11-11-2025
Mutual Trust
Module - 6
Topics to be discussed
Key Management and Distribution
User Authentication Protocols
2 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
1
11-11-2025
Key Management and Distribution
&
User Authentication Protocols
3 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Symmetric-key Distribution
Symmetric-key cryptography is more efficient than asymmetric-key
cryptography for enciphering large messages.
Symmetric-key cryptography, however, needs a shared secret key
between two parties.
The distribution of keys is another problem.
Topics discussed in this section:
1. Key-Distribution Center: KDC
2. Session Keys
4 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
2
11-11-2025
Key-Distribution Center: KDC
5 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Key-Distribution Center: KDC
Flat Multiple KDCs
6 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
3
11-11-2025
Key-Distribution Center: KDC
Hierarchical Multiple KDCs
7 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Session Keys
A KDC creates a secret key for each member.
This secret key can be used only between the member and the KDC,
not between two members.
A session symmetric key between two parties is used
only once.
8 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
4
11-11-2025
Session Keys
A Simple Protocol Using a KDC
9 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Needham-Schroeder Protocol
Brief description of each step as in figure (next slide):
1. Alice sends a message to KDC with her nonce (RA), her identity
and Bob’s identity.
2. The KDC replies a message to Alice with Alice’s nonce, Bob’s
identity, the session key (RAB) and an encrypted ticket to Bob. The
whole message is encrypted with Alice’s key
3. Alice sends Bob’s ticket to him.
4. Bob sends his challenge to Alice (RB), encrypted with the session
key.
5. Alice responds to Bob’s challenge, by sending (RB-1) instead of RB
10 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
5
11-11-2025
Needham-Schroeder Protocol
11 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Otway-Rees Protocol
Brief description of each step as in figure (next slide):
1. Alice sends a message to Bob with a common nonce (R), the
identities of Alice and Bob, and a ticket for KDC (Challenge for
KDC) that includes Alice’s nonce RA, a copy of R and identities of
Alice and Bob.
2. Bob creates same type of ticket, but with his own nonce RB. Both
the tickets are sent to KDC
3. KDC creates a message that has R, ticket for Alice and a ticket for
bob, this message is sent to Bob. The ticket has RA, RB and session
key (KAB).
4. Bob sends Alice her ticket.
5. Alice acknowledges by sending a short message encrypted with
KAB
12 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
6
11-11-2025
Otway-Rees Protocol
13 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
KERBEROS
Kerberos is an authentication protocol, and at the same time a KDC,
that has become very popular.
Topics discussed in this section:
Introduction
Servers
Operation
Using Different Servers
Kerberos Version 5
Realms
14 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
7
11-11-2025
KERBEROS
Introduction:
Kerberos is a protocol for authenticating service requests between
trusted hosts across an untrusted network, such as the internet.
Kerberos is built in to all major operating systems, including
Microsoft Windows, Apple OS X, FreeBSD and Linux.
Kerberos was originally developed for Project Athena at the
Massachusetts Institute of Technology (MIT).
The protocol was named after the character Kerberos (or
Cerberus) from Greek mythology, the ferocious three-headed guard
dog of Hades.
15 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
KERBEROS
Introduction:
Kerberos provides a centralize authentication server whose function
is to authenticate users to servers and servers to users.
In Kerberos Authentication server and database is used for client
authentication.
Kerberos run as a third-party trusted server known as the Key
Distribution Center (KDC).
The three heads of the Kerberos protocol represent a client, a
server and a Key Distribution Center (KDC), which acts as
Kerberos' trusted third-party authentication service.
16 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
8
11-11-2025
KERBEROS
Aim:
The user's password must never travel over the network.
The user's password must never be stored in any form on the client
machine.
The user's password should never be stored in an unencrypted form
even in the authentication server database.
The user is asked to enter a password only once per work session.
Authentication information management is centralized and resides
on the authentication server.
The application servers must prove their authenticity to the client as
well. This characteristic is known as Mutual authentication.
17 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Kerberos servers
18 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
9
11-11-2025
Kerberos servers
Authentication Server (AS)
The authentication server (AS) is the KDC in the Kerberos protocol.
Ticket-Granting Server (TGS)
The ticket-granting server (TGS) issues a ticket for the real server
(Bob).
Real Server
The real server (Bob) provides services for the user (Alice).
19 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Operation
20 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
10
11-11-2025
Operation: steps
1. Alice sends request to AS in plain text using her registered
identity.
2. The AS replies with an encrypted message with Alice’s permanent
symmetric key (KA-AS). The message has two items: a session key
(KA-TGS) and a ticket for TGS i.e., encrypted with TGS symmetric
key (KAS-TGS). When the message arrives, Alice types her password
which is used by the client process to create KA-AS, then decrypt
the message to extract the session key and the ticket.
3. Alice sends three items to TGS: the ticket received from AS, the
name of the real server (Bob), the timestamp that is encrypted by
(KA-TGS).
21 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Operation: steps
4. TGS sends two tickets, each containing Session key between Alice
and Bob (KA-B). The ticket for Alice is encrypted with (KA-TGS); the
ticket for Bob is encrypted with (KTGS-B).
5. Alice sends Bob’s ticket with the timestamp encrypted by (KA-B).
6. Bob confirms the receipt by adding 1 to the timestamp, the
message is encrypted with (KA-B).
22 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
11
11-11-2025
KERBEROS
Using Different Servers
Note that if Alice needs to receive services from different servers,
she need repeat only the last four steps.
23 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
KERBEROS
Kerberos Version 5
The minor differences between version 4 and version 5 are briefly
listed below:
❖ Version 5 has a longer ticket lifetime.
❖ Version 5 allows tickets to be renewed.
❖ Version 5 can accept any symmetric-key algorithm.
❖ Version 5 uses a different protocol for describing data types.
❖ Version 5 has more overhead than version 4.
24 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
12
11-11-2025
KERBEROS
Realm
Kerberos allows the global distribution of ASs and TGSs, with each
system called a realm.
A user may get a ticket for a local server or a remote server.
25 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Symmetric-key Agreement
Alice and Bob can create a session key between themselves without
using a KDC.
This method of session-key creation is referred to as the symmetric-
key agreement.
Majorly used techniques:
1. Diffie-Hellman Key Agreement
2. Station-to-Station Key Agreement
26 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
13
11-11-2025
Diffie-Hellman Key Agreement
27 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Diffie-Hellman Key Agreement
The symmetric (shared) key in the Diffie-Hellman
method is K = gxy mod p.
28 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
14
11-11-2025
Diffie-Hellman Key Agreement
29 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Diffie-Hellman Key Agreement
Let us give a trivial example to make the procedure clear. Our
example uses small numbers, but note that in a real situation, the
numbers are very large. Assume that g = 7 and p = 23. The steps are
as follows:
1. Alice chooses x = 3 and calculates R1 = 73 mod 23 = 21.
2. Bob chooses y = 6 and calculates R2 = 76 mod 23 = 4.
3. Alice sends the number 21 to Bob.
4. Bob sends the number 4 to Alice.
5. Alice calculates the symmetric key K = 43 mod 23 = 18.
6. Bob calculates the symmetric key K = 216 mod 23 = 18.
7. The value of K is the same for both Alice and Bob;
gxy mod p = 718 mod 35 = 18.
30 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
15
11-11-2025
Diffie-Hellman Key Agreement
Let us give a more realistic example. We used a program to create a
random integer of 512 bits (the ideal is 1024 bits).
The integer p is a 159-digit number.
We also choose g, x, and y as shown below:
31 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Diffie-Hellman Key Agreement
The following shows the values of R1, R2, and K.
32 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
16
11-11-2025
Security of Diffie-Hellman
Discrete Logarithm Attack
Man-in-the-Middle Attack
33 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Man-in-the-middle attack
34 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
17
11-11-2025
Station-to-Station Key Agreement
35 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
PUBLIC-KEY DISTRIBUTION
In asymmetric-key cryptography, people do not need to know a
symmetric shared key.
Everyone shields a private key and advertises a public key.
In Public-Key cryptography, everyone has access to
everyone’s public key;
Public keys are available to public
36 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
18
11-11-2025
PUBLIC-KEY DISTRIBUTION
Topics discussed in this section:
Public Announcement
Trusted Center
Controlled Trusted Center
Certification Authority
X.509
37 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Public Announcement
The naive approach is to announce public keys publicly.
38 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
19
11-11-2025
Trusted Center
The more secure approach is to have a trusted center retain a
directory of public keys.
39 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Controlled Trusted Center
A higher level of security can be achieved if there are added controls on
the distribution of the public key.
The public key announcement can include a timestamp and be signed by
an authority to prevent interception and modification of the response.
40 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
20
11-11-2025
Certification Authority (CA)
Security certificates are used to reduce the load on trusted centers.
A server (Bob) can request a certificate from a certification authority
(CA), which could be a cross-certified company or state or federal
organization. Bob’s request contains his identification and his public key.
The CA checks the identification of Bob. If verified, the CA writes Bob’s
public key on the certificate and signs it with its own private key.
Bob can now upload the signed certificate and store it on his site or
Bob may send the certificate to users upon request.
Any user who wants Bob’s public key can download the certificate and
decrypts it using the CA’s public key to extract Bob’s public key
41 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
Certification Authority (CA)
42 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
21
11-11-2025
X.509
The Internet community has accepted the ITU-T recommendation
X.509 as a way to unify certificate formats.
In X.509, the certificate has the following important fields:
❖ Version number: this field is the version of X.509 (current version is
3).
❖ Serial number: this field is the serial number assigned to each
certificate and is unique for each certificate issuer.
❖ Signature algorithm ID: this field identifies the signature algorithm
used in the certificate. This field is repeated in the signature field.
43 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
X.509
❖ Issuer name: this field identifies the CA that issued the certificate.
❖ Validity Period: this field defines the earliest (not before) time and
the latest (not after) time during which the certificate is valid.
❖ Subject name: this field defines the entity that owns the public key
stored in this certificate.
❖ Subject public key: this field gives the value of the public key of the
owner of the certificate and defines the public key algorithm.
❖ Signature: this field contains the digest of all other fields in the
certificate encrypted by the CA’s private key, and also contains the
ID of the signature algorithm.
44 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
22
11-11-2025
X.509
45 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
X.509
Certificate Renewal
Each certificate has a period of validity.
If there is no problem with the certificate, the CA issues a new
certificate before the old one expires.
Certificate Revocation
In some cases a certificate must be revoked before its expiration.
The revocation is done by periodically issuing a certificate revocation
list (CRL) that contains all revoked certificates that have not expired
on the date the CRL is issued.
To ensure the validity of a certificate, the user must check the latest
CRL published by the CA that issued the certificate.
46 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
23
11-11-2025
X.509
Certificate Revocation
47 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
SUMMARY
Digital Signature
Comparison with Physical Signature
Digital Signature Process
Attacks on Digital Signature
Digital Signature Schemes
Key Management and Distribution & User Authentication Protocols
Symmetric-key Distribution
Public-key Distribution
48 Dr. [Link], Asst. Prof. (Sr), SENSE, VIT
24