网络安全课件Chapter4.pptVIP

Henric Johnson Chapter 4 Authentication Applications Outline Security Concerns Kerberos X.509 Authentication Service Recommended reading and Web Sites Security Concerns key concerns are confidentiality and timeliness to provide confidentiality must encrypt identification and session key info which requires the use of previously shared private or public keys need timeliness to prevent replay attacks provided by using sequence numbers or timestamps or challenge/response KERBEROS In Greek mythology, a many headed dog, the guardian of the entrance of Hades KERBEROS Users wish to access services on servers. Three threats exist: User pretend to be another user. User alter the network address of a workstation. User eavesdrop on exchanges and use a replay attack. KERBEROS Provides a centralized authentication server to authenticate users to servers and servers to users. Relies on conventional encryption, making no use of public-key encryption Two versions: version 4 and 5 Version 4 makes use of DES Kerberos Version 4 Terms: C = Client AS = authentication server V = server IDc = identifier of user on C IDv = identifier of V Pc = password of user on C ADc = network address of C Kv = secret encryption key shared by AS an V TS = timestamp || = concatenation A Simple Authentication Dialogue C ? AS: IDc || Pc || IDv AS ? C: Ticket C ? V: IDc || Ticket Ticket = EKv[IDc || Pc || IDv] Version 4 Authentication Dialogue Problems: Lifetime associated with the ticket-granting ticket If to short ? repeatedly asked for password If to long ? greater opportunity to replay The threat is that an opponent will steal the ticket and use it before it expires Version 4 Authentication Dialogue Authentication Service Exhange: To obtain Ticket-Granting Ticket C ? AS: IDc || IDtgs ||TS1 AS ? C: EKc [Kc,tgs|| IDtgs || TS2 || Lifetime2 || Tickettgs] Overview of Kerberos Request for Service in Another Realm Difference Between Version 4 and 5 Encryption system depen