SLIDE 1 ECE-8843 http://www.csc.gatech.edu/copeland/jac/8813-03/
john.copeland@ece.gatech.edu 404 894-5177 fax 404 894-0035 Office: GCATT Bldg 579 email or call for office visit, or call Kathy Cheek, 404 894-5696 Chapter 7: 07-WebSec.pdf has PDF copies of slides from Chap. 7 of the text, “Network Security Essentials, Applications and Standards” by William Stallings)
SLIDE 2 Threats Consequences Countermeasures Integrity
- Modification of data
- Loss of information
- Cryptographic
checksums
- Trojan horse browser
- Compromise of machine
- Modification of memory
- Vulnerability to all threats
- Modification of messages in
transit Confidentiality
- Eavesdropping on the net
- Loss of information
- Encryption
- Theft of info from server
- Loss of privacy
- Web Proxies
- Theft of data from client
- Info about network
configuration
clients talk to server Denial of Service
- Killing of user threads
- Disruptive
- Difficult to prevent
- Flooding machine with bogus
requests
- Annoying
- Filling disk or memory
- Prevent users from getting
work done
- Isolating machines by DNS
attacks Authentication
- Impersonate users
- Misrepresentation of user
- Cryptographic
techniques
- Data forgery
- Belief that false data is valid
SLIDE 3
SMTP HTTP TCP IP/IPSec (a) Network Level FTP SMTP HTTP TCP SSL or TLS IP (b) Transport Level
Figure 7.1 Relative Location of Security Facilities in the TCP/IP Protocol Stack
FTP PGP SET IP S/MIME HTTP Kerberos UDP SMTP (c) Application Level TCP
SLIDE 4
IP Figure 7.2 SSL Protocol Stack TCP SSL Record Protocol
SSL Handshake Protocol SSL Change Cipher Spec Protocol SSL Alert Protocol HTTP
SLIDE 5
Application Data Fragment Compress Add MAC Encrypt Append SSL Record Header Figure 7.3 SSL Record Protocol Operation
SLIDE 6
Content Type Major Version Minor Version Compressed Length Figure 7.4 SSL Record Format Plaintext (optionally compressed) MAC (0, 16, or 20 bytes) encrypted
SLIDE 7
1 Figure 7.5 SSL Record Protocol Payload
(a) Change Cipher Spec Protocol 1 byte Type (c) Handshake Protocol 1 byte Length 3 bytes Content 0 bytes (d) Other Upper-Layer Protocol (e.g., HTTP) OpaqueContent 1 byte Level (b) Alert Protocol 1 byte 1 byte Alert
SLIDE 8 server_key_exchange
Figure 7.6 Handshake Protocol Action Client Server
Time
client_hello certificate client_key_exchange certifi cat e_ verif y change_cipher_spec finished server_hello c ertif ica te certificate_request se rve r_h el lo_ done change_cipher_spec finished
Establish security capabilities, including protocol version, session ID, cipher suite, compression method, and initial random numbers. Server may send certificate, key exchange, and request certificate. Server signals end
Client sends certificate if requested. Client sends key exchange. Client may send certificate verification. Change cipher suite and finish handshake protocol. Note: Shaded transfers are
- ptional or situation-dependent
messages that are not always sent.
SLIDE 9 secret seed seed A(1)
HMAC
secret secret
length= hash size
secret seed A(2)
HMAC HMAC ||
secret seed A(3 )
HMAC HMAC
Figure 7.7 TLS Function P_hash (secret, seed)
||
secret
HMAC ||
SLIDE 10
Internet
Cardholder Certificate Authority Merchant Payment Gateway Acquirer Issuer Figure 7.8 Secure Electronic Commerce Components
Payment Network Internet
SLIDE 11
PI PIMD OI H H E OIMD Figure 7.9 Construction of Dual Signature H POMD KRc Dual Signature
||
PI = Payment Information OI = Order Information H = Hash function (SHA-1) || = Concatenation PIMD = PI message digest OIMD = OI message digest POMD= Payment Order message digest E = Encryption (RSA) KRc = Customer's private signature key
SLIDE 12 PI OI E E
OIMD
Figure 7.10 Cardholder Sends Purchase Request KUb Ks
Dual Signature Digital Envelope Request Message
PI = Payment Information OI = Order Information PIMD= PI message digest OIMD= OI message digest E = Encryption (RSA for asymmetric;
Ks = Temporary symmetric key KUb = Bank's public key-exchange key
+
Dual Signature
+
Cardholder Certificate
+ + +
PIMD Received by merchant Passed on by merchant to payment gateway
+ +
SLIDE 13
Figure 7.11 Merchant Verifies Customer Purchase Request KUc
OI = Order Information OIMD = OI message digest POMD = Payment Order message digest D = Decryption (RSA) H = Hash function (SHA-1) KUc = Customer's public signature key OIMD
H
||
Passed on by merchant to payment gateway
H D
POMD
Compare
POMD
OI
Digital Envelope Request Message Dual Signature
+
Cardholder Certificate
+ +
PIMD
+ +
