Sebery J.Cryptography.An introduction to computer security.1989

6. publishes p; q; ; t and its public key.

Registration: The following steps are undertaken by P to get the certi cate from T A.

1.P selects at random her private key s 2R Zq and computes her public key K s mod p.

2.P registers her public key K with T A so T A publishes a certi cate

(signature) S for (IDP ; K).

Message Sequence: P proves to V her identity in three passes.

T A provides public parameters of the system. The public key of T A is used to verify the prover's certi cate S. The protocol in the scheme takes three passes. P picks a random r 2R Zq and computes her commitment u r mod p and sends IDP ; K; S; u; S to V . V checks whether (IDP ; K) and the corresponding certi cate S match. If so, V chooses his random challenge b and dispatches it

response u yKb mod p.

Clearly if P follows the protocol, she is always correctly identi ed by V . On the other hand, an impostor Oscar can cheat if he is able to guess V 's challenge. Let his guess be g. Instead of the prescribed u = r, Oscar sends his commitment

u r Kg mod p:

Vsends his challenge b and Oscar has to respond with y r + (b g)s mod q:

He will get away if g b mod q as he is able to send a valid response y r mod q. The probability of Oscar's correct guess of b is 2 t. In other words, the false acceptance rate is 2 t.

452 13 IDENTIFICATION

Let us illustrate the protocol using small parameters (the protocol is not secure). T A has the following parameters: p = 285457, q = 313, = 146159. Peggy chooses private key s = 237 and computes her public key K = s 166428 mod 285457. P registers her identity plus her public key with T A. T A publishes its public key and certi cate S of Peggy's (IDP ; K).

Assume that V wishes P to identify herself to him. P selects at random r, let it be r = 133, computes her commitment u = r2 36157 mod 285457 and forwards IDP ; K; S; u to V . V veri es whether the pair (IDP ; K) and the certi cate match (this step is skipped). If the check holds, V sends his challenge b, say b = 167, to P . P nds y r + sb mod q, which is y = 274 and sends it to V . V calculates

yKb = 146159274166428167 36157 mod 285457;

which is equal to Peggy's commitment u. V accepts Peggy.

The Schnorr scheme is indeed very eÆcient. The prover (a smart card) needs a single exponentiation modulo p to generate her commitment. The response y involves single multiplication and addition modulo q. The scheme is provably secure against passive attacks under the DL assumption.

13.6.2 Okamoto Identi cation Scheme

A modi cation of the Schnorr scheme that is as secure as the corresponding discrete logarithm instance, was given by Okamoto in [389]. The scheme is provably secure against active attackers. The scheme works as follows.

Okamoto identi cation scheme

TA Precomputations: T A sets up the parameters of the scheme. In particular,

TA

1.chooses a modulus p where p is prime,

2.takes a factor q of (p 1) (q is prime),

3.picks up two integers 1 and 2 of order q in the group Zp ,

4.selects an integer t = O(p), say t 20,

5.uses its secret key to issue certi cates while its public key is used to verify them,

6.publishes p; q; 1; 2; t and its public key.

Registration: The following steps are undertaken by P to get the certi cate from T A.

1.P selects at random her private key (s1; s2) 2R Zq Zq and computes her public key K 1 s1 2 s2 mod p.

2.P registers her public key K with T A so T A publishes a certi cate

Let us illustrate the scheme on a simple example. The scheme has the following parameters: p = 6491, q = 59, 1 = 1764, 2 = 4269, t = 5. P chooses her two secret elements s1 = 21, s2 = 47. The public key

P selects at random r1 = 13, r2 = 33, computes her commitment

and sends it to V . V replies with his challenge e = 12. P solves the congruences:

which is the same as the commitment. V accepts.

454 13 IDENTIFICATION

13.6.3 Signatures from Identi cation Schemes

Identi cation schemes can be converted into signature schemes [182]. To convert an identi cation scheme, it is enough to replace the veri er by a hash function. The hash function takes two arguments: a message to be signed and a commitment and produces a digest (challenge) that is later signed. Consider the Schnorr identi cation scheme [453]. The signature scheme based on it is presented below.

Schnorr signature scheme

Initialization: The TA sets up the scheme and

1.chooses the parameters as in the Schnorr identi cation scheme so the

modulus p is prime (p 2512), a prime q is a divisor of (p 1) (q 2140), and an integer 2 Zp is a generator of a group of order q,

2.picks up a hash function h : Zp Z ! f0;1; : : : ; 2t 1g,

3.applies its secret key to issue certi cates while the corresponding public key is used to verify them,

4.publishes p; q; ; h and its public key.

The following steps are undertaken by the signer S to get the certi cate from T A.

1.S selects at random her private key s 2R Zq and computes her public key K s mod p.

2.S registers her public key K with T A so T A publishes a certi cate (signature) for (IDS; K).

Signing: To sign a message m, S selects a random integer r 2R Zq, computes u r mod p, and calculates the digest b = h(u; m) for the message m 2 Z. The signature is the pair SGs(m) = (b; y) where

~

Veri cation: The veri er V takes the message m~ , its signature (b; y~) and collects the authentic public key K from T A (together with the necessary public elements). V next reconstructs

~

u~ y~Kb mod p and checks whether

~ ?

b h(~u; m~ )

If the check holds, V accepts the signature, otherwise rejects.

Pointcheval and Stern proved [411] that if an existential forgery of the Schnorr scheme is possible then DL in subgroups can be solved. This statement is true in the random oracle model.

Similarly, the Okamoto identi cation scheme can be converted for signing [389].

Okamoto signature scheme

Initialization: T A sets up the scheme and of the scheme. In particular, T A

1.chooses the parameters as in the Okamoto identi cation scheme. In particular, the modulus p is prime (p 2512), a prime q divides (p 1)

2140), and 1 and 2 are two integers of order q in the group Zp ,

2.selects a hash function h : Zp Z ! f0;1; : : : ; 2t 1g,

3.uses its secret key to issue certi cates while its public key is used to verify them,

4.publishes p; q; 1; 2; h and its public key.

The following steps are undertaken by the signer S to get the certi cate from T A.

1.S selects at random her private key (s1; s2) 2R Zq Zq and computes her public key K 1 s1 2 s2 mod p.

2.S registers her public key K with T A so T A publishes a certi cate

(signature) for (IDP ; K).

Signing: To sign a message m 2 Z, S picks up two random integers r1; r2 2R Zq , computes u 1r1 2r2 mod p, nds out

e = h(u; m)

and solves two congruences

The signature for message m is (e; y1; y2).

Veri cation: Victor is given a message m~ and a signature (~e; y~1; y~2). V collects public elements from T A, calculates

u~ 1y~1 2y~2 Ke~ (mod p) and checks whether

456 13 IDENTIFICATION

?

e~ h(~u;m~ ):

If the check holds, V accepts the signature, otherwise rejects.

Okamoto proved that the above scheme is secure against any adaptive chosen message attacks if the discrete logarithm problem is intractable and h is a correlation free one way hash function. The existence of correlation free hash functions is a stronger requirement than the existence of collision free hash functions (for details consult [389]).

13.7 Problems and Exercises

1.Consider the following identi cation protocol. Peggy gives her name to Victor. Victor tosses an unbiased coin. If the coin comes up heads, Victor accepts Peggy, otherwise he rejects. Compute the false rejection/acceptance rates. Is the protocol practical?

2.Victor has bought two personal identi cation machines. One machine uses ngerprints for identi cation and is characterized by the false rejection and acceptance rates Pfa1 and Pfr1, respectively. The second machine applies face image to identify a person. Its false rejection and acceptance rates are Pfa2 and Pfr2, respectively. Victor is not sure how to combine the machines. But he thinks about the two following schemes:

a)In the rst scheme, a person is accepted only if the person is accepted by both identi cation machines.

b)In the second scheme, a person is accepted if at least one machine has accepted the

person.

Compute the false rejection/acceptance rates for both schemes (make reasonable probabilistic assumptions if necessary).

3.Assume an identi cation scheme based on PINs of the length of 4 digits. What is the probability of guessing the PIN if the attacker is allowed to enter three consecutive guesses?

4.Suppose that passwords have the length of 10 characters. Characters are chosen randomly from a given set of elements. Consider that the set of possible elements consists of

a)all lower case letters (i.e. a; b; c; : : : ; z),

b)all letters (i.e. both lower and upper case letters),

c)all alphanumerical characters (i.e. all letters plus all digits),

d)all characters accessible on a typical keyboard (i.e. the set has 96 lower/upper case letters, digits, and special characters).

What is the probability of guessing a password in a single attempt for each the cases mentioned above? What is the time necessary to exhaustively search the whole password space for the above cases if it is possible to check 1000 passwords per second.

5.Let passwords be of length of 7 characters. The password space contains 267 possible elements. Assume that an attacker can access a hashed password le and can run a program that tests 1000 passwords per second. What would be the lifetime of a password

selected at random from the password space provided the owner will change the password if the probability of breaking it by the attacker becomes equal to 10 3 (attacker continuously runs his program starting from the last change of password).

6.Modify the challenge-response protocol for a shared (secret) key in such a way that it allows to use timestamps by both interacting parties.

7.Assume that two parties A and B have collected their corresponding public keys from their T A. Design the challenge-response protocol that allows mutual authentication of both A and B. Consider two possible cases: when the public keys are used for encryption and when the public keys are used for authentication.

8.Show that the Fiat-Shamir protocol is sound and complete. Write a transcript simulator for the protocol and evaluate its eÆciency.

9.A prover P and a veri er V apply the Fiat-Shamir protocol for identi cation. They have been using it for some time. An attacker Oscar has collected a transcript of their interactions and discovered that Victor does not select his challenges with uniform probability. In fact Victor's selection of challenge is described by two probabilities P(b = 0) = " and

P (b = 1) = 1 " where " < 0:5. Oscar wants to impersonate Peggy and knows that he will be successful if he guesses Victor's challenge. To guess the challenge, Oscar may apply the two following strategies:

a)He chooses his guess according to the same probability distribution as Victor.

b)He chooses his guess to be always 1.

What are the probabilities of Oscar's successful impersonation for the two strategies? Which of the strategies is better? What would be the best possible strategy for Oscar?

10.An attacker Oscar has collected a transcript of Peggy and Victor interactions in the FiatShamir identi cation protocol. Looking through the transcript, Oscar has discovered that

there are two entries (u1; b1; v1) and (u2; b2; v2) for which u1 = u2 and b1 6= b2. What is the probability of the event? Can Oscar use the discovery to break the protocol?

11.Consider the Feige-Fiat-Shamir protocol. Prove that it is sound and complete. Design a transcript simulator for the protocol. Discuss its eÆciency and show how it depends on the size of the parameter ` (` is the length of the challenge).

12.Given the Feige-Fiat-Shamir protocol. An attacker Oscar has noticed that the veri er V chooses his rst challenge according to the protocol (randomly and uniformly from the set

f0; 1g`). But the rest t 1 challenges are \recycled" from the previous ones. A recycled challenge in the i-th iteration, is created as follows. Let a challenge in the (i 1)-th iteration be bi 1 = (a1; : : : ; a`), then a recycled challenge is bi = (a2; : : : ; a`; a`+1) where the bit a`+1 is randomly chosen with the uniform probability. What is the probability of false acceptance in the protocol with the recycled challenges.

13.Convert both the FFS and GQ identi cation protocols into corresponding signature schemes. Discuss their security.

14.Modify the Schnorr identi cation scheme for the case when the arithmetics is performed

in GF (2521) and q = 2521 1 is a Mersenne prime. Discuss its eÆciency.

15. Consider the Schnorr identi cation scheme. Let the set of challenges be binary, i.e. b 2R f0; 1g. Show that the resulting protocol is sound and complete. Design a transcript simulator for it and discuss its eÆciency.

458 13 IDENTIFICATION

16.In the Okamoto scheme, Peggy selected s1 at random and assigned s2 = s1. Discuss the repercussions of her choice of parameters on the scheme. Is the scheme still secure if an attacker knows that s1 = s2?

17. Consider the Okamoto scheme again. Assume that the trusted authority T A displayed the public parameters with two generators 1 = 2. Is the scheme secure? Justify your answer.

14 INTRUSION DETECTION

14.1 Introduction

Distributed systems emerged as a consequence of rapid progress in both computing and communication technology. A distributed system combines all computing resources into one \super" computer in which the underlying network provides the necessary communication facilities. The main advantage and, ironically, the major problem of distributed systems is its openness. The openness of the system permits sharing of all resources among users independently of their locations. At the same time, a distributed system is much more vulnerable to a potential attacker due to a distributed nature of the system. The communication network is typically too large to even attempt to protect it via some physical means. Widely used cryptographic methods may either detect illegal activity or render the transmitted data nonintelligent to an attacker. Some channels due to their characteristics may be subject to some speci c attacks. For example, all broadcasting channels used for mobile and satellite communication are inherently vulnerable to eavesdropping. An attacker may be aware of some weaknesses in the security guards and choose them to compromise a part or the whole system. In general, the designers of the security guards try to prevent any illegal user to access the system. Numerous examples showed that even the best protection mechanism may fail because: there is a aw in the design, or more often because the mechanism was not designed to withstand some \exotic", yet, practical attacks. So if the security guards fail, should we succumb and do nothing?

The absolutely last line of defence is an intrusion detection system (IDS). The system assumes that an attacker has outsmarted the security guards and gained an (unauthorized) access. It tries to identify attackers by scanning the behavior of active users. This is possible if an intrusion exhibits distinctive characteristics from these typical for a nonintrusive activity. A nonintrusive

460 14 INTRUSION DETECTION

activity is characterized by users' behavior pro les. A crucial component of any IDS is a database in which these pro les are stored. Auditing that primarily provides information about how and by whom di erent computing resources are being used, also can be used to establish user behavior pro les. Pro les should be continually updated to re ect the current behavior of users. The IDS is in fact an identi cation system and as such can be characterized by probabilities of false acceptance and false rejection. False acceptance results that the IDS allows an intruder to continue their activity. While false rejection typically causes that the IDS stops an activity of a legitimate user.

Attackers are classi ed into three broad categories:

1.clandestine { attackers who avoid the IDS or auditing system,

2.masqueraders { attackers who impersonate legitimate users,

3.misfeasors { legitimate users who abuse their privileges.

Note that misfeasors are just authorized users who are trying to circumvent the access control mechanism. Masqueraders are intruders who somehow manage to convince the identi cation mechanism that they are legitimate users. A typical example of a masquerader is an attacker who has guessed somebody's password. Clandestine are attackers who are usually trying to unmobilize the IDS (and consequently the audit system) so they can act with no trace of their activity in the audit trail.

The IDS works on the presumption that it is possible to identify an abnormal behavior of a user. A behavior observed by the IDS can be abnormal for a user although it may not be harmful and may be typical for somebody else. An abnormal behavior indicates that the user may be a masquerader. In contrast, the IDS may detect a user behavior that violates the rules of the game (the security policy). In this case, the IDS does not need to use the behavior pro le to detect the intrusion { the decision is made on the basis of the de nition of misuse of computer resources. So there are two possible intrusion detection strategies:

{anomaly detection when the observed behavior deviates from the expected one for the user,

{misuse detection when the observed behavior indicates an intention to abuse the computer resources.

Anomaly intrusion detection requires the IDS to keep information about typical behavior pro les for each legitimate user. For instance, if a user always