%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt,psfig]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecture
%		date of the lecture
%		lecturer
%		scribe---that is you
%
\lecture{5}{September 19, 1996}{Ron Rivest}{abhi shelat} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favorite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


Current events: 

A {\em New York Times} article discussed an onslaught
of denial of service attacks on network servers. Specifically,
the article describes how a Chess club server was flooded with
so many bogus requests that it was unable to respond to legitimate clients.
This attack stems from a vulnerability in the 3-way handshake used in
the TCP/IP protocol. Once a server receives an SYN, it allocates
system memory to keep state for this connection. It then sends an ACK/SYN back to the
requester and waits for an ACK reply from the client.  If no response
arrives in a predefined window of time, usually on the order of seconds, the
connection is closed and the slot is recycled.
This new attack, described and accompanied with pret-a-porter code in
{\tt alt.cypherpunks} and in {\em 2600 Magazine},
floods a server with SYN packets whose sender fields' have been stamped with randomly
generated IP addresses.  The server gobbles up these requests, soon
runs out of space to allocate new state, and then refuses
to open new connections until one of the slots times out. Legitimate users
are left out in the cold.

We discussed the ethics of posting the code, and potential
countermeasures for this type of attack.

Topics covered today:
\begin{enumerate}
	\item Authentication
	\item Computational security 
	\item DES
\end{enumerate}

\section{Unconditional Authentication}
In the last lecture, we discussed the use of one-time pads
for information theoretically secure encryption.  However,
the scheme we described did not provide a way for
the receiver to be sure that the message she is receiving is the
same message that was sent to her. In other words, she has
no guarantee of the authenticity of the message.

An eavesdropper can modify cipher text, and therefore plain text,
by simply altering the bits he wants. For example,
consider a transaction between an ATM machine and the bank. If the
eavesdropper knows the format of the message, he can alter the
million's digit of the amount to be transfered by just flipping that
particular bit in the cipher stream.

The point here is that authenticity and privacy are independent
and require different techniques.  A guarantee of privacy requires that
only the intended audience can read a message.
With authenticity, we would like 
to provide the receiver a guarantee that the message she receives 
is exactly the same message sent to her.

One proposal for authenticity is simply to send the message twice, 
back to back.
However, this scheme can be easily exploited. If the eavesdropper
knows about it (an assumption we must make), he only needs to modify 
two bits, the original and the copy bit, instead of one.

Another idea might be to append a special string, "This is Alice,"
to the end of the message. However, this does nothing to
protect the first part of the message, which can still be 
tampered.

The general solution to this problem involves
appending a Message Authentication Code (MAC) 
to the message.

 \begin{figure}[h]
 \begin{center}
 \mbox{\psfig{figure=notes-05-fig-01.ps}}
 \caption{MAC used for authentication.}
 \label{fig:1}
 \end{center}
 \end{figure}

One example of a MAC that extends the one-time pad theme from
last lecture involves using a one-time key for authentication.

First let us assume that the adversary's goal is to dupe the 
receiver into accepting a forged or fabricated message. We shall prove that
the following scheme reduces the probability of our adversaries 
success to $\frac{1}{p}$ with $p$ an arbitrarily large prime chosen
by the sender and receiver.

Scheme:
\begin{enumerate}
\item Let the message, $M$ be an integer, $0 \leq M \leq p$, where
	$p$ is prime. We require that the sender and receiver have secretly chosen 
	and shared $K=(a,b)$ such that $0\leq a,b \leq p$ before the start of the protocol.
	Finally, define our MAC to be $f(M,K) = aM + b \ \mbox{mod}(p)$.

	For example, if $p=7$ and $M=5$, we can choose $K=(3,2)$ and
	$f(M,K) = 3*5 + 2=3$.

\item Send $C=(M,f(M,K))$.

\item The receiver now takes $M$, computes $f(M,K)$ and checks to see
	if his value agrees with the value he received. If not, then
	there has been a forgery and he calls Interpol.
\end{enumerate}

The adversary can see both $M$ and $aM+b \ \mbox{mod}(p)$, but
will gain no extra information, since 
this only gives one equation in two unknowns.
By Lagrange's Interpolation theorem, there is no way for the
adversary to recover both $a$ and $b$. The best
the adversary can do is guess either $a$ or $b$ and solve for the other
term. This will allow him to alter the message and recompute a MAC. However,
since there are $p$ possible guesses for $a$ or $b$, the probability of
guessing correctly is $\frac{1}{p}$. Alternatively, the adversary can 
guess a new MAC. Again, since there are $p$ different
MAC values, the probability
that the adversary can make an undetectable change is still $\frac{1}{p}$.

Note that reuse of key breaks the system since this gives
an eavesdropper two equations in two unknowns. Also note that
the MAC consumes just as many bits as the message.  

A geometrical interpretation follows. The secret key can
be thought of as a slope and an intercept on a line mod $p$. An adversary
is given only one point on the line, and hence, can only guess
the $p$ possible intercepts to discover $K$ and spoof a message.

To combine these two schemes into a new scheme that has both
authenticity and privacy, we use two
shared keys, $K_1$ for privacy, and $K_2=(a,b)$ for authenticity.
The message consists of $(K_1 + M,\ f(M,K_2))$.

\section{Computational Security}
Key management for one-time pad schemes is difficult. In order to solve this problem, 
we sacrifice information theoretic security for computational security.
Computational security is based on the computational difficulty of breaking an 
encryption scheme. 

These type of schemes have two functions:
\[	E(M,K) = C \] 
\[	D(C,K) = M \]
The strength of these type of algorithms relies on the fact that an adversary
can not determine $K$ even if she is given matching plain text and cipher text
pairs $(M,C)$.

Many of these cryptologics are based on a Fiestal network:
%picture.
 \begin{figure}[h]
 \begin{center}
 \mbox{\psfig{figure=notes-05-fig-02.ps}}
 \caption{Fiestal Network.}
 \label{fig:2}
 \end{center}
 \end{figure}

DES is a 64-bit block cipher proposed in 1976. 
A block cipher is an algorithm that encrypts blocks of data at 
a time, as opposed to a stream cipher which can encrypt single bits or bytes.
Methods for using DES to encrypt messages that are longer than 64-bits will be 
discussed in the next lecture.  DES is impressively fast when implemented in hardware. 

DES is based on a 16-round Fiestal network. Each round breaks the incoming block into
two 32-bit parts, $L$ and $R$. A set of eight substitution boxes from $V^6 \to V^4$
where $V=\{0,1\}$
along with an expansion and permutation constitute the round function, $f$.
Each of the 16 rounds in DES uses a key schedule to extract a 48-bit subkey 
from the 56-bit key given as input to the algorithm.

Decoding is performed by running the algorithm in reverse.

This excerpt from {\tt http://www.netsurf.com/nsf/v01/03/nsf.01.03.html}
provides some more information on DES:

One of the most widely used encryption algorithms is DES (Data Encryption
Standard). It was developed by IBM and adopted as an official Federal
Information Processing Standard (FIPS PUB 46) in 1976. DES uses a 56-bit
key - considered to be just beyond the technology at the time to break
with a brute force approach. However, by 1993 a custom computer costing \$1
million could theoretically be built to crack DES by brute force in 7
hours. In the following year, a new technique called "linear
cryptanalysis" enabled another researcher [Matsiu] to break DES in 50 days on a
single workstation, or about 14 MIPS-years assuming a 100 MIPS machine.
Efforts to extend the life of DES include lengthening the key to 128 bits
(still beyond the realm of computer horsepower today)  and "Triple DES",
which involves three passes of encryption and decryption using two
different keys.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
