
behind behind this kind of protocol
attacks so therefore you see that the
previous three things that is the the
three phases like the phase one where
you are actually obtaining a ticket for
communicating between the client and the
server okay and you're obtaining a
ticket for communicating between the
client and the server I mean the first
one was client and the ticket granting
server second one is the client and the
actual server is actually based on the
new demand Schroeder's protocol right
and and essentially the object above
this protocol is to actually obtain the
three important criteria the three
important criteria are essentially that
our eavesdropper will not be able to
observe the second one is that there
should not be any insider who can
actually do an attack okay and even if
the old key is being retrieved and I
mean even if the whole key is leaked
right
it should not be again used I mean it
should not be like the old key is again
again forced to be generated by the
parties involved and the other thing is
that you are also ensuring that there is
a kind of freshness in the keys that you
are generating right that is so these
ideas are kind of related but these are
the important objectives behind a
protocol of this nature okay so now you
can have various varieties of protocols
you can have protocols which are two
parties three parties multi parties but
the idea is that the objectives or the
basic objectives are essentially the
same right
so this carbons protocol was actually a
part of a product I mean part of a
product which is generated by MIT so so
now there can be various modes of
session key generation there could be
like things like key transport where one
principal generates the key which is
transferred to the other so therefore as
we have seen in the previous cases where
examples of key transport because the
session has been generated by the server
and it has been actually passed to both
a and B in some form there could be some
other protocols where the session key is
actually a function of inputs generated
by all parties like if there are two
parties a and B and both actually gives
some kind of a share then that is used
to generate a key okay so a classic
example of that is something as we have
seen is the example of the famous
diffie-hellman protocol where you know
that there is a generator of this there
is a generator which has been previously
established and it could be like X so
generator means generated of a finite
field okay and a finite group and X is a
member of this which is which is
generated randomly and we also generates
Y which is a random shear okay so what a
does is that a communicator computes
this value of G power of X this could be
modulo a given prime number okay so and
the other thing which can be generated
by B is G power of Y mod P and what may
happen is that this is communicated to B
and again this is communicated to a and
now when G power of Y mod P comes to a
it actually takes the power of Y and
raises it to this power of X and what it
does is that it takes the power of X and
raises to power of Y okay and in both
cases we know that these are the same
okay so therefore if you take a modulo P
then the both of these are exactly the
same so you see that here also we have
actually generated a randomly number a
random number X and a random input Y and
you are actually establishing our key
which is G power of XY between these two
parties right so this is a classic
example of a key
okay we're key agreement between the
parties a and B where the session key is
actually a function of the shares which
has been generated by a and B so
typically we can say that there is a
function called F and they are a and B
has actually contributed and generated
like in B and na and the session key K a
B is actually a function of both na
Anning B right
so therefore this function has to ensure
that it is neither stood towards na or
neither skewed towards NB both of them
should have an equal contribution to the
value of KB right because what we will
consider the case of krypton is that I
have a knowledge of Na along with some
public information can I obtain this
value of KB right so in this case for
example imagine like if you actually
know the value of x and you know the
value of G power of Y then you know that
immediately you can calculate G power of
X Y right but as a cryptanalytic point
of view you will be interested like
because if there is an evil dropout who
observes this then eye dropper obtains
what G power of X G power of X mod P and
G power of Y mod P and it is interested
to find out some way of computing the
value of G power of X Y mod P so this we
have seen is believed to be a difficult
problem which is known as a famous defi
element problem right so therefore the
idea is that the function f should not
be skewed towards either na or in be
okay and it's typically a one-way
function because it is also important
that a knowledge of kab does not
actually reveal the value of Na and NB
so therefore we would like ideally at
the end of the protocol also a and B
should not be aware like a should not be
aware and get a knowledge of Y and B
should not get a value of x okay so
therefore the typical requirement of a
protocol or rather a function would be
that it has to be essentially one way by
nature okay so there are some other
protocols which are also hybrid so
hybrid means they're partially it is
actually a key transport protocol and
partially
is actual agreement protocol okay so
therefore it could be like partially the
protocol is a hybrid name I mean it's
actually a key transport that is if
there are two members a and B then two a
it is a key transport but maybe 2 B it
is actually an agreement ok so there
could be various kind of protocols as
well okay so let us see one example we
will see one example of a hybrid
protocol you can also categorize your
protocols based upon the number of users
so you can have as I told you that two
party protocols or multi-party or which
is also called as conference key
protocols okay so therefore if you are
going for confidence key protocols they
look only complicate the matter a great
deal and there will be more other
criteria and requirements we will come
up but the basic criteria that which we
have seen already will still remain okay
so therefore it will only make it like
the protocols have to be more complex
and has to it has to consider more
practical scenarios and problems okay so
now let us see one example of a hybrid
protocol so here there are again three
parties a B and s which is involved and
you see that a actually communicates
with B and sends a comma any okay so
therefore a will communicate to B and
send the value of a and also a fresh
input which is generated and called as
any now what B sends back to s is n B
comma a comma B comma K BS so you see
that this is quite as I mean as we have
seen in the previous case right the
protocol as we have seen in the previous
context it's just one packet like that
okay and so there is a fifth protocol
similar to that fifth protocol okay so
you see that this is being generated and
sends and B sends this to the server s
so me actually sends it back to s and
what the other thing which is also since
is the corresponding value of na
okay so na is also the other thing which
has been obtained from a I mean B has
received the corresponding entity from a
and it has just related back to s okay
so what s does is that s sends to a a
key which is called as kab which is a
newly generated session T KB along with
a
along with B along with this fresh na
and it has encrypted the entire thing by
a long term key called as KS okay so the
and you know that the other thing we
just mean st. he is this value of NS
okay so the NS is a fresh number which
is being generated by the server okay
now what a does or a sends to B is this
NS okay along with a and B we just now
been encrypted by kab so you're not one
thing that in this case the a a has
actually obtained back obtain the key
right it has just got back the key from
the server because it has been just
transported to a right the key has been
just transported to a and it has just
got it can simply obtain it by
decrypting this packet by using its long
term key called case right now what B
does is that B sends again back to aka B
I mean B comma a which has been
encrypted by kab but if you observe here
that if you observe one interesting
point here is that so far as V is
concerned B has actually not been
provided kab explicitly okay because we
has never actually obtained kab
explicitly you see that B what are the
messages B has actually got me has a
knowledge of Na okay and it has also got
the knowledge of NB of course and it has
also got the knowledge of NS because
that is the thing which the server has
communicated to me through a right now
how is the saga generated this key KB
that is important because that KB has
been generated by the server and
communicated to a now what the server
does is that using its key or other part
in s and the part in B it actually
applies a one-way kind of function and
obtain session key call as kab okay and
this KB is actually again can be
generated by B because b also has got a
knowledge of NS and it has
got a knowledge of na NB okay so B also
has got a knowledge of NB of course
because it is its own key okay so
therefore now it can again apply this
function f and it can obtain the value
of K kab so therefore so whereas B is
concerned means actually not been given
kab explicitly but it has been used to
compute a function if by using it has
been used by or rather generated by
computing a function f okay so therefore
to be this is an example of agreement
while for a it is actually an example of
key transport so these are typical
example of a hybrid kind of protocol
where to one party it is a transport and
to the other party it is an example of a
agreement okay so the conclusion is that
we have learned some basic tools to
understand and build secured protocols
there is a huge literature on protocols
attacks on protocols security analysis
of protocols and the idea is that clever
and proper integration is very much
necessary for a complete end-to-end
security okay so we have seen that we
have to apply your basic encryption
tools and basic techniques in a clever
way and ensure that attacks are really I
mean at least the known attacks do not
work okay that is and we can actually
consider this problem this is a problem
which is known as the famous outward
East protocol okay so here what it does
is that a sends to B in this this Macias
M comma a comma B and sends this packet
in a comma M comma a comma B which has
been encrypted by KS which is again a
long term key B sends to s M comma a
comma B and the second and this packet
is in a comma M comma a comma B which
has been encrypted by KS the other part
is n B comma M comma a comma b kb it has
been encrypted by K BS the server s
sends to B this M along with in a comma
K a B that is in a generator decision TK
be encrypted it by KS the other part is
NB comma kab which has been encrypted by
K BS
okay and B sends to a in a comma K B
comma a which has been encrypted by K a
so this is a classic protocol but you
can imagine that if the length of na
comma M a and K B are same then this
there
can be a potential attack against this
protocol okay so you can just think
about this another how the product can
work as a hint you can note that the
first message in a second message or the
first and the fourth message has got a
has goddess or than the first on a third
message has got a similarity that is
this part and this part you can observe
that this packet and this packet and
this packet have all been generated by
KS it has been encrypted by KS right so
you can just think or ponder about
whether this fact can be actually
exploited for developing an attack and
also known to the adversary and the
players observe the mysterious bit
strings are not as formal notations okay
so it will not observe this so therefore
if there is a class there is a knob at a
card which can sit between the clients
and it can actually send some bit
strings which are not detectable by the
receiver and can somehow fool this
protocol then there can be an attack
right so therefore you can just consider
whether this protocol is safe against a
possible adversary so I have actually
used this reference called protocols for
authentication and key establishment by
Colleen Boyle and on each Masseria very
extensively for this particular lecture
the the 5 stage protocol you can
actually find detailed in this book and
you can actually read it for more
references there is a huge repository of
protocols present and is an excellent
treatment on this subject you can also
refer to these other books which also
have been used so you can find more
reference on the carbons protocols in
this particular text so next day we
shall actually take up the topic on
system security
you