Chapter 8

Security

Computer Networking:
A Top-Down Approach
8th edition
Jim Kurose, Keith Ross
Pearson, 2020
What is network security?
confidentiality: only sender, intended receiver should
“understand” message contents
• sender encrypts message
• receiver decrypts message
authentication: sender, receiver want to confirm identity of
each other
message integrity: sender, receiver want to ensure message
not altered (in transit, or afterwards) without detection
access and availability: services must be accessible and
available to users

Security: 8- 2
The language of cryptography
Alice’s Bob’s
KA encryption KB decryption
key key
plaintext encryption ciphertext decryption plaintext
algorithm algorithm

m: plaintext message
KA(m): ciphertext, encrypted with key KA
m = KB(KA(m))
Security: 8- 3
Breaking an encryption scheme
 cipher-text only attack:  known-plaintext attack:
Trudy has ciphertext she Trudy has plaintext
can analyze corresponding to
 two approaches: ciphertext
• brute force: search • e.g., in monoalphabetic
cipher, Trudy determines
through all keys pairings for a,l,i,c,e,b,o,
• statistical analysis
 chosen-plaintext attack:
Trudy can get ciphertext
for chosen plaintext
Security: 8- 4
Symmetric key cryptography
KS KS

plaintext encryption ciphertext decryption plaintext

algorithm KS(m) algorithm

symmetric key crypto: Bob and Alice share same

(symmetric) key: K
 e.g., key is knowing substitution pattern in mono alphabetic
substitution cipher
Q: how do Bob and Alice agree on key value?
Security: 8- 5
Simple encryption scheme
substitution cipher: substituting one thing for another
 monoalphabetic cipher: substitute one letter for another

plaintext: abcdefghijklmnopqrstuvwxyz

ciphertext: mnbvcxzasdfghjklpoiuytrewq

e.g.: Plaintext: bob. How are you. alice

ciphertext: nkn. akr moc wky. mgsbc

Encryption key: mapping from set of 26 letters

to set of 26 letters
Security: 8- 6
A more sophisticated encryption approach
 n substitution ciphers, M1,M2,…,Mn
 cycling pattern:
• e.g., n=4: M1,M3,M4,M3,M2; M1,M3,M4,M3,M2; ..
 for each new plaintext symbol, use subsequent
substitution pattern in cyclic pattern
• dog: d from M1, o from M3, g from M4

Encryption key: n substitution ciphers, and cyclic

pattern
• key need not be just n-bit pattern

Security: 8- 7
Symmetric key crypto: DES
DES: Data Encryption Standard
 US encryption standard [NIST 1993]
 56-bit symmetric key, 64-bit plaintext input
 block cipher with cipher block chaining
 how secure is DES?
• DES Challenge: 56-bit-key-encrypted phrase decrypted (brute
force) in less than a day
• no known good analytic attack
 making DES more secure:
• 3DES: encrypt 3 times with 3 different keys

Security: 8- 8
AES: Advanced Encryption Standard
 symmetric-key NIST standard, replaced DES (Nov 2001)
 processes data in 128 bit blocks
 128, 192, or 256 bit keys
 brute force decryption (try each key) taking 1 sec on
DES, takes 149 trillion years for AES

Security: 8- 9
Public Key Cryptography
symmetric key crypto: public key crypto
 requires sender, receiver  radically different
know shared secret key approach [Diffie-
 Q: how to agree on key in Hellman76, RSA78]
first place (particularly if  sender, receiver do not
never “met”)? share secret key
 public encryption key
known to all
 private decryption key
known only to receiver

Security: 8- 10
Public Key Cryptography
+
K
B
Bob’s public key
-
K Bob’s private key
B

plaintext encryption ciphertext decryption plaintext

message, m algorithm +
K (m) algorithm m = K - (K +(m))
B B B

Wow - public key cryptography revolutionized 2000-year-old

(previously only symmetric key) cryptography!
• similar ideas emerged at roughly same time, independently in US and UK
(classified) Security: 8- 11
Public key encryption algorithms
requirements:
1 need K
B
+
.( ) and BK- .( ) such that
- +
K (K (m)) = m
B B
+
2 given public key BK
, it should be
-
impossible to computeB private key K

RSA: Rivest, Shamir, Adelson algorithm

Security: 8- 12
Prerequisite: modular arithmetic
 x mod n = remainder of x when divide by
n
 facts:
[(a mod n) + (b mod n)] mod n = (a+b) mod n
[(a mod n) - (b mod n)] mod n = (a-b) mod n
[(a mod n) * (b mod n)] mod n = (a*b) mod n
 thus
(a mod n) mod n = a mod n
d d

 example: x=14, n=10, d=2:

(x mod n) mod n = 4 mod 10 = 6
d 2

dx = 14 = 196 x mod 10 = 6
2 d

Security: 8- 13
RSA: getting ready
 message: just a bit pattern
 bit pattern can be uniquely represented by an integer
number
 thus, encrypting a message is equivalent to encrypting a
number
example:
 m= 10010001. This message is uniquely represented by the
decimal number 145.
 to encrypt m, we encrypt the corresponding number, which gives
a new number (the ciphertext).
Security: 8- 14
RSA: Creating public/private key pair
1. choose two large prime numbers p, q. (e.g., 1024 bits
each)
2. compute n = pq, z = (p-1)(q
-1)
3. choose e (with e<n) that has no common factors with z (e,
z are “relatively prime”).
4. choose d such that ed-1 is exactly divisible by z. (in other
words: ed mod z = 1 ).
5. public key is (n,e). private key is (n,
d).
KB+ KB-
Security: 8- 15
RSA: encryption, decryption
0. given (n,e) and (n,d) as computed above
1. to encrypt message m (<n), compute
c = me mod
n
2. to decrypt received bit pattern, c, compute
m = c d mod n

magic happens e mod d mod

m = (m
! n) c n

Security: 8- 16
RSA example:
Bob chooses p=5, q=7. Then n=35, z=24.
e=5 (so e, z relatively prime).
d=29 (so ed-1 exactly divisible by z).
encrypting 8-bit messages.

bit pattern m me c = memod n

encrypt:
0000l000 12 24832 17

decrypt:
c cd m = cdmod n
17481968572106750915091411825223071697 12

Security: 8- 17
Why does RSA work?
 must show that cd mod n = m, where c = me mod n
 fact: for any x and y: xy mod n = x(y mod z) mod n
• where n= pq and z = (p-1)(q-1)
 thus,
cd mod n = (me mod n)d mod n
= med mod n
= m(ed mod z) mod n
= m1 mod n
=m
Security: 8- 18
RSA: another important property
The following property will be very useful later:
- + + -
K B(K (m)) = m= K (K (m))
B B B

use public key use private key

first, followed first, followed
by private key by public key

result is the same!

Security: 8- 19
 - + + -
Why K B(KB(m)) = m= KB(KB (m))?
follows directly from modular arithmetic:

(me mod n)d mod n = med mod n

= mde mod n
= (md mod n)e mod n

Security: 8- 20
Why is RSA secure?
 suppose you know Bob’s public key (n,e). How hard is it to
determine d?
 essentially need to find factors of n without knowing the
two factors p and q
• fact: factoring a big number is hard

Security: 8- 21
RSA in practice: session keys
 exponentiation in RSA is computationally intensive
 DES is at least 100 times faster than RSA
 use public key crypto to establish secure connection,
then establish second key – symmetric session key –
for encrypting data
session key, KS

 Bob and Alice use RSA to exchange a symmetric session key

KS

 once both have K , they use symmetric key cryptography

S

Security: 8- 22
 Authentication
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap1.0: Alice says “I am Alice”

“I am Alice” failure scenario??

Security: 8- 23
 Authentication
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap1.0: Alice says “I am Alice”

in a network,
Bob can not
“see” Alice, so
Trudy simply
“I am Alice” declares herself
to be Alice

Security: 8- 24
Authentication: another try
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap2.0: Alice says “I am Alice” in an IP packet
containing her source IP address

Alice’s
IP address “I am Alice”
failure scenario??

Security: 8- 25
Authentication: another try
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap2.0: Alice says “I am Alice” in an IP packet
containing her source IP address

Trudy can create

a packet “spoofing”
Alice’s
Alice’s address
IP address “I am Alice”

Security: 8- 26
Authentication: a third try
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap3.0: Alice says “I am Alice” and sends her secret
password to “prove” it.

Alice’s Alice’s
IP addr password “I am Alice” failure scenario??
Alice’s OK
IP addr

Security: 8- 27
Authentication: a third try
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap3.0: Alice says “I am Alice” and sends her secret
password to “prove” it.
playback attack:
Alice’s Alice’s
IP addr password “I am Alice” Trudy records
Alice’s packet
” and later
Alice
m
e’s rd“I a
plays it back to
ic
s
l
A wo
s ce’s OK Bob
e’
Alic ddr p
as Ali ddr
IP a IP a

Security: 8- 28
Authentication: a modified third try
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap3.0: Alice says “I am Alice” and sends her
encrypted secret password to “prove” it.

Alice’s encrypted
IP addr password “I am Alice” failure scenario??
Alice’s OK
IP addr

Security: 8- 29
Authentication: a modified third try
Goal: Bob wants Alice to “prove” her identity to him
Protocol ap3.0: Alice says “I am Alice” and sends her
encrypted secret password to “prove” it.

Alice’s encrypted
IP addr password “I am Alice” playback attack still
works: Trudy
Alice
” records Alice’s
y
m
ptedd“I a packet
cr
n swor s OK
e’s e
Alic ddr p
as ce’
Ali ddr and later plays it
IP a
IP a back to Bob
Security: 8- 30
 Authentication: a fourth try
Goal: avoid playback attack
nonce: number (R) used only once-in-a-lifetime
protocol ap4.0: to prove Alice “live”, Bob sends Alice nonce,
R
 Alice must return R, encrypted with shared secret key
“I am Alice”

R
KA-B(R) Bob know Alice is live,
and only Alice knows key
to encrypt nonce, so it
Failures, drawbacks? must be Alice!
Security: 8- 31
Authentication: ap5.0
ap4.0 requires shared symmetric key - can we authenticate
using public key techniques?
ap5.0: use nonce, public key cryptography

“I am Alice”
Bob computes
R + -
- K (K (R)) = R
K A (R) A A
and knows only Alice could
Send me your public key have the private key, that
+ encrypted R such that
K A (R) + -
K (K (R)) = R
A A
Security: 8- 32
 Authentication: ap5.0 – there’s still a flaw!
man (or woman) in the middle attack: Trudy poses as Alice (to
Bob) and as Bob (to Alice)

I am Alice I am Alice
R

?
-
K (R)
T
R Where are Send me your public key
- mistakes +
K (R) K Bob computes
A made here? T + -
Send me your public key K(K T(R)) = R,
+ T
K authenticating
A Trudy as Alice
Trudy recovers m: +
Trudy recovers Bob’s m: + - + K (m) Bob sends a
- + m = K (K (m)) T
m = K (K (m)) K (m) T T personal message,
A A A sends m to Alice m to Alice
and she and Bob meet a encrypted with
week later in person and Alice’s public key
discuss m, not knowing
Trudy knows m
Security: 8- 33
Digital signatures
cryptographic technique analogous to hand-written signatures:
 sender (Bob) digitally signs document: he is document owner/creator.
 verifiable, nonforgeable: recipient (Alice) can prove to someone that
Bob, and no one else (including Alice), must have signed document
 simple digital signature for message m:
• Bob signs m by encrypting with his private key K , creating “signed” message,
B

K -(m)
B

- -
Bob’s message, m K B Bob’s private m,K B(m)
key
Dear Alice Dear Alice
Oh, how I have missed Oh, how I have missed
you. I think of you all
Public key you. I think of you all
the time! …(blah blah encryption the time! …(blah blah
blah)
algorithm blah) -
KB(m)
Bob Bob
Security: 8- 34
Digital signatures
-
 suppose Alice receives msg m, with signature: m, KB(m)
+ -
 Alice verifies m signed by Bob by applying Bob’s public key KB to
+ -
KB+(m)
- then checks KB(KB(m) ) = m.

 If KB(KB(m) ) = m, whoever signed m must have used Bob’s private

key
Alice thus verifies that:
 Bob signed m
 no one else signed m
 Bob signed m and not m’
non-repudiation: -
 Alice can take m, and signature K (m) to court and prove
that Bob signed m
B

Security: 8- 35
Message digests
computationally expensive to public-key-encrypt long
messages
goal: fixed-length, easy- to-compute digital “fingerprint”
 apply hash function H to m, get fixed size message digest, H(m)
large
H: Hash
messag H(m)
e Function
m
Hash function properties:
 many-to-1
 produces fixed-size msg digest (fingerprint)
 given message digest x, computationally infeasible to find m
such that x = H(m)
Security: 8- 36
Internet checksum: poor crypto hash function
Internet checksum has some properties of hash function:
 produces fixed length digest (16-bit sum) of message
 is many-to-one
but given message with given hash value, it is easy to find
another message with same hash value:
message ASCII format message ASCII format
IOU1 49 4F 55 31 IOU9 49 4F 55 39
00.9 30 30 2E 39 00.1 30 30 2E 31
9BOB 39 42 D2 42 9BOB 39 42 D2 42
B2 C1 D2 AC different messages B2 C1 D2 AC
but identical checksums!
Security: 8- 37
Digital signature = signed message digest
Bob sends digitally signed Alice verifies signature,
message: integrity of digitally signed
large
message H: Hash
H(m) message:
m Function encrypted
message
-
KBdigest
(H(m))
digital
Bob’s signature large
private -
key KB (encrypt) message
m digital
Bob’s signature
public +
key KB (decrypt)
encrypted H: Hash
+ message
- function
KBdigest
(H(m))
H(m) H(m)

?
equal
Security: 8- 38
Hash function algorithms
 MD5 hash function widely used (RFC 1321)
• computes 128-bit message digest in 4-step process.
• arbitrary 128-bit string x, appears difficult to construct msg m
whose MD5 hash is equal to x
 SHA-1 is also used
• US standard [NIST, FIPS PUB 180-1]
• 160-bit message digest

Security: 8- 39
 Authentication: ap5.0 – let’s fix it!!
Recall the problem: Trudy poses as Alice (to Bob) and as Bob (to
Alice)

I am Alice I am Alice
R

?
-
K (R)
T
R Where are Send me your public key
- mistakes +
K (R) K Bob computes
A made here? T + -
Send me your public key K(K T(R)) = R,
+ T
K authenticating
A Trudy as Alice
Trudy recovers m: +
Trudy recovers Bob’s m: + - + K (m) Bob sends a
- + m = K (K (m)) T
m = K (K (m)) K (m) T T personal message,
A A A sends m to Alice m to Alice
and she and Bob meet a encrypted with
week later in person and Alice’s public key
discuss m, not knowing
Trudy knows m
Security: 8- 40
Need for certified public keys
 motivation: Trudy plays pizza prank on
Bob
• Trudy creates e-mail order:
Dear Pizza Store, Please deliver to me
four pepperoni pizzas. Thank you, Bob
• Trudy signs order with her private key
• Trudy sends order to Pizza Store
• Trudy sends to Pizza Store her public
key, but says it’s Bob’s public key
• Pizza Store verifies signature; then
delivers four pepperoni pizzas to Bob
• Bob doesn’t even like pepperoni

Security: 8- 41
Public key Certification Authorities (CA)
 certification authority (CA): binds public key to particular entity,
E
 entity (person, website, router) registers its public key with CE
provides “proof of identity” to CA
• CA creates certificate binding identity E to E’s public key
• certificate containing E’s public key digitally signed by CA: CA says
“this is E’s public key”
Bob’s digital
public + signature +
key KB (encrypt) KB

CA’s
Bob’s
private
key
-
K certificate for Bob’s
identifying
CA public key, signed by
information CA

Security: 8- 42
Public key Certification Authorities (CA)
 when Alice wants Bob’s public key:
• gets Bob’s certificate (Bob or elsewhere)
• apply CA’s public key to Bob’s certificate, get Bob’s public key

+
digital Bob’s
KB signature + public
(decrypt) K B key

CA’s
public +
key KCA

Security: 8- 43
Firewalls
firewall
isolates organization’s internal network from larger
Internet, allowing some packets to pass, blocking
others

administered public
network Internet
trusted “good guys” untrusted “bad guys”
firewall
Security: 8- 44
Firewalls: why
prevent denial of service attacks:
 SYN flooding: attacker establishes many bogus TCP connections,
no resources left for “real” connections
prevent illegal modification/access of internal data
 e.g., attacker replaces CIA’s homepage with something else
allow only authorized access to inside network
 set of authenticated users/hosts
three types of firewalls:
 stateless packet filters
 stateful packet filters
 application gateways

Security: 8- 45
Stateless packet filtering
Should arriving
packet be allowed
in? Departing
packet let out?

 internal network connected to Internet via router firewall

 filters packet-by-packet, decision to forward/drop packet
based on:
• source IP address, destination IP address
• TCP/UDP source, destination port numbers
• ICMP message type
• TCP SYN, ACK bits
Security: 8- 46
Stateless packet filtering: example
Should arriving
packet be allowed
in? Departing
packet let out?

 example 1: block incoming and outgoing datagrams with IP protocol field

= 17 and with either source or dest port = 23
• result: all incoming, outgoing UDP flows and telnet connections are
blocked
 example 2: block inbound TCP segments with ACK=0
• result: prevents external clients from making TCP connections with
internal clients, but allows internal clients to connect to outside
Security: 8- 47
Stateless packet filtering: more examples
Policy Firewall Setting
no outside Web access drop all outgoing packets to any IP
address, port 80
no incoming TCP connections, drop all incoming TCP SYN packets to
except those for institution’s any IP except [Link], port
public Web server only. 80
prevent Web-radios from eating drop all incoming UDP packets -
up the available bandwidth. except DNS and router broadcasts.
prevent your network from being drop all ICMP packets going to a
used for a smurf DoS attack. “broadcast” address (e.g.
[Link])
prevent your network from being drop all outgoing ICMP TTL expired
tracerouted traffic

Security: 8- 48
Stateful packet filtering
 stateless packet filter: heavy handed tool
• admits packets that “make no sense,” e.g., dest port = 80, ACK bit set, even
though no TCP connection established:

action source dest protocol source dest flag

address address port port bit
outside of
allow 222.22/16
222.22/1 TCP 80 > 1023 ACK
6

 stateful packet filter: track status of every TCP connection

• track connection setup (SYN), teardown (FIN): determine whether
incoming, outgoing packets “makes sense”
• timeout inactive connections at firewall: no longer admit packets

Security: 8- 49
Application gateways
 filter packets on host-to-gateway
telnet session application
application data as well gateway
router and filter
as on IP/TCP/UDP fields.
 example: allow select
internal users to telnet gateway-to-remote
host telnet session
outside

1. require all telnet users to telnet through gateway.

2. for authorized users, gateway sets up telnet connection to dest
host
• gateway relays data between 2 connections
3. router filter blocks all telnet connections not originating from
gateway Security: 8- 50
Limitations of firewalls, gateways
 IP spoofing: router can’t  filters often use all or
know if data “really” comes nothing policy for UDP
from claimed source  tradeoff: degree of
 if multiple apps need communication with
special treatment, each has outside world, level of
own app. gateway security
 client software must know  many highly protected
how to contact gateway sites still suffer from
• e.g., must set IP address attacks
of proxy in Web browser

Security: 8- 51
Intrusion detection systems
 packet filtering:
• operates on TCP/IP headers only
• no correlation check among sessions
 IDS: intrusion detection system
• deep packet inspection: look at packet contents (e.g., check
character strings in packet against database of known virus,
attack strings)
• examine correlation among multiple packets
• port scanning
• network mapping
• DoS attack
Security: 8- 52
Intrusion detection systems
multiple IDSs: different types of checking at different
locations
firewall

internal
network
Internet

IDS Web demilitarized

server DNS zone
sensors FTPserver
server

Security: 8- 53