%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{14}{October 24, 1996}{Ron Rivest}{$Van^{2}$} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Topics covered in this lecture:
\begin{itemize}
\item One-Time Passwords
\item Secure Channels
\item Zero-Knowledge Protocols
\end{itemize}

\section{One-Time Passwords}

Although passwords are useful for security purposes, they can be easily
compromised if the same password is used for long periods of time.  Hence, 
it is always wise to periodically change your password.  An extreme take 
on this idea is to have a ``continuously'' chaning password.  In other 
words, passwords can never be used twice.  Once the password is used to 
gain access into a system, that password is no longer valid and a new 
password must be used in order to gain access the next time.  This method
is very robust against attacks (if passwords are chosen randomly).  There 
are a number of ways to implement one-time passwords.  We enumerate a few 
here.

\subsection{S-Key}

This method makes use of the idea of hashing to implement one-time passwords.

\[ X_{0} \stackrel{h(X_{1})}{\longleftarrow} X_{1}
   \stackrel{h(X_{2})}{\longleftarrow} X_{2}
   \stackrel{h(X_{3})}{\longleftarrow} X_{3} ... X_{n-1}
   \stackrel{h(X_{n})}{\longleftarrow} X_{n}
\]

With this method, the user uses $X_{1} ... X_{n}$ as passwords beginning
with $X_{1}$.  The computer originally stores $X_{0}$.  To gain access, the
user inputs $X_{1}$.  The computer hashes this value.  If the output of the
hash matches $X_{0}$, the user is allowed access.  At this point, the 
computer updates its internal value to $X_{1}$.  Hence, the next time, the
user must enter the value $X_{2}$ in order to gain access, and so on and 
so forth.  Note that only the user has a list of the passwords.  The
computer itself doesn't have the list of passwords since it isn't a safe
repository.  The computer only has the means of verifying the validity of
the password.  Also, the hashing function must be strong enough that an
adversary cannot engineer $X_{k}$ given $X_{k-1}$.  Note also that to 
generate the list of passwords, the generator must begin with $X_{n}$ and
work backwards until $X_{0}$.

\subsection{Challenge-Response}

This method is very similar to secret functions.  Everytime a user wants
access, the user is prompted with a ``challenge.''  If the user knows the
secret function, the user can calculate the value and ``respond.''

\[ User \stackrel{R = ``challenge''}{\longleftarrow} Host \]

\[ User \stackrel{F(R) = ``response''}{\longrightarrow} Host \]

The host also has the means of calculating the correct value.  If the 
challenge is different everytime the user desires access, the result would
be a one-time password system.  Of course, instead of a function, this
system could also use, say, public-private key encryption.  The user is 
present with a message (challenge).  The user must encrypt it with the
private key.  The host verifies the user by decrypting the message using
the public key and seeing if it matches the original message.  If it does,
the user is granted access.  In general, however, it is not a good idea to
sign arbitrary messages as the ``challenge'' could be anything, like an
encrypted message which says that you are giving your home away.

\subsection{Weaknesses}

The problem with both protocols mentioned is that there is no way
of binding the authentication process with the communication line.  In
fact, both methods are vulnerable to ``hijacking'': when an active adversary
disconnects the line between the user and host and pretends to be the user
and gain access after the user has authenticated.  Hence, this solves the
problem of authentication, but the channel of communication is not secure.

\section{Secure Channels}

The idea behind secure channels is that once established, you can be sure
that the person you are talking to on the other side of the communication
line is the person you began the conversation with.

\subsection{Basic Diffie-Hellman} 
 
Let $p$ be a large prime publicly known and $g$ a generator modulo $p$.
Let's also assume Alice wants to establish a secure channel with Bob.
 
1.   Alice picks a random number mod $p-1$, which we will call $x$.  This
number is kept secret from the adversary.  She then sends Bob $g^{x}$.
 
           \[   A \stackrel{g^x}{\longrightarrow} B \]  
 
2.  Bob picks a random number mod $p-1$, which we will call $y$.  This
number is kept secret form the adversary.  He then sends Alice
$g^{y}$.
          
          \[   A \stackrel{g^y}{\longleftarrow} B \]  
    
    
3.  Now both Alice and Bob can use $g^{xy}$ as their session key, as Alice
knows $g^{y}$ from Bob and she knows $x$.  Hence, she can calculate ${(g^x)}^y = g^{xy}$.
Symmetrically, Bob knows $g^{x}$ from Alice and he knows $y$ and therefore
can calculate ${(g^x)}^y = g^{xy}$.

Once this is established, it is very difficult for an adversary to ascertain
$g^{xy}$ and therefore it is very difficult for an adversary to pretend to
be either Alice or Bob.

{\bf Note:} This protocol relies on another problem in discrete math:
{\em the Diffie-Hellman problem}. Simply stated, it claims that given
$g^x, g^y \pmod p$, it is hard to find $g^{xy}$. This problem is
similar to the discrete logarithm problem, although at best this is as
hard, since knowing how to solve discrete logs solves the {\em
Diffie-Hellman} problem, but the inverse is not necessarily true:
there may be some trick method to solve this problem without computing
the discrete log.

\subsection{Diffie-Hellman ``Diffie''culties}

There are, however, major problems with the Diffie-Hellman method of 
establishing a secure channel:

\begin{itemize}
\item Only works if the adversary is passive.    
\item There is forward secrecy but {\bf no} authentication.
\end{itemize}
 
This makes Diffie-Hellman vulnerable to "man in the middle" attack (a
type of active attack where the intruder controls the flow of
messages, and pretends to be the person the participants are trying to
talk to).
 
\[ Alice \stackrel{g^{x}}{\longrightarrow} Eve
	 \stackrel{g^{x'}}{\longrightarrow} Bob \]

\[ Alice \stackrel{g^{y'}}{\longleftarrow} Eve
	 \stackrel{g^{y}}{\longleftarrow} Bob \]

1.  Eve, for example, can pretend that she is Bob to get $g^{x}$ from Alice
during the initial transmission.  She can then send Alice some $g^{y'}$ 
which Alice would think is from Bob.
 
2.  She can then send Bob some $g^{x'}$ which Bob would think is from
Alice.  Bob, under the protocol, would return $g^{y}$ which would be
intercepted by Eve.  
 
3.  Now Eve has $g^x, y', g^{x'}, y$, which she can get $g^{x{y'}}$ to
talk to Alice with, and $g^{x'y}$ to talk to Bob with. Neither Alice
nor Bob realize that Eve is decrypting all their communications,
reading it, and then passing them on encrypted with the other key.

	This problem can be fixed if authentication is also used as
part of the process, such as using public keys.  More about this will
be discussed later.

\section{Zero-Knowledge (Leakage) Protocols}

The idea behind zero-knowledge protocols is that you prove a fact
(knowledge of a password, solutions to a hard problem), without giving
away any information (the password, the solution, etc.)This means the
person you are talking with will at the end strongly believe that you
know the secret, but have no way of knowing what the secret is.  You
don't ``leak'' any information. This method prevents potential
adversaries from learning your password when you type it in, as in
conventional password based systems.

For example let $(n,e)$ be an RSA public--key. Assume that 
Alice wants to prove that she knows some $m$ where
$c=m^{e}  \bmod n$ is her public.

She could do the following:
\begin{enumerate}
\item Alice sends Bob $y=r^{e}$ where $r$ is a random number mod $n$.
\item Bob sends Alice either $b=0$ or $b=1$
\item Alice sends Bob $z=r*m^{b}$ that is either $r$ or $rm$.
\item Bob  then checks the result, that is if he sent $b=0$ he checks that 
$z^e=y$, if he sent $b=1$ he checks that $z^e=yc$.
\end{enumerate}

This basic protocol should be repeated many times (say 20.)
 
Why does this protocol work? In particular what does it achieve? 
 
We have to prove the following things: 
 
\begin{enumerate}
 
\item The correct Alice who knows $m$ should always pass the protocol.
This property is usually called {\bf completeness.} This is clearly true 
in our case. 
 
\item If a bad Eve tries to impersonate Alice without knowing $m$ she
should fail with high probability. This property is usually called 
{\bf soundness.} Notice that since Alice is prepared to answer both questions
$b=0$ or $b=1$, then she must know $m$. For Eve instead the only possibility
would be to guess what Bob is going to ask. She chooses $r$ at random. 
If she thinks Bob is going to ask $b=0$ then she behaves like Alice in the 
first message sending $y=r^e$. If she thinks Bob is going to ask $b=1$ then 
she sends $y=r^e/c$. Her answer in the first message will always be the only
$e$--root she knows, i.e. $r$. However if the protocol is repeated 
20 times and Bob's choices are always randomly and independently chosen
Eve will have a probability of convincing him equal to $2^{-20}$. 
Notice that by increasing the number of repetitions one can bring
this probability as low as desired. 
 
\item Finally we want that Bob learns nothing from his interaction with Alice. 
This is why this kind of protocols is called {\bf zero--knowledge}. 
We have to argue that the transcript of the conversation with Alice 
reveals nothing to Bob. A way to argue this is to prove that Bob can 
construct such transcript on his own without interacting with Alice. 
Indeed Bob could (behaving like Eve) generate a transcript with
the same identical probability distribution of the true conversations.

\end{enumerate}
 
NOTE: One could argue that Challenge-Response is also a zero-knowledge
protocol; however, this isn't the case.  The host cannot generate the
transcript of a conversation with the same probability distribution 
as that of a true conversation.
 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
