CNIT 141: 11. Diffie-Hellman
1 like550 views
The document discusses the Diffie-Hellman key exchange protocol, detailing its function, potential vulnerabilities, and alternative key agreement protocols. It explains how this method allows two parties to securely establish a shared secret while addressing issues like eavesdropping, replay attacks, and security goals such as authentication and forward secrecy. Additionally, it covers problems related to the discrete logarithm, computational Diffie-Hellman, and the importance of using secure parameters in cryptographic systems.
CNIT 141: 11. Diffie-Hellman
- 1. CNIT 141 Cryptography for Computer Networks 11. Diffie-Hellman
- 2. Topics • The Diffie-Hellman Function • The Diffie-Hellman Problems • Key Agreement Protocols • Diffie-Hellman Protocols • How Things Can Go Wrong
- 3. 1976 • Whitfield Diffie and Martin Hellman • Published "New Directions in Cryptography" • Revolutionized cryptography • Specified a public-key distribution scheme • The Diffie-Hellman (DH) protocol • The basis for public-key encryption and signatures
- 4. Key Agreement • After exchanging a shared secret • Parties turn the secret into a symmetric key • Thus establishing a secure channel
- 6. The Group Zp* • The integers 1, 2, 3, ... p-1 • Where p is prime • In DH, the two parties choose random elements a and b to be their secrets • From the group • Both parties also use a number g • Which is not a secret
- 7. Alice and Bob • They can both calculate gab by combining public and secret information Keep a secret Transmit ga Keep b secret Transmit gb
- 8. Diffie-Hellman • Alice calculates A = ga mod p • and sends it to Bob • Bob calculates B = gb mod p • and sends it to Alice • Alice calculates Ba mod p = gba mod p • Bob calculates Ab mod p = gab mod p • They now have the same shared secret
- 9. Key Derivation Function (KDF) • The shared secret is not used directly as the key • It's passed through a KDF to create a random- looking value of the proper size • A kind of hash function
- 10. Safe Primes • Not all values of p and g work • For highest security, both p and (p - 1) / 2 should be prime • Those are called safe primes • They don't have small subgroups • That would limit the shared secret to a small number of possible values
- 11. Safe Primes • With safe primes even a g of 2 works • But safe primes are slow to generate • 1000x as long as generating mere random primes
- 12. Generating 2048-bit DH • 154 seconds
- 13. Generating 2048-bit RSA • 0.17 seconds
- 15. Discrete Logarithm Problem • Public value: ga • Secret value: a • Recovering a from ga is the DLP • Diffie-Hellman's security depends on the DLP's hardness
- 16. Eavesdropper • Evil attacker knows only ga and gb Keep a secret Transmit ga Keep b secret Transmit gb
- 17. The Computational Diffie- Hellman Problem (CDH) • Consider an eavesdropper • Compute the shared secret gab • Given only the public values ga and gb • And not the secrets a or b • This might be easier than the DLP • We don't know for sure
- 18. Number Sieve • DH protocol with 2048 bit prime p provides 90 bits of security • Same as RSA with a 2048-bit n • Fastest known attack on Computational Diffie- Hellman is the number field sieve • Similar to the fastest known attack on RSA: the "general number field sieve"
- 19. Decisional Diffie-Hellman Problem (DDH) • Stronger than CDH's hardness assumption • If DDH is hard, the attacker can't learn anything about the shared secret from the public information • Not even a few bits of it • Because it appears completely random • Both DDH and CDH are hard if the parameters are well-chosen
- 21. A Non-DH Key Agreement Protocol • Authenticated Key Agreement (AKA) • Used by 3G and 4G • To establish secure communication between a SIM card and a telecom operator • Uses only symmetric-key operations • Relies on a pre-shared secret K
- 23. Replay Attack • Attacker captures pair (R, V1) • Sends it to SIM card to open a new session impersonating the telco • To precent this, protocol checks to make sure R isn't reused
- 24. Compromised K • Attacker who gets K • Can perform MiTM attack and listen to all cleartext communications • Can impersonate either party • Can record communications and later decrypt them using the captured R values
- 25. Attack Models for Key Agreement Protocols • Eavesdropper • Attacker is a MiTM • Can record, modify, drop or inject messages • To stop: protocol must not leak any information about the shared secret • Data leak • Attacker gets the session key and all temporary secrets • But not long-term secret K
- 26. Attack Models for Key Agreement Protocols • Breach • Attacker learns long-term key K • Impossible to protect current session from this attack • But a protocol can protect other sessions
- 27. Security Goals • Authentication • Mutual authentication: each party can authenticate to the other party • Authenticated Key Agreement happens when a protocol authenticates both parties
- 28. Security Goals • Key control • Neither party can control the final shared secret • The 3G/4G protocol lacks this property • Because the operator chooses R • Which entirely determines the final shared key
- 29. Security Goals • Forward secrecy • Even if all long-term secrets are exposed • Shared secrets from previous sessions are not available • 3G/4G protocol doesn't provide this
- 30. Performance • Number of messages exchanged • Message length • Computations required • Possibility of pre-computation • The main cause of latency is usually round- trip time • Computation required also counts
- 31. Performance of 3G/4G • Exchanges two messages of a few hundred bits each • Pre-computation is possible • Operator can pick many values of R in advance
- 33. Anonymous Diffie-Hellman • Not authenticated • Vulnerable to MiTM attack (next slide)
- 35. Authenticated Diffie-Hellman • Uses public-key signatures to sign messages • With a system such as RSA-PSS
- 36. Security Against Eavesdroppers • Authenticated DH stops eavesdroppers • Attacker can't learn the shared secret gab • Neither party can control the shared secret
- 37. Replay • Eve can record and replay previous values of A and sigA • To pretend to be Alice • Key confirmation prevents this • Alice and Bob send a message to prove that they both own the shared secret
- 38. Security Against Data Leaks • If Eve has a, she can impersonate Alice • To prevent this, integrate long-term keys into the shared secret computation
- 39. Memezes-Qu-Vanstone MQV • Designed in 1998 • NSA included it in Suite B • Designed to protect classified information • More secure than authenticated DH • Better performance
- 40. MQV • x and y are long-term private keys • X and Y are long-term public keys
- 41. Data Leak • Attacker who gets the ephemeral secrets a and b • Can't find the shared secret • That would require knowing the long-term private keys
- 42. Breach • Attacker gets Alice's long-term private key x • Previous sessions are still safe • Because they used Alice's ephemeral private keys • There is an attack that could compromise a targeted old session • It can be mitigated by a key-confirmation step
- 43. MQV Rarely Used • Was encumbered by patents • Complex and difficult to implement • Authenticated DH is simpler and regarded as good enough
- 44. How Things Can Go Wrong
- 45. Not Hashing the Shared Secret • The shared secret gab is not a session key • A symmetric key should look random • Every bit should be 50% likely to be 0 • But gab is in the range 1, 2, ... p • High-order bit more likely to be 0 • Use a KDF to convert the secret to a key
- 46. Legacy DH in TLS • Old cipher suites uses Anonymous DH • TLS_DH_anon_WITH_AES_128_CBC_SHA • TLS_DH_ANON_AES_128_CBC_SHA1 • TLS_DH_anon_WITH_AES_128_CBC_SHA • ADH-AES128-SHA • Link Ch 11i
- 47. Unsafe Group Parameters • OpenSSL allowed unsafe primes p • Attacker can craft DH parameters that reveal information about the private key • Fixed in 2016