### Create a StudySoup account

#### Be part of our community, it's free to join!

Already have a StudySoup account? Login here

# Operating Systems CS 5523

UTSA

GPA 3.55

### View Full Document

## 13

## 0

## Popular in Course

## Popular in ComputerScienence

This 13 page Class Notes was uploaded by Mireya Heidenreich on Thursday October 29, 2015. The Class Notes belongs to CS 5523 at University of Texas at San Antonio taught by Staff in Fall. Since its upload, it has received 13 views. For similar materials see /class/231395/cs-5523-university-of-texas-at-san-antonio in ComputerScienence at University of Texas at San Antonio.

## Reviews for Operating Systems

### What is Karma?

#### Karma is the currency of StudySoup.

#### You can buy or earn more Karma at anytime and redeem it for class notes, study guides, flashcards, and more!

Date Created: 10/29/15

CS 5523 Lecture 20 Security Case Studies I Questions on laboratory 3 I Continue scenarios I NeedhamSchroeder I Brief summary of common algorithms I Kerberos Simplified overview of secret key encryption Encrypted message EK M MK Decrypted message DK EK M DK MM M It is hard to get M from MKwithout knowing K Scenario 1 Secret communication with shared secret key Alice and Bob share a secret key KAB Alice wants to send a secret message Mto Bob 1 Alice uses KAB and an agreed encryption function EKAB M to encrypt and send message Mto Bob 2 Bob reads the encrypted messages using the corresponding decryption function DKAB M How can Bob and Alice safely get the shared key KAB How can Bob know that M wasn t a replay Scenario 2 Authenticated communication with a server Alice wants to access Bob s files on a local file server Sara is a trusted authentication server that holds passwords and current secret keys 1 Alice sends a message to Sara asking for a ticket to access Bob 2 Sara sends Alice a response encrypted with KA that is a ticket encrypted with KB and a new secret key KAB for communication tickeUKB KAB KA 3 Alice decrypts response with KA 4 Alice sends ticket her ID and request R to Bob ticketKB Alice R 5 Bob decrypts ticket using KB the ticket was KAB Alice KB This is the simpli ed scenario for Kerberos KAB is the session key Simplified overview of public key encryption I Keys come in pairs K and K2 I Keep one public and one private I If you encrypt with K you can decrypt with K2 and vice versa DK2 EK1 M M DK1 EK2 M M Scenario 3 Authenticated communication with public keys Bob has generated a publicprivate key pair There is a trusted authority that gives out key certificates V Alice accesses a key distribution center to obtain a public key certificate with Bob s public key Alice extracts Bob s public key KBM V Alice creates a new secret key KAB and encrypts KAB known string with KBM Alice sends unique keyname KAB known stn39ngKBW to Bob A 4 Bob decrypts KAB known stn39ngKBM using KB 539 Bob and Alice now communicate with KAB pIv This is the scenario for the widely used hybrid cryptographic protocol Scenario 4 Digital signatures with a secure digest function Alice wants to sign document Mso that any recipient can verify it came from Alice This assumes that Alice has a privatepublic key pair A digest is like a checksum Alice computes a xedlength digest DigestM Alice encrypts DigestM with her private key certi cate with Bob s public key and makes M DigestMKAW available Bob reads M DigestMKapJ extracts M and computes DigestM Bob applies KAWth DigestMKaWto obtain DigestM and compares the value with his computed value Na 0 Figure 74 Alice s bank account certificate 1 Certt cate type Account number 2 Name Alice 3 Account 6262626 4 Certtfying authority Bob s Bank 5 Signature Digest eld2 eld 3K 5an Mum39s om Ex lenmsDolmmedemdhez Dmhm ysm Contains AndDesxgl Edn 3 AddisonWesleyPubhshm 2mm Figure 75 Publickey certificate for Bob s Bank 1 Certi cate type Public key 2 Name Bob s Bank 3 Public key KBpub 4 Certifying authority Fred 7 The Bankers Federation 5 Signature DigesIO ield2 eld 3KF w 9g Dismalqu committing Edn 3 summing 2mm Figure 713 X509 Certificate format subject Distinguished Name Public Key Issuer Distinguished Name Signature Period of validity Not Before Date Not A er Date Administrative information Version Serial Number Fxtenrlerl Information Mum39s om Ex lenmsDolmmedemdhez Dism bntad ysm Cmepts mama Edn 3 AddxsunWes AYPlbhshm 2mm Some popular encryption schemes I TEA Tiny Encryption Algorithm Wheeler and Needham 1994 uses 32 rounds with combinations of XOR text shifts I DES Data Encryption Standard National Bureau of Standards 1977 obsolete because of short keys successfully cracked by brute force attacks in 1997 and a machine was built in 1998 that could crack keys in 3 days Replaced by AES Advanced Encryption Standard NIST 1999 I RSA Rivest Shamir and Adelman public key encryption based on factoring products of large primes widely used RSA s patent has expired Some popular encryption schemes continued I 3DES tripleDES ANSI 1985 apply DES 3 times with two keys very slow I IDEA International Data Encryption Algorithm Lai and Massey 1990 based on group algebra with 8 rounds of XOR I MD5 used for data digests Rivest 1992 four rounds applying 4 nonlinear functions to each of 16 32bit segments I SHA NIST 1995 based on Rivest s MD4 algorithm to produce a 160 bit digest Figure 714 Performance of encryption and secure digest algorithms Key sizehash size Extrapolated PRB optimized bits kbytess kbytesec TEA 128 700 DES 56 350 7746 TripleDES 112 120 2842 IDEA 128 700 4469 RSA 512 7 RSA 2048 1 MDS 128 1740 62425 SHA 160 750 25162 Mum We in cmmwognifIZmfh mm cm new m 3 Figure 715 The Needham Schroeder secretkey authentication protocol Header Message Notes 1 AgtSI A B N A requests S to supply a key for communication A with B 2 SgtA N B K S returns a message encrypted in A s secret key A K 15 containing a newly generated key K A 5 and a AB K5KA ticket encrypted in B s secret key The nonce N A demonstrates that the message was sent in response to the preceding one A believes that S sent the message because only S knows A s secret key 3 AgtB Kw AKB A sends the ticket to B 4 BgtA NBKAB B decrypts the ticket and uses the new key KAB to encrypt another nonce N 5 5 AgtB N5 UK A demonstrates to B that it was the sender ofthe Mum39s om Ex lenmSDolmnxe previous message by returning an agreed 39 o N demdhexg Dishian ysm Contains new Edn 3 mismwtsiamusm 2mm Kerberos I Follows Needham and Schroeder very closely I Uses time values as nonces I When user logs in the login program sends user s name to the kerberos authentication server I If user is known server replies with a session key and a nonce encrypted in the user s password and a ticket for TGS I After login program authenticates the information it can erase the user s password from memory Figure 716 System architecture of Kerberos Kerberos Key Distribution Centre Step A 1 Request for TGS 39 Server request session setup Request encrypted with session key ely encrypted with session ke Client C Server S DoOperatIon o nmmvs Gm Ex lenmsDolmmedemdhez stm nntad ysm Concepts AndDesxgl Edn 3 Add onWeskyPlbhshm 2mm CS 5523 Lecture 20 Security Case Studies I Questions on laboratory 3 I Continue scenarios I NeedhamSchroeder I Brief summary ofcommon algorithms I Kerberos Simplified overview of secret key encryption Encrypted message EK M llUK Decrypted message DK EK M WK MM M It is hard to get M 39om MKwithout knowing K Scenario 1 Secret communication with shared secret key Alice and Bob share a secret key KAB Alice wants to send a secret message Mto Bob 1 Alice uses KAB and an agreed encryption Jnction EKAB M to encrypt and send message Mto Bo Bob reads the using decryption Jnction DKAB M How can Bob and Alice safely get the shared key KAB How can Bob know that Mwasn t a replay Scenario 2 Authenticated communication with a server Alice wants to access Bob39s files on a local le server Sara is a trusted authentication server that holds passwords and current secret keys 1 Alice sends a message to Sara asking for a ticket to access Bob 2 Sara sends Alice a response encrypted with KA that is a ticket encrypted with K5 and a 39 39 iCkeWEy KAB KA 3 Alice decrypts response with KA VAE u 4 Alice sends ticket her ID and request R to Bob ticketkfy Alice R 5 Bob decrypts ticket using K5 the ticket was KAB Alice KB This is the simpli ed scenario for Kerberos KAB is the session key Simplified overview of public key encryption I Keys come in pairs K and K2 I Keep one public and one private I If you encrypt with K you can decrypt with K2 and vice versa DK2EK1M M DK1 EK2 M M Scenario 3 Authenticated communication with public keys Bob has generated a publicprivate key pair There is a trusted authority that gives out key certif39cates Alice accesses a key distribution center to obtain a public key certi cate with Bob s public key Alice extracts Bob s public key K3 2 Alice creates a new secret key KAB and encrypts Kw known string wi Baa Alice sends unique keyname KASV known stringKEM to Bob Bob decrypts KASV known stringKEMusing KBW 5 Bob and Alice now communicate with KAB 3 4 This is the scenario forthe widely used hybrid cryptographic protocol Scenario 4 Digital signatures with a secure digest function Alice wants to sign document M so that any recipient can verify it came from Alice This assumes that Alice has a privatepublic key pair A digest is like a checksum Alice computes a xedlength digest DigestM Alice encrypts DigestM with her private key certi cate with Bob s public key and makes lll DigestMmW available Bob reads lll DigestMKm extracts Mand computes DigestM Bob applies KAMto DigestMKWVto obtain DigestM and compares the value with his computed value Au Figure 7 4 Alice s bank account cemncate 1 Camme type Accountnumber 2 Name Alice 3 Account 6262626 4 oemfymg Maury Bob sBank 5 Signature Digestg eldl eld 3 Kb W Figure 7 5 Pubnekey cevtmcate for Bob s Bank 1 Certfimte ype Public key 2 Name Bob s Bank 3 Public key Km 4 Certyjtrg Monty Fred 7 The Bankers Fedaation 5 Signmwe Digeezg etdz fteld 3K w Figure 7 13 x509 Certi cate format SW Distinguished Name Public Key 1mm Dmngmshed Name 513nm Period afvalxmy Nut B bre Dae Nut A er Date Admmmmnve Information Varsmn Sanal Num 3 Some popular encryption schemes I TEA Tiny Encryption Algorithm Wheeler and Needham 1994 uses 32 rounds with combinations of XOR text shi s I DES Data Encryption Standard National Bureau of Standards 1977 obsolete because of short keys successfully cracked by brute force attacks in 1997 and a machine was built in 1998 that could crack keys in 3 days Replaced byAES Advanced Encryption Standard NIST 1999 I RSA Rivest Shamir and Adelman public key encryption based on factoring products oflarge primes widely used RSA s patent has expired Some popular encryption schemes continued I 3055 tripleDES ANSI 1985 apply DES 3 times with two key ery s w I IDEA International Data Encryption Algorithm Lai and Massey 1990 based on group algebra with 8 rounds ofXOR I MD5 used for data digests Rivest 1992 four rounds applying 4 nonlinear Jnctions to each of16 32bit segments I SHA NIST 1995 based on Rivest s MD4 algorithm to produce a 160 bit digest Figure 7 M Performance ofervcryption and secure digest aigonthrns Key sizehash srze bus speed namess namessee TEA 128 700 e DES 56 350 7746 TnplerDES 112 120 2842 128 700 4469 RSA 512 7 e RSA 2048 1 e MDS 128 1740 62425 H 1 0 0 1 Figure 7 15 The Needhamesgnroeder secretrkey authentication protocoi Header Alexmge Nate 1 Ms A 5 NA Arequests Ste supplyakey fur eernrnunrestaen mm B 2 SrgtA NA 5 K ted m A s seeret hey 41 K2 A q q s returns amessage eneryp eentanrng a new1y generated key 0 and a tzcket eneryptearn B s seeret key The neneeN aernenstrates that the message was sent m respunse messagebecause only 5 knuwsA s seeret key 3 AegtB K4 1 ASends the heket DB 4 BegtA mm B decrypts the heket and uses the new key Kata encrypt anuther nenee N 5 MB Np um Ademunstxates te B that rt was the sender 1me p em us messagebyreturmng an agreed trans ur mahun qu Kerberos I Follows Needham and Schroeder very closely I Uses time values as nonces I When user logs in the login program sends user s name to the kerberos authentication server I Ifuser is knovm server replies with a session key and a nonce encrypted in the user s password and a ticket for TGS I A er login program authenticates the information it can erase the user s password 39om memory

### BOOM! Enjoy Your Free Notes!

We've added these Notes to your profile, click here to view them now.

### You're already Subscribed!

Looks like you've already subscribed to StudySoup, you won't need to purchase another subscription to get this material. To access this material simply click 'View Full Document'

## Why people love StudySoup

#### "Knowing I can count on the Elite Notetaker in my class allows me to focus on what the professor is saying instead of just scribbling notes the whole time and falling behind."

#### "I bought an awesome study guide, which helped me get an A in my Math 34B class this quarter!"

#### "I was shooting for a perfect 4.0 GPA this semester. Having StudySoup as a study aid was critical to helping me achieve my goal...and I nailed it!"

#### "Their 'Elite Notetakers' are making over $1,200/month in sales by creating high quality content that helps their classmates in a time of need."

### Refund Policy

#### STUDYSOUP CANCELLATION POLICY

All subscriptions to StudySoup are paid in full at the time of subscribing. To change your credit card information or to cancel your subscription, go to "Edit Settings". All credit card information will be available there. If you should decide to cancel your subscription, it will continue to be valid until the next payment period, as all payments for the current period were made in advance. For special circumstances, please email support@studysoup.com

#### STUDYSOUP REFUND POLICY

StudySoup has more than 1 million course-specific study resources to help students study smarter. If you’re having trouble finding what you’re looking for, our customer support team can help you find what you need! Feel free to contact them here: support@studysoup.com

Recurring Subscriptions: If you have canceled your recurring subscription on the day of renewal and have not downloaded any documents, you may request a refund by submitting an email to support@studysoup.com

Satisfaction Guarantee: If you’re not satisfied with your subscription, you can contact us for further help. Contact must be made within 3 business days of your subscription purchase and your refund request will be subject for review.

Please Note: Refunds can never be provided more than 30 days after the initial purchase date regardless of your activity on the site.