《安全协议PPT课件.ppt》由会员分享，可在线阅读，更多相关《安全协议PPT课件.ppt（46页珍藏版）》请在金锄头文库上搜索。
1、1 4 3AuthenticationandKeyTransportUsingPublicKeyCryptography 中国矿业大学计算机科学与技术学院 2 Introduction TwopotentialadvantagesDigitalsignaturesSimplificationofkeymanagementTwocostsHighcomputationalcostpublickeysstillneedmanaged 3 Notation EX M EncryptionofmessageMusingthepublickeyofprincipalXSigX M Signaturewi
2、thappendixofmessageMbyprincipalXNXnoncechosenbyprincipalXTXtimestampchosenbyprincipalX M KSymmetricencryptionofmessageMwithkeyK 4 4 3 1EntityAuthenticationProtocols 1 A B TA B SigA TA B ISO IEC9798 3one passunilateralauthentication 5 1 B A NB2 A B NA NB SigA NA NB B ISO IEC9798 3two passunilateralau
3、thentication 加入NA的作用是不被B当作oracle标准允许省略签名中的B 但Protocol4 1不可省略 6 1 A B TA B SigA TA B 2 B A TB A SigB TB A ISO IEC9798 3two passmutualauthentication 7 ISO IEC9798 3three passmutualauthentication 1 B A NB2 A B NA NB B SigA NA NB B 3 B A NB NA A SigB NB NA A 8 EarlyversionofProtocol4 4 1 B A NB2 A B NA
4、NB B SigA NA NB B 3 B A NB NA A SigB NB NA A 1 CB A NC2 A CB NA NC B SigA NA NC B 1 CA B NA2 B CA NB NA A SigB NB NA A 3 CB A NB NA A SigB NB NA A CanadianattackonProtocol4 5 Useofaprotocolidentifierineverysignedmessage A C B ISO IEC9798 3two passparallelauthentication 1 A B NA1 B A NB2 A B NA NB B
5、SigA NA NB B 2 B A NB NA A SigB NB NA A 1 1 2 2 A B 9 10 4 3 2KeyTransportProtocols 1 A B EB A KAB TA ISO IEC11770 3Mechanism1 Keycontrol AKeyfreshness A 没有发送方的认证 B不能保证freshness Keyauth AKeyconf NoSecurityProof NoAttack No 11 1 A B B TA EB A KAB SigA B TA EB A KAB ISO IEC11770 3Mechanism2 Keycontrol
6、 AKeyfreshness A BKeyauth A BKeyconf BSecurityProof NoAttack No 12 1 A B EB B KAB TA SigA B KAB TA ISO IEC11770 3Mechanism3 Swaparoundtheorderinwhichthesignatureandencryptionareappliedinmechanism2 Achievesthesamegoalsasmechanism2 13 1 A B EB KAB TA SigA KAB TA Denning Saccopublickeyprotocol A B EB K
7、AB TA SigA KAB TA BA C EC KAB TA SigA KAB TA AttackofProtocol A B正常通信 同时B假冒A与C通信 A B C 14 A B NAB A A NA NB EA B KAB SigB A NA NB EA B KAB ISO IEC11770 3Mechanism4 Similartomechanism2Keycontrol BKeyfreshness A BKeyauth A BKeyconf ASecurityProof YesAttack No 15 A B NAB A NB NA A EA B KBA SigB NB NA A
8、 EA B KBA A B NA NB B EB A KAB SigA NA NB B EB B KAB ISO IEC11770 3Mechanism5 Keycontrol A BKeyfreshness A BKeyauth A BKeyconf A SecurityProof NoAttack No 16 A B EB A KAB NA B A EA B KBA NA NB A B NB ISO IEC11770 3Mechanism6 K h KAB KBA Keycontrol A BKeyfreshness A BKeyauth A BKeyconf A BSecurityPro
9、of NoAttack No 17 A B EB A KAB NA B A EA KBA NA NB A B NB Helsinkiprotocol earlierversion 1 A C EC A KAB NA 1 CA B EB A KAB NA 2 B CA EA KBA NA NB 2 C A EA KBA NA NB 3 A C NB3 CA B NB AttackonHelsinkiprotocol A C正常通信 同时C假冒A与B通信 A C B 18 A B EB NA A B A EA NA NB A B EB NB Needham Schroederpublickeypr
10、otocol 1 A C EC NA A 1 CA B EB NA A 2 B CA EA NA NB 2 C A EA NA NB 3 A C EC NB 3 CA B EB NB AttackonNeedham Schroederprotocol A C正常通信 同时C假冒A与B通信 A C B 19 A B EB NA A B A EA NA NB B A B EB NB Lowe svariantofNeedham Schroederprotocol LoweprovesecureusingmodelcheckerFDRNA NBcanactasasharedsecret sostep
11、3usingencryption 20 Keycontrol AKeyfreshness AKeyauth AKeyconf NoAttack YesThesignatureshouldincludetheunencryptedkey hashedtoprotectconfidentiality withtheencryptedkeysentseparately 攻击者I替换签名 A以为与B通信 B以为与攻击者I通信 X 509one passauthentication 1 A B TA NA B EB KAB SigA TA NA B EB KAB A I B B 21 A B TA NA
12、 B EB KAB SigA TA NA B EB KAB B A TB NB A NA EA KBA SigB TB NB A NA EA KBA X 509two passauthentication A B TA NA B EB KAB SigA TA NA B EB KAB B A TB NB A NA EA KBA SigB TB NB A NA EA KBA A B NB B SigA NB B X 509two passauthentication 22 4 4KeyAgreementProtocols 23 Introduction Akeytransportprotocolo
13、rmechanismisakeyestablishmenttechniquewhereonepartycreatesorobtainsasecretkey andthensecurelytransfersittotheother s Akeyagreementprotocolormechanismisakeyestablishmenttechniqueinwhichasharedsecretkeyisderivedbytwo ormore partiesasafunctionofinformationcontributedby orassociatedwith eachofthese idea
14、lly suchthatnopartycanpredeterminetheresultingvalue Keycontrolisatermusedtodescribetheextenttowhichprincipalshavetheabilitytochooseorinfluencethevalueofthesharedkey orsessionkey Itisdesiredthatneitherprincipalcancontrolthesharedsecretvalue 24 4 4 1Diffie HellmanKeyAgreement NotationpAlargerprimeZAB主
15、体计算的共享秘密q素数 q p 1 KAB会话密钥GZ p的子群SAB静态DH密钥gxAxBgG的生成元NA NBA B选择的noncesrA rBA B在G中选择的随机数H 单向函数tA tBtA grA tB grBx RX从X中随机选择xxA xBA B的私钥F G验证F与G是否相等yA yByA gxA yB gxB 25 26 静态DH密钥生成会话密钥K H SAB freshvalue 传输 KAB K 或KAB MACK r r是序列号或随机数 特点 提供隐含密钥认证 缺乏联合控制密钥 没有前向秘密性 易遭密钥泄露假冒攻击 小子群攻击分析群G的结构 若ord G 是合数 则它存在
16、子群 如果grA在某个小子群中 则grArB也在其中 小子群有助于攻击者穷尽搜索发现会话密钥 此攻击的关键是强迫 诱使 共享秘密存在于小子群中 对策 选ord G 是比较大的素数 一般ord G 素数q q p 1 27 适用于单向通信 A B都有隐含密钥认证 A相信只有B能解密kA B相信只有A知道SAB B不都确定密钥的新鲜性 没有前向秘密性 知xB可获得旧的ZAB 受密钥泄露假冒攻击 知xA或xB可假冒A或B 4 4 3Diffie Hellman basedprotocolswithEnhancedmessageFormat 增加对DH交换消息的认证 共享秘密是瞬时ephemeralDH密钥 通常能提供前向秘密性 对瞬时公钥 grA 签名 通常能避免密钥泄露假冒攻击 知道A的私钥不能假冒B 瞬时秘密提供了前向秘密性 签名抵御了密钥泄露假冒攻击 不能达到密钥的双向确认 加密确保对方拥有相同的会话密钥 抵御了未知密钥共享攻击 若无加密 C可替换A的签名 28 不使用加密的站对站协议 A C B B tA tA tB SigB tB tA tB SigB tB tA SigA tA
