Crypto U9, Cryptographic Protocols

Crypto U9, Cryptographic Protocols

1. specification of all events needed in order to achieve a requried security goal

   • specifies 4 things
     • protocol assumptions
     • protocol flow
       • communication steps in protocol
     • protocol messages
       • kind of content in messages
     • protocol actions
       • any action an entity needs to perform before sending or after receiving a message

2. stages of protocol design

   • 1. define protocol objectives
     • Identify the problem trying to be solved.
   • 2. define protocol goals
     • translate objectives into concrete security goals
   • 3. specify protocol
     • take goals as input and determine
       • cryptographic primitives
       • flow
       • actions

3. design challenges

   • it's hard to get the right objectives
   • it is not always straightforward to identify the right security goals for identified objectives
   • deviating from standard protocols can lead to insecure protocols
   • complicated design goals may not fit existing, standard protocols
   • modifying a standard protocol even slightly may have insecure impacts
   • hire professionals to do protocol design

4. protocol examples

   • PKCS
     • specifies suite of protocols for public key cryptography
   • ISO / IEC 117700
     • specifies suite of protocols for mutual entity authentication
   • SSL/TLS
     • specifies protocol for setting up a secure communication channel

5. attacks on protocols

   • reflection
     • http://en.wikipedia.org/wiki/Reflection_attack
   • man in the middle
     • http://en.wikipedia.org/wiki/Man-in-the-middle_attack
   • interleaving
     • type of man in the middle attack