\documentstyle[12pt,twoside,alltt,DraTex,AlDraTex]{article}

\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{4}{September 17, 1996}{Ron Rivest}{Kevin Fu} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


Topics covered today:

\begin{itemize}
\item Communications
\item Risk Analysis
\item Crypto
\end{itemize}

\section {Communications}

The phone system is the biggest communications system around.
Securing this medium has proven to be a difficult task.  Watching how
security on the phones has changed, in adaptation to the different
attacks on the system, is a good way to study the evolution of
security, in general.  Phone booths and pay phones have evolved into
highly impenetrable fortresses.  They are designed against physical
attacks and attempts to make money off of them as well as being
difficult to vandalize.

Some terminology was brought up: phone freaks, computer hackers, and
phracks.  A phone freak is someone who uses phones illegally, a
computer hacker is someone who breaks into computer systems illegally;
the combination of the two is called a phrack.

We observed that phone system users depend on:
\begin{itemize}
\item Reliability

	Phone systems are expected to be working all the time.  A
	January 15, 1990 incident was described where a bug in AT\&T
	telephone switching software caused an outage for half of the
	United States.  The bug was traced down to a case statement in
	some C code.  According to {\em The Hacker Crackdown}, ``Within
	the C software was a long `do... while' construct. The
	`do... while' construct contained a `switch' statement. The
	`switch' statement contained an `if' clause. The `if' clause
	contained a `break.'  The `break' was supposed to `break' the
	`if clause.' Instead, the `break' broke the `switch'
	statement.''  This single bug caused all of the mayhem.
\item Authenticity

	For instance, when one calls a bank phone number, one expects
	the bank to answer on the other side.  But an example was
	given where phone phracks reprogrammed a Bell South telephone
	switch to divert the Palm Beach County Probation Department's
	incoming calls to a phone sex line.  

	In general, one should not rely on the phone system for
	air-tight security or authentication.

\end{itemize}

Other examples of phone abuse were cited.  In the mid 70's, devices
called {\em blue-boxes} emulated the 2600Hz signal used by phone
switches to make long distance calls.  With this device, phone users
could make free long distance calls.  (You didn't have an excuse
not to call home).  The 2600Hz signal became the symbolistic name for
the phreaks.  The alt.2600 newsgroup and FAQ discuss vboxes,
red-boxes, blue-boxes, and code for ethernet sniffers.

The cellular phone system is also vulnerable to attack.  CNN reported
that over 80,000 cell phone numbers were collected while unsuspecting
motorists whizzed by on a busy Brooklyn highway.  Thieves used a
``black box'' scanner to intercept numbers.  See {\tt
http://cnn.com/US/9607/02/newsbriefs/index.html}.

Break-ins to company PBX's where also mentioned.  Phracks were able to
``bounce'' off company PBX's for free long distance calls.

Items for warning of phone system abuse (eg, caller ID and callback modems)
are also circumventable.  Such devices are simply ``higher fences'' for
intruders to jump over.

\section {Risk Analysis}


Risk Analysis is about analyzing a situation and the risks that
apply to it, as well as the security measures being taken currently
and the measures that could be taken (more or less measures).  It is a
standard approach for deciding the seriousness of a risk.  It is done
to show the validity of an expensive system that appears to do nothing
useful.  It is a validation for security budgets.  In class we discussed
the Lojack system, a device to aid in re-acquiring a stolen car.

To recover a stolen car equipped with Lojack, a call is first made to
Lojack officials.  Then a beacon is set off in the stolen car.  Police
track down the car and [usually] apprehend the thief.

\begin{figure}[bp]
\hspace{1in}\begin{tabular}{|l|l|l|} \hline
				& Without Lojack	& With Lojack \\ \hline
Pr(lost forever)		& 75\%			& 10\% \\
Emotional [therapy] factor	& \$2000 		& \$2000 \\ \hline
Pr(recovered)			& 25\%			& 90\% \\
Emotional [therapy] factor	& \$1000 		& \$750 \\ \hline
Expected Loss			& \$1750		& \$900 \\ \hline
\end{tabular}
\caption{Cost analysis of a {\bf stolen} car in Boston, where Pr(car is
stolen)=1\%/yr}
\end{figure}

Risk Analysis Process:
\begin{enumerate}
  \item Identify assets \& penalties and determine value
\begin{tabbing}
sssss \= ssssssssssssssssssssssssssssss \= ssssssssss \= ssssssssss \= \kill
\> car \> 50 \\
\> emotional stress \> 100 \\
\> late lecture notes delivery \> \ldots \\
\end{tabbing}
  \item Find vulnerability
	\begin{itemize}
	\item theft
	\item accidental loss
	\item damage
	\end{itemize}
  \item Estimate likelihood of exploitation
\begin{tabbing}
sssss \= ssssssssssssss \= ssssssssss \= ssssssssss \= \kill
\> 1\% Chance \> Car stolen in a year in Boston \\
\end{tabbing}

  \item Figure annual loss

Approximate the loss taking into account insurance, car value,
and emotional stress per year.

  \item Determine cost of added security

	We guestimated a \$250 initial registration fee and a \$500
	fee for actually requesting the beacon to be switched on.  The
	benefit of using the Lojack system is reduced insurance (save
	\$50/yr).  Assume a \$500 deductible.

  \item Estimate likelihood of exploitation under added security

The Lojack system decreases the likelihood that a thief will get away.

  \item Form conclusion

The Lojack system will save the consumer money on the average as
described in figure 1.  The expected cost of a car without Lojack is
\$17.50/yr while a car with Lojack is \$25 (registration) + \$9
(stolen) - \$50 (insurance) = -\$16/yr.

\end{enumerate}

Notice how silly this can be, since the numbers are all such rough
estimates.  Even though it may seem silly here, especially
with our soft numbers and no research done into the problem, in big
systems, where a computer company has a vested interest in finding
out whether or not to protect themselves, risk analysis is useful.
This example was more meant to show the method of the procedure, rather
than its usefulness. 

\section {Crypto}

Despite this not being a crypto course, we shall get into some of
its basics and discuss its relevance to security. 

WWI motivated much of the early work on cryptography: securing and
authenticating radio broadcasts.  Unless you have physical control
over a resource, you might as well assume it's in the hands of the
enemy.  Cryptography attempts to overcome this challenge.

What is cryptography about?  Communication in the presence of
adversaries. What are the worries?  {\em Confidentiality} (or secrecy,
or privacy): keeping messages secret.  Also {\em Authenticity} (or
integrity): making sure the recipient of a message knows who
originated it. The goals of cryptography are maintaining
confidentiality and authentication.

Secret key (shared secret) cryptography is the traditional key system
(as opposed to public-key crypto).  The key needs to
be physically protected and securely delivered to the other party.

Let's introduce our classic characters: Alice, Bob, and Lucifer.
Alice is sending messages to Bob, and Lucifer controls their
communications medium.  Bob wants to know that Alice is sending the
message M and that it is unmodified and secret.  Lucifer can change the
message, can block messages, can send his own messages.  An
eavesdropper can be {\em passive} (listening to M) or {\em active}
(inserting/changing M).


Alice sends an encoding of a message: ciphertext.  Alice has
an encoder to accomplish this.  She then sends it out on the
communications line where Lucifer can get at it.  Bob has
a decoder.  If Bob receives a message, he decodes it with
his decoder and if it makes sense, he will accept it as
coming from Alice.

We can distinguish between two forms of cryptography depending on what
is used to protect the data: either {\em information theory} or
{\em computational complexity}.

Information-theoretically protected data is proven to be safe.  There
is a proof of the unbreakability of the encrypting algorithm, so it is
impossible for Lucifer to read the messages being sent.  To do this,
however, a key has to be known to both parties, as long as the
message; as more messages are sent, more key is used up.  Since we
like to share a fixed length of a secret key, the majority of
encryption uses computational complexity.  In this case Lucifer can't
break the security assuming he has limited computational power and
certain problems require a very long time to solve. In these cases a
proof of security of the cryptosystem hinges on some unproven
computational assumption which is however generally known to be true
(for example factoring large integers is hard.) By this very
definition, we are on shakier ground when we are sending information;
however, since it is easier, it is the more common practice.  Unlike
in information theoty, here keys are typically re-used.

\subsection{Information-theoretic Security}

Lucifer can't break the security even if he has infinitely powerful
computational resources.  Problem: Keys are {\em use-once}; otherwise
vulnerable to attack.
		
{\bf Vernam One-Time Pad} 

The encryption is provable as being unbreakable.  The {\bf one time
pad} encryption scheme requires Alice and Bob to share a
use-once key, $K$, and a message, $M$.  The random key is the same
length as M, and each key bit is independent of each other.  The
message is typically padded with random bits for further security.

	\[ M=0110 \] 
	\[ K=1100 \]

To produce the ciphertext, Alice puts her message and the key (one
time pad) together in a bitwise XOR function.  

	\[ C = M \oplus K = 1010 \]

This ciphertext is sent over the insecure medium.

If Bob gets a message, he takes that ciphertext and XORs it, in a
bitwise fashion, with his copy of the (same) key to decrypt the
original message.

	\[ M= C \oplus K = 0110 \]

This technique provides perfect secrecy.  

\begin{claim}
If the pad is never used again, the ciphertext does not increase
the adversary's knowledge about the message.
\end{claim}
Lucifer may know something beforehand, like that M is part of the
English language or one of 3 colors.  Indeed it is easy to prove that
given a ciphertext $C$, any message $M$ could have been sent using the
key $K=C \oplus M$.

\begin{figure}[b]
\Draw
\TreeSpace(S,60,40)
\TreeSpec()
	 ()(\Edge)
\LTree()($2/3$~~$M=0$#$1/3$~~$M=1$,2,//
	$1/2$~~$K=0$#$1/2$~~$K=1$,2, & $1/2$~~$K=0$#$1/2$~~$K=1$,2,//
	,0,$C=0$~~$1/3$ &,0,$C=1$~~$1/3$ &,0,$C=1$~~$1/6$ &,0,$C=0$~~$1/6$//)
\Move(-135,-40)
\DrawOval(80,25)
\EndDraw
\caption{Probability Tree for ciphertexts}
\end{figure}

Let's say the adversary knows the likelihood of certain messages:
$2/3$ Chance of $M=0$ and $1/3$ Chance of $M=1$. The unconditional
probability is $Pr(M=0)=2/3$

The conditional probability using the circled portion in figure 2 is
$Pr(M=0 | C=1)$.
\[ = \frac{Pr (M=0 \wedge C=1)}{Pr(C=1)} \]
\[ = \frac{1/3}{1/2}=2/3 \]

Since the conditional probability = the unconditional probability,
even knowing the possible forms of M does not produce any new information
to solve the problem.

Why is it important to only use the pad once?  If you let it
be a two time pad, and somehow Lucifer knows or guesses that
you are using the same pad, he can gain some knowledge.  If $M_1$
and $M_2$ are encrypted using the same pad $K$ to get $C_1$ and $C_2$ then 
Lucifer can compute 
\[ C_1 \oplus C_2 = (M_1 \oplus K) \oplus (M_2 \oplus K) = M_1 \oplus M_2 \]
This may not seem very important, but
statistical analysis shows that it can be very easy to get
the two original messages from this, due to the redundancy of
the English language.  One thing to note is that if $M_1$ and $M_2$ 
are compressed before the encryption, then it is
much harder to get the original messages from the XOR of the
two compressed messages.

If you are thinking that using a XOR pad more than once is not really a 
security risk, you may be interested in the story of project Venoma. 
During the cold war years apparently the Russians were reusing pads 
for their encrypted communications between embassies. The Western intelligence
agencies guessed that this was the case and started a massive effort 
for the decryption of the messages. By collecting a huge number of 
ciphertexts and looking for dependencies they were able to decrypt a
good portion of the messages. It is still not clear how it was possible 
for the Russians to make such an error. Project Venoma was recently 
declassified by the CIA. 

\section {Handouts \& Readings}
{\em The Hacker Crackdown} by Bruce Sterling, 1992 Bantam (also available online at {\tt http://kraken.nwscc.sea06.navy.mil/crackdwn/hacker.htm})

{\em Hackers} by Steven Levy

{\tt alt.2600} newsgroup

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}



