%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% \documentstyle[12pt,twoside,alltt]{article}
\documentstyle[12pt,twoside,alltt,epsf]{article}
% is the line you should use IF you're using EPS images.
% make sure to copy the psfig.sty file into the directory with
% the latex document however.
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{15}{October 23rd, 1997}{Ron Rivest}{Ben Adida} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.eps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure. HOWEVER, leave it commented or follow
%	  the instructions at the top if you want to latex it on Athena. 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.eps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Topics Covered}

\begin{itemize}
\item An Active Attack on RSA smart cards
\item Secure Channels over Insecure Connections
\end{itemize}

\section{Active Attack on RSA Smart Card}

The timing attacks we saw last time showed that there are ways of
completely circumventing theoretical difficulties to break
cryptographic systems. While the timing attacks were passive, here we
see an active attack on some RSA Smart Cards.

In practice, RSA public exponents are chosen to be small (3, 17,
etc...), which makes encryption and signature verification reasonably
fast. Private exponents, however, should never be small for obvious
security reasons. This makes decryption slow. One way to speed things
up is to split up calculations modulo p and modulo q using the Chinese
Remainder Theorem. For smart cards which usually have limited
computing power, this is a very useful technique.

The steps of the CRT computation are as follows:

$ c= M^e \pmod{n} $

\begin{tabular}{ll}
$c_1= c \pmod{p}$ & $c_2= c \pmod{q}$ \\
$d_1= d \pmod{p-1}$ & $d_2= d \pmod{q-1}$ \\
$m_1= c_1^{d_1} \pmod{p}$ & $m_2= c_2^{d_2} \pmod{q}$ \\
$a_1= q^{-1} \pmod{p}$ & $a_2= p^{-1} \pmod{q}$ \\
\end{tabular}

$m= a_1*q*m_1 + a_2*p*m_2 \pmod{n}$ 

The danger that the card exposes here is precisely in performing
separate calculations for p and q. An active attack consisting simply
in a power spike during the calculation of one of the two $m$'s is
enough to reveal $n$'s factorization.

Suppose that a power spike or other disturbance causes a change in the
calculation of $m_2$, such that it now becomes $m_2'$.

The attacker can then take a random plaintext $m$, encrypt it to
obtain $c$, then pass $c$ through the the smart card, providing the
disturbance to obtain:

$m'= a_1*q*m_1 + a_2*p*m_2' \pmod{n}$

$m-m'= a_2*p*(m_2-m_2') \pmod{n}$

Thus,

$gcd(m-m',n)= p$

and the attacker obtains $n$'s factorization, which easily yields the
RSA secret exponent $d$.

One possible fix for this is to simply have the smart card check that
the output it is about to produce still encrypts to the proper
ciphertext it was fed in the beginning. If there is a difference, the
card can simply refuse to output the result, thereby securing its
secret key. Another fix is simply to perform the operation twice, and
yielding an output when the two results are the same.

\section{Providing Secure Channels over Insecure Connections}

\subsection{Weaknesses of Insecure Connections}

In the history of hacking, phone systems have been an easy
target. Public telephones have gone from being easy targets to being
extremely hard to hack. However, phone lines, like many other means of
communication, remain insecure.

People often make weak assumptions about phone lines:
\begin{itemize}
\item The number you call is the number you reach. \\
It's far from impossible to hack into a telephone router and reroute a
number to a different destination. Nothing authenticates the user at
the end of the line.
\item The person on the other end of the line is the same from
beginning to end of conversation. \\
The call can be ``hijacked'' in the midst of conversation. Imagine an
online conversation that begins with a zero-knowledge proof. The
attacker can wait until the proof takes place, then hijacks the
communication, having full access to the system.
\end{itemize}

The idea is that we need authentication from beginning to end.

Cryptographic keys are the basis for secure channels. They provide a
logical, virtual secure channel on top of an insecure connection like
a phone line.

\subsection{Establishing an Authenticated Channel: Key Exchange}

We need to perform a key exchange in a fully authenticated way, so
that each party is convinced of the identity of the other.

The intuitive solution to this is the direct Public-Key approach:
\begin{itemize}
\item Sign message
\item Encrypt signed message with recipient's public key (or bootstrap
a secret key encrypted with recipient's public key).
\end{itemize}

The problem with this idea is that there is no Perfect Forward
Secrecy. A system achieves Perfect Forward Secrecy if the disclosure
of long-term secrets doesn't compromise any past communications. This
directly implies that a long term key cannot be used for
encryption. A system that achieves Perfect Forward Secrecy is one
where long term secrets are used only for authentication (signatures).

Our new protocol thus becomes:

\begin{itemize}
\item A transitory (session) asymmetric keypair is generated.
\item The transitory public key is signed by the long-term keypair
\item The signed transitory public key is then used for that
communication's encryption (directly, or through bootstrapping for
secret key).
\item The transitory keypair is discarded as soon as the communication
is cut. Thus, once the communication is over, no one (including the
individuals who communicated) will be able to decrypt a recording of
the conversation.
\end{itemize}

\subsection{Diffie-Helman}

Using Diffie-Helman to perform the key exchange, a naive protocol
might look like this:

\vspace{3mm}

\epsfbox{notes-15-fig-1.eps}

\vspace{3mm}

This protocol has serious problems, as mentioned earlier. An attack on
the system might look like this:

\vspace{3mm}

\epsfbox{notes-15-fig-2.eps}

\vspace{3mm}

By becoming active, Eve the attacker intercepts the key exchange, and
then becomes a passive relay between Alice and Bob. Eve's goal is
simply to eavesdrop, not interfere.

In the case of a phone conversation, one can assume ``voice''
authentication, meaning that Alice can recognize Bob's voice on the
other end of the line. Bob can then read to Alice a hash of the public
key he used, which Alice can confirm. If these don't match, it's time
to hang up the phone and try again!

On the other hand, we might want stronger authentication: digital
signatures. One protocol for performing this works as follows:

\vspace{3mm}

\epsfbox{notes-15-fig-3.eps}

\vspace{3mm}

This protocol shows that Bob knows the key $k$, because Bob returns an
encrypted copy of a signed $g^x \pmod{p}$, which is a {\em fresh}
message.

There remains, however, a small problem with this protocol. If an
attacker can somehow convince the supposed receiver to sign
$h(g^x,g^y)$, then a key exchange interception can be performed.
In this protocol, Alice is supposed to believe that Bob has the key
$k$, which is not necessarily true.

This can be fixed by having the return message from Bob include $k$
signed by Bob, which directly implies that Bob knows $k$.

This protocol remains interesting, though, because it accomplishes
freshness without the use of timestamps.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
