CS 114: Network

Security
Lecture 10 - Transport Layer Security

Prof. Daniel Votipka

Spring 2023
(some slides courtesy of Prof. Micah Sherr)
 Administrivia
• Exam 1 has mostly been graded
• Review next week!
• No lecture on Thursday (I will still have office hours)
• Homework 1, part 2 extended to Mar. 7th at
11:59pm
• Limited TA Office hours (See Piazza) this week
• HMAC test verified manually
• LaTeX template in Box
2
Kerberos

3
 Kerberos Overview

Knows all users’ and

servers’ passwords
User proves his identity;
requests ticket for some service

User receives ticket

Ticket is used to access

User
desired network service Servers
 “Single Logon” Authentication
kinit program (client)
Key Distribution
Center (KDC)
password IDc , IDTGS , timec
Convert into
client master key

User Kc EncryptKc(Kc,TGS , IDTGS , timeKDC ,

lifetime , ticketTGS)
Decrypts with Fresh key to be used
Kc and obtains between client and TGS
Kc,TGS and TGS Key = KTGS
ticketTGS
EncryptKTGS(Kc,TGS , IDc , Addrc , Key = Kc
IDTGS , timeKDC , lifetime) …
Client will use this unforgeable ticket to
get other tickets without re-authenticating
All users must
pre-register their
passwords with KDC

• Client only needs to obtain TGS ticket once (say, every morning)
• Ticket is encrypted; client cannot forge it or tamper with it
5
 Obtaining a Service Ticket
Client EncryptKc,TGS(IDc , Addrc , timec) Ticket Granting
Proves that client knows key Kc,TGS
Service (TGS)
Knows Kc,TGS contained in encrypted TGS ticket usually lives inside KDC
and ticketTGS

System command, IDv , ticketTGS , authC

e.g. “lpr –Pprint”

User EncryptKc,TGS(Kc,v , IDv , timeTGS ,

EncryptKTGS (Kc,TGS , IDc , Addrc , ticketv)
IDTGS , timeKDC , lifetime)
Fresh key to be used Knows key Kv for
between client and service
each service

EncryptKv(Kc,v , IDc , Addrc , IDv ,

timeTGS , lifetime)
Client will use this unforgeable
ticket to get access to service V

• Client uses TGS ticket to obtain a service ticket and a short-term key for
each network service
• One encrypted, unforgeable ticket per service (printer, email, etc.)
6
 What is the Internet?
A collection of independently operated
autonomous systems (ASes)
boundary router
backbone router
Src=Alice,SrcPort=1234
Dest=Bob,DestPort=80
Backbone
Content=“Hello world” area
border
router
internal
routers

Area 3
Area 1
Area 2

7
 What about security?

• Where is confidentiality and

authenticity?
• No relevant “security” fields
in IP, TCP, or UDP headers.

8
 Alice’s Switch

Eavesdropping

Internet

Bob’s Switch

9
10
 Let’s use that crypto stuff
• Let’s build some new protocols Let’s build a
• HTTP → SecureHTTP crypto-wrapper
standard instead
• POP → POPSecure

✖
• IMAP → CryptoIMAP
• SMTP → SMTPSec
• FTP → FTPS
• Jabber → SecJabber
• Telnet → TelCryptNet
11
 IP Packet

Security Layer

Unencrypted
Protocol

12
 What properties should
this crypto-wrapper have?
• Confidentiality
• Integrity
• Authenticity
• Server
• Client
• Mutual authentication
• Reliability
13
SSL / TLS

14
 History
• Secure Sockets Layer (SSL) developed by Netscape (remember
them?) in 1995
• Version 1 never released
• Version 2 incorporated into Netscape Navigator 1.1
• Microsoft fixes vulnerabilities in SSLv2 and introduces Private
Communications Technology (PCT) protocol
• Netscape overhauls SSLv2, fixing some more security issues, and
releases SSLv3
• IETF takes over and releases Transport Layer Security (TLS),
a non-interoperable upgrade to SSLv3
• current version is TLS version 1.2, RFC 5246
https://tools.ietf.org/html/rfc5246
15
 K.I.S.S.

• Application-layer
protocol
• Operates over TCP --
WHY?

16
SSL/TLS Message Types

• Handshake
• Alerts
• Change cipher spec
• Data

17
SSL/TLS Message Types

• Handshake
• Alerts
• Change cipher spec
• Data

18
 Overview
• Alice (client) initiates conversation with Bob (server)
• Bob sends Alice his certificate
• Alice verifies certificate
• Alice picks a random number S and sends it to Bob,
encrypted with Bob’s public key
• Both parties derive key material from S
• Client and server exchange encrypted and integrity-
protected data

19
 SSLv2 Handshake
ClientHello,Version,

Alice Bob
Cipher list., RAlice
ServerHello,Ver., Cert.,
Chosen cipher, RBob

EBob+(S)

EK’(Data)

Encryption and Alice randomly chooses S,

Alice computes integrity keys derived Bob computes
the “pre-master secret”
master secret k as from Master Secret master secret k as
K=h(S,RAlice,RBob) K=h(S,RAlice,RBob)
20
 Cipher Suites
[msherr@Speedy 10:49 AM] ~/Documents/teaching/cosc235/lectures> openssl ciphers -v
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD

•
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256)
Includes encryption Mac=AEAD
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384

algorithm, key ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH

ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH
Au=ECDSA Enc=AES(256) Mac=SHA384
Au=RSA Enc=AES(256) Mac=SHA1
ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
length, block mode, SRP-DSS-AES-256-CBC-SHA SSLv3 Kx=SRP Au=DSS Enc=AES(256) Mac=SHA1
SRP-RSA-AES-256-CBC-SHA SSLv3 Kx=SRP Au=RSA Enc=AES(256) Mac=SHA1
and integrity SRP-AES-256-CBC-SHA SSLv3 Kx=SRP
DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH
Au=SRP Enc=AES(256) Mac=SHA1
Au=DSS Enc=AESGCM(256) Mac=AEAD
checksum DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH
DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH
Au=RSA Enc=AESGCM(256) Mac=AEAD
Au=RSA Enc=AES(256) Mac=SHA256
algorithm DHE-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
TLSv1.2 Kx=DH
SSLv3 Kx=DH
Au=DSS Enc=AES(256) Mac=SHA256
Au=RSA Enc=AES(256) Mac=SHA1
DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1

• ~90 defined cipher

DHE-DSS-CAMELLIA256-SHA SSLv3 Kx=DH Au=DSS Enc=Camellia(256) Mac=SHA1
ECDH-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDH-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(256)
suites Mac=AEAD
ECDH-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AES(256) Mac=SHA384
ECDH-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256) Mac=SHA384

•
ECDH-RSA-AES256-SHA SSLv3 Kx=ECDH/RSA Au=ECDH Enc=AES(256) Mac=SHA1
Alice gives Bob a ECDH-ECDSA-AES256-SHA
AES256-GCM-SHA384
SSLv3 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256) Mac=SHA1
TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD

list of supported AES256-SHA256

AES256-SHA
TLSv1.2 Kx=RSA
SSLv3 Kx=RSA
Au=RSA Enc=AES(256) Mac=SHA256
Au=RSA Enc=AES(256) Mac=SHA1
CAMELLIA256-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA1
cipher suites; Bob PSK-AES256-CBC-SHA SSLv3 Kx=PSK Au=PSK Enc=AES(256) Mac=SHA1
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
makes final choice ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH
Mac=AEAD
Au=ECDSA Enc=AESGCM(128)

ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256

ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256

21
 Authentication
ClientHello,Version,

Alice Bob
Cipher list., RAlice
ServerHello,Ver., Cert.,
Chosen cipher, RBob

EBob+(S)

EK’(Data)

Q: Which parties
are authenticated?

22
 SSLv2 Problems
ClientHello, Version,

Alice Bob
Weakest ciphers
Cipher list., RAlice
ServerHello,Ver., Cert.,
Chosen cipher, RBob

EBob+(S)

EK’(Data)
TCP FIN

23
 SSLv3 Fixes
ClientHello,Version,

Alice Bob
Cipher list., RAlice
ServerHello,Ver., Cert.,
Chosen cipher, RBob

EBob+(S), hK(all prior handshake msgs)

hK(keyed hash of handshake msgs)

EK’(Data)
EK’(Finish) Keyed hash over previous
messages ensures
integrity protection

24
 SSL/TLS with
Server and Client Authentication

Alice Bob
ClientHello, Version, Cipher list. RAlice

ServerHello, Ver., CertBob, Cipher, RBob

CertRequest

EBob+(S), CertAlice

Sig(Alice-,hK(all prior handshake msgs))

hK(keyed hash of handshake msgs)

EK’(Data)

Signature proves Alice

EK’(Finish) knows private key
associated with
her certificate
25
 Handshake cost
• Per-session master secret derived using
expensive public key crypto

[msherr@NotLinux 11:31 AM] ~> openssl speed rsa1024 aes-128-cbc

Doing aes-128 cbc for 3s on 16 size blocks: 27119786 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 7393395 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 1883302 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 473817 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 58941 aes-128 cbc's in 3.00s
Doing 1024 bit private rsa's for 10s: 6693 1024 bit private RSA's in 9.99s
Doing 1024 bit public rsa's for 10s: 137389 1024 bit public RSA's in 9.98s
OpenSSL 1.0.0a 1 Jun 2010
built on: Fri Jul 16 10:30:43 EDT 2010
options:bn(64,64) rc4(ptr,char) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: /usr/bin/gcc-4.2 -fPIC -fno-common -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS
-D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -arch x86_64 -O3 -DL_ENDIAN -DMD32_REG_T=int -Wall
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128 cbc 145122.60k 157725.76k 160708.44k 161729.54k 160948.22k
sign verify sign/s verify/s
rsa 1024 bits 0.001493s 0.000073s 670.0 13766.4

26
HTTP 1.0
GET /index.html

In HTTP
[Data]1.0, each
transaction requires a
separate TCP
connection (i.e.,
GET “session”)
/logo.gif

POST /login.cgi
27
 Session Resumption
• Allows Alice and Bob to construct new encryption
& integrity keys using previously shared pre-master
secret (S)
• uses session-id to continue SSL session over
multiple connections
• avoids having to repeat public-key crypto
operations
• Ifsecret
either Alice or Bob don’t remember master
key, new handshake is required

28
 SSLv3 Handshake
Alice Bob
ClientHello, Version, Cipher list. RAlice

ServerHello, Ver., Cert., Chosen cipher, RBob

EBob+(S), hK(all prior handshake msgs)

hK(keyed hash of handshake msgs)

EK’(Data)

EK’(Finish)

29
 Session Resumption
Alice session-id, Cipher list, RAlice
Bob
session-id, cipher, RBob
hK(keyed hash of handshake msgs)

hK(keyed hash of handshake msgs)

Alice and Bob

EK’(Data) compute new
master secret
k as
K’=h(S,RAlice,RBob)
30
 TLS v1.3 (2018)

• Limits cipher options

• Pre-shares multiple keys for
resumed sessions
SSL/TLS in
the Real
World
32
Network Stack, revisited
Application
SSL/TLS

Transport

Network

Link

Physical
33
 SSL/TLS in the Real World
• Most (modern) browsers support SSLv3, TLS 1.2
• Client authentication very rare -- WHY?
• Implementations:
• HTTP (80) → HTTPS (443)
• POP (110) → POP3S (995)
• IMAP (143) → IMAPS (993)
• SMTP (25) → SMTP with SSL (465)
• FTP (20,21)→ FTPS (989,990)
• Telnet (23) → Telnets (992)
34
 SSL/TLS and the Web
• HTTPS: Tunnel HTTP over SSL/TLS
• Add golden lock symbol
Supported ciphers

Chosen cipher
Web Web
Certificate
Browser Server
Generate shared secret keys

Transfer HTTP over SSL channel

35
“cs.tufts.edu/cs/114”
 Let’s look at one of those packet things
0 1 2 3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

IP Header:
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

At least 20 bytes
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |

TCP Header:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |U|A|P|R|S|F| |

At least 20 bytes
| Offset| Reserved |R|C|S|S|Y|I| Window |
| | |G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Checksum | Urgent Pointer |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
|
SSL/TLS Record Data -- header |
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
TLS Header &
Application Data
| Application Data |
| |
| ... |
| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

37
38
Problems with TLS/SSL

39
If Bob’s cert isn’t verified, how do you know you’re
actually talking to Bob?

Alice “Bob”
Bob
ClientHello,Version,
Cipher list., RAlice
ServerHello,Ver., Cert.,
Chosen cipher, RBob

EBob+(S)

EK’(Data)

40
Solution: Use a PKI

41
The 2011 DigiNotar Incident

42
Exploiting the network
• The Internet is extremely vulnerable to
attack
• it is a huge open system ...
• which adheres to the end-to-end principle
• smart end-points, dumb network
• Can you think of any large-scale attacks that
would be enabled by this setup?

43