VTCP/Secure: A Remote VPN for the Macintosh

1
VTCP/Secure A Remote VPN for the Macintosh
Stacey Lum, InfoExpressThe Third Annual
Macintosh Cryptography and Internet Commerce
Software Development Workshop
2
Remote VPN Definition
CorporateNetwork

• Provide Secure Remote Access Over Untrusted
  Networks
• Secure Usually MeansEncryption Data
  IntegrityAuthenticationAccess Control

Gateway
UntrustedNetwork
Remote PC
3
Remote VPN Environments

• ISDN, Cable Modem, DSL, 56k Dial-up
• Network Address Translation (NAT)
• Single and Multiple IP at NAT Device
• Extranet Capabilities
• Remote Firewall
• Proxy Traversal

4
Remote VPN Features

• Performance
• Ease of Use
• Application Compatibility
• TCP and UDP
• ICMP
• File Sharing
• Non-IP Protocol Applications

5
Where to Filter Data?

• Need to Intercept Network Calls
• Characteristics of VPN Differs Depending on Which
  Layer is Intercepted

6
Layer 3 Advantages

• Compatibility Above IP
• Can be IPSEC Compliant
• Gateway Performance

Application
TCP/UDP
IP
NIC,Modem
7
Layer 4 Advantages

• Media and OS Compatibility (Ethernet, Dial-up)
• Extranet, NAT, and Proxy Friendly
• End User Performance

Application
TCP/UDP
IP
NIC,Modem
8
Mac Layer 4 Filtering

• STREAMS Filtering
• TCP UDP (Autopush)
• DNS (SAD Push)
• Tunneling Component
• OT GUI Application
• Encryption and Integrity
• Authentication

OT App
TCP
UDP
IP
NIC,Modem
9
Security Model
Authentication Server
Shared Key
Gateway
Gateway Public Key
Client
10
Diffie-Hellman Public Key

• Royalty Free
• Based on Discrete Logarithms
• Simple Math
• Gxy mod P Gyx mod P
• n is hard to calculate from (Gn modulus P) with
  certain values of P and G
• Private key nPublic key (Gn modulus P)

11
Standard D-H Exchange
Mac Client
Gateway
UntrustedNetwork
Contents o Server public key
Contents o Server public keyo Server private key
Create DH key pairSend public key
Calculate D-Hsecret key usingservers private
key clients public key
Calculate D-Hsecret key usingclients private
key servers public key
Encrypted Authentication
12
Extended D-H Exchange with Past Secrecy
Mac Client
Gateway
UntrustedNetwork
Contents o Server public key
Contents o Server public keyo Server private key
Generate two D-H key pairs andsend public keys
Generate D-Hkey pair andsend public key
Calculate D-H usingclients private keys
servers public keys
Calculate D-H usingservers private key
clients public keys
Encrypted Authentication
13
Symmetric Key For Encryption

• Compression for Performance (LZ)
• Crypto Checksum for Integrity (MD5)
• Initialization Vector for Sequencing
• Encryption (DES, and Triple DES)
• Chain Messages gt Block Length (CBC)

14
Demo

• Diffie-Hellman Key Exchange
• DES Encryption
• Authentication using SecurID
• Download File