Network Security

1
Network Security Part 2Public Key Cryptography

• V.T. Raja, Ph.D.,
• Oregon State University

2
Network Security Part 2

• Outline
• Public Key Cryptography
• Public keys and Private keys
• RSA Algorithm
• Authentication
• Authentication Protocol (ap)
• ap 1.0, 2.0, 3.0, 3.1, 4.0, 5.0
• Exchanging Public Keys
• Man (Woman) in the middle-attack

3
Introduction - Public Key Cryptography

• Disadvantage of symmetric key cryptography?
• Until 1970s encryption involved symmetric key
• Is it possible for two parties to communicate
  using encryption/decryption without using a
  shared secret key?
• A radically different and marvelously elegant
  approach towards encryption/decryption
• Public key cryptography is useful not only for
  encryption/decryption, but also for
  authentication and digital signatures as well.

4
Basic Idea of Public Key Cryptography

• Each participant has a private key (known only to
  the participant) and a public key.
• The public key is created with ones private key.
  
• Public key is made available to others and could
  be posted even on a website which is accessible
  by the rest of the world.
• Public key of recipient is used by sender to
  encrypt message.
• Recipient decrypts message using recipients
  private key.
• Example
• Alice wishes to send a message to Bob.
• Alice fetches Bobs public key.
• Alice uses Bobs public key to encrypt message
• Alice sends encrypted message to Bob.
• Bob decrypts cipher text with Bobs private key.
  

5
Notation and Choice of Keys

• Assume Alices plain text message, (which has to
  be encrypted and then sent to Bob) is denoted as
  m.
• Assume Bobs public key is denoted as KB and his
  private key is denoted as KB-.
• These keys are chosen such that
• KB- (KB (m)) KB (KB- (m)) m

6
RSA Algorithm

• How does RSA work?
• Class Participation Exercise on RSA application
• Why does RSA work?
• (See MS Word handout for answers to above
  questions)

7
RSA Algorithm

• Even for small p and q, as seen in the
  participation exercise, we had to deal with
  extremely large numbers.
• If we follow the suggestion of RSA labs and
  select p and q to be several hundred bits long,
  then the following practical issues come to mind
• How to choose large prime numbers p and q?
• How to choose e and d?
• How to perform exponentiation with large numbers?
• (For those who are interested in this area, refer
  to Kaufman 1995 for answers to the above
  mentioned questions).

8
RSA and DES/AES

• DES is at least 100 times faster than RSA.
• In practice, RSA is often used in combination
  with DES or AES. How?
• (Alice encrypts DES key with Bobs public key.
  Bob decrypts and obtains DES key with his private
  key. The data is encrypted using DES key, which
  now both Alice and Bob have access to in order to
  encrypt/decrypt data).

9
Security of RSA

• The security of RSA relies on the fact that there
  are no known algorithms for quickly factoring a
  number (n), into the primes p and q. If one knew
  p and q, then given e, one could then easily
  compute the secret key d. It is not known
  whether or not there exist fast algorithms for
  factoring a number, and in this sense the
  security of RSA is not guaranteed.

10
Authentication

• ap 1.0
• ap 2.0
• ap 3.0
• ap 3.1
• ap 4.0
• ap 5.0

11
Exchanging Public Keys

• Why should public key be publicly available?
• Wouldnt it be better for Alice and Bob to
  exchange their respective public keys via e-mail,
  after authenticating each other?
• Due to possibility of man (woman) in the middle
  attack.

12
Man (Woman) in the Middle Attack
13
Man (Woman) in the Middle Attack