Security

Security

1. Cryptography

   • Kerchkoff's principle
   • MAC h(k || m)
     • Origin authentication MAC_1 == MAC_2
   • Digital signature Sig(m) = m^d mod n
     • m1 == m2
   • Entity authentication
     • Freshness, target, origin
   • Diffie-hellman
     • Agree p,q. Secret n,m
       • N=q^n mod p; M = q^m mod p
         • M^n = N^m
     • Station-to-station B->A C_b||gb || Sig_b(g_b)
     • Epheremal key
   • Digital Certificate (trust chain)

2. Practical

   • Networks
     • OSI (p,dl, n, t, s, p, a)
     • TCP
     • UDP
     • DNS
     • Ethernet frame
     • HTTP
   • Controls
     • Firewall (stateless/stateful iptables)
     • IDS/IPS (signature/anomaly based)
     • Anti-malware (sb)
     • Honeypots
     • Input sanitisation, prepared
     • Abstract interpretation
   • Bell-La Padula (no ru, no wd)
   • Biba (no wu, no rd)

3. Attacks

   • Passive vs Active
   • Man in the middle
     • Replay
   • Meet in the middle (DES)
   • Birthday
   • Key-search
   • Downgrade
   • Port scanning (nmap -p- ip)
   • DDoS
   • Phishing
   • SQL
   • IP Spoofing
   • XSS stored/reflected
   • Buffer overflow
   • Dictionary (hydra)

4. Encryption

   • Substitution (letter frequency, keyspace)
   • Vernam Cipher, one-time pad
     • Semantic security
   • Asymmetric (public key)
   • Symmetric
   • Ellpitic curve
   • Hash (preimage, second preimage, collision)

5. Modes

   • Stream (ki XOR pi)
     • HMAC (bit-flipping) h(k2 || h(k1 || m)); k -> k1,k2
   • ECB (repeated plaintext)
     • CTR (nonce)
   • CBC
   • CFB

6. RSA

   • Trapdoor: modular exponentiation f(x) = b^x mod n
   • C = P^e mod n
   • P = C^d mod n
   • n = pq
     • gcd(e, totient(n)) = 1
       • ed = 1 + k totient(n); d < totient(n), d /= e

7. SSL (c, i, oa,ea)

   • SA
   • Client Request (IDs, rc, cipher-suites)
     • Server response (rs, cipher-suite, pk_s)
       • Pre-master secret transfer (RSA/EDH better)
         • Client Finished MAC(h(all m))
           • Server finished MAC(h(all m))

8. Kerboros

   • User login
     • Client authentication
       • Client service authorisation
         • Client service request
   • AS, TGS, KDC, Client, Service