two major areas where wireless networks do not provide the same level of protection as wired ones. • Typical mobile network authentication approach: » Mobile Node (MN) roams to a network managed by a Foreign Agent (FA). » MN performs authentication with the FA, under the assistance of his Home Agent (HA). » After successful authentication, FA and HA share a symmetric key (session key). 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 4
protocol based on the smart card. • In 2006, Lee and Hwang, pointed out it is subject to the forgery attack, and proposed a slightly modified version. • Now, Xu et al. show that they are vulnerable to the insider attack, and propose a new protocol. » Above weaknesses are eliminated, while the efficiency is not sacrificed. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 5
entity X Certificate of an entity X Identity of an entity X ℎ ∙ An appropriate one-way hash function ‖ String concatenation ⊕ The XOR operation · Symmetric encryption of a message using key K −1 · Symmetric decryption of a message using key K · Asymmetric encryption of a message using X’s public key · Asymmetric decryption of a message using X’s private key ℎ · Signature of a message using X’s private key 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 6
security enhancement on Zhu and Ma’s protocol. • Lee et al.’s protocol consists of three phases: » Phase 1, the HA securely issues a password and a smart card to MN. » Phase 2, mutual authentication between MN and FA, is performed under the assistance of HA. » Phase 3, MN renews his session key with FA. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 8
identity to HA • HA has already had a large random number , which plays as the secret key. » HA computes ≜ ℎ ∥ and ≜ ℎ ∥ ⊕ ⊕ ⊕ » HA issues MN’s password and a smart card, which contains , , ℎ · 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 9
issues a temporary certificate to MN. • In Lee and Hwang’s scheme, this phase is completed by five steps. • Step 1 (MN): » User inputs his and to his smart card, which computes ≜ ⊕ and ≜ ℎ ⊕ , then does an encryption 1 ≜ ℎ ∥ 0 ∥ . Here 0 and are secret random numbers. » MN sends to FA a Msg-1: , , 1 , . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 10
1 , , and checks if is valid. » FA generates a secret random number , and computes a signature 1 ≜ ℎ , , 1 , , . » FA sends to HA a Msg-2: , , 1 , , 1 , , . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 11
1 , , 1 , , , and checks if and are both valid. » HA computes = ℎ ∥ ⊕ ⊕ , and = ℎ ⊕ ℎ ∥ , then does a decryption ℎ ∥ 0 ∥ = −1 1 . » Hashes the afore-computed , compares this ℎ to the one recovered from 1 . If matches, HA believes MN is authenticated. » HA does an encryption 2 ≜ ℎ ∥ ∥ 0 ∥ , and computes a signature 2 ≜ ℎ , , 2 , » HA sends FA a Msg-3: , 2 , 2 , , . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 12
, 2 , , , and checks if and are both valid. » FA does a decryption ℎ ∥ ∥ 0 ∥ = 2 , then computes session key ≜ ℎ ∥ ⊕ 0 , and does an encryption 3 ≜ ∥ ℎ 0 ∥ . » FA sends 3 to MN. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 13
MN computes the session key = ℎ ∥ ⊕ 0 , then does a decryption ∥ ℎ 0 ∥ = −1 3 . » MN computes ℎ 0 ∥ , and compares it to the on recovered by decrypting 3 . If matches, MN believes FA is authenticated. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 14
Periodically, MN updates the session key, from to a future +1 . » MN randomly chooses , and sends to FA both and ∥ . » FA checks if the received is valid. » FA does a decryption ∥ = −1 ∥ , and check if the this matches the received one. » Both MN and FA computes the new session key, which would be +1 ≜ ℎ ∥ ⊕ . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 15
scheme still have several serious deficiencies: 1. Lack of user anonymity (suffers insider attack). 2. Unfair key agreement. 3. Inapplicable security design. • The original scheme by Zhu and Ma is also affected similarly. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 17
so that the user’s real identity can only by recognized by his home agent (HA). • Consider a legitimate but malicious user MNα registered with the HA, which is also the home agent of many other mobile users, like an innocent MNi . • Disclosure of MNi ’s identity , may allow tracking of MNi ’s behavior, such as the moving history and current position. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 18
FA. » MNα eavesdrops the Msg-1 sent by MNi over the air, where ≜ ⊕ = ℎ ∥ ⊕ ⊕ . » MNα holds ≜ ⊕ = ℎ ∥ ⊕ ⊕ . » MNα reveals by = ⊕ ⊕ . • Essentially, MNα can reveal the identity of any other MN registered with the same HA. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 19
that the agreed key contains some contribution from each participant, so that nobody has an unfair advantage in controlling the session key. • MN can always choose 0 ∗ ≜ ℎ ∥ ⊕ ∗, where ∗ is the designated key by MN alone. • The shared session key computed by FA, according to ≜ ℎ ∥ ⊕ 0 , is always MN’s pre-determined ∗. • The key renewal is not a fair protocol, either. As +1 ≜ ℎ ∥ ⊕ , MN can deliberately choose , such that +1 is still exactly in his preference. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 22
design, a MN cannot freely choose his own password, or change it for any sake of security: » Typically, ℎ • is instantiated with the 160-bit SHA-1. • In phase 1, ≜ ℎ ∥ , a user has to bear in mind such a 160-bit password » As ≜ ℎ ∥ , HA cannot update , unless the server key is updated. • However, updating will immediately affect all users. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 25
that there is a static binding between and in Msg-1. • Also employs a user password, and a smart card. • Xu et al.’s design also has three phases involved: » Phase 1, MN freely choose his password, and HA issues a smart card, based on Diffie-Hellman. » Phase 2, mutual authentication between MN and FA, is performed under the assistance of HA. » Phase 3, MN renews his session key with FA. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 27
of order , where = 2 + 1. Both and are both large primer numbers. • HA, chooses the public parameters (thus ) and , and selects a private key , then computes ≜ mod. • When MN registers with his HA, he submit his freely chosen and . • HA computes ≜ ℎ ∥ with its server secret key . • HA issues a smart card, where , , , and ℎ · are stored. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 28
employ asymmetric encryptions between HA and FA. • Instead, HA pre-shares a distinct symmetric key with each FA. • This scheme has 5 steps to complete phase 2. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 29
smart card, the device chooses two secret random numbers and , and then ≜ mod, ≜ ℎ mod , ≜ ℎ ⊕ , ≜ ∥ , does a encryption ≜ ∥ . » Note that is the user’s ephemeral public key, ≜ ℎ mod is the (hashed) Diffie-Hellman key. Both keys can be pre-computed off-line. » Sends to FA a Msg-1: , , , , . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 30
, , , and checks if is valid. » FA randomly chooses , then computes ≜ ∥ ∥ ∥ ∥ . » FA sends to HA a Msg-2: , . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 31
and then does a decryption ∥ ∥ ∥ ∥ = −1 . » HA checks if the recovered is valid, then computes = ℎ mod , and ∥ = −1 . » HA checks if is valid, computes ℎ ∥ = −1 , = ℎ ⊕ , and ∥ = −1 . » HA checks if from and matches, if so, HA believes MN is legally enrolled. » HA computes ≜ ∥ and ≜ ∥ ∥ . » HA sends to FA a Msg-3: , . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 32
and do a decryption ∥ = −1 . » FA checks if recovered equals its original choice, if so, FA believes MN is an authorized user. » FA forwards to MN. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 33
a decryption ∥ ∥ = −1 . » MN checks if equals its original choice, and if is the identifier of the intended FA, if so, MN believes FA is authenticated. » Both MN and FA can compute the agreed session key by ≜ ⊕ . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 34
a concise renewal protocol does not involve exchange of any secret messages, and is particularly preferable for a wireless environment. • The MN may probably be energy constrained devices, this renewal favorably lowers the communication costs for both MN and FA. • This scheme allows MN to “hibernate”, once MN “wakes up”, it applies ℎ · on its last saved key. • It features self-healing. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 35
any message. • Α may also: 1. Obtains a user’s password 2. Steal a user’s smart card, and extract all information from it • Obviously, if a user’s password and smart card are both stolen, there is not way to prevent the attacker. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 37
in ≜ ℎ ∥ . As only HA knows the secret key , even if MN’s is revealed by an attacker α, from a stolen smart card, α still cannot decrypt . 2. is also hidden in ≜ ∥ . Even if α can obtain the , he still cannot acquire the decryption key ≜ ℎ ⊕ , because Diffie-Hellman problem prevents α from inferring ≜ ℎ mod from ≜ mod. (This happens when α is an insider MNα ). 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 38
session key containing equal contributions from both parties. • Consider HA wants to pre-determine : 1. MN randomly chooses his contribution , embeds it in , and sends a Msg-1 to FA. 2. FA receives Msg-1, and chooses his , and sends a Msg-2 to HA. 3. HA receives Msg-1, and recovers from , and sends a Msg-3 to FA. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 40
is that HA already reveals for FA. i. FA receives Msg-3, and obtains . Instead of forwarding to MN, the tricky FA chooses another ∗ = ⊕ ∗. Then FA sends a Msg-2 to HA, the genuine is discarded. ii. HA receives Msg-2, and innocently sends to FA a Msg-3’, where ∗ instead of is embedded. 4. FA receives Msg-3’, and obtains as in Msg-3, and forward ′ to HA, who is blind to the trick. 5. On receiving ′, both MN and FA “agree” on ∗ = ∗ ⊕ , which is determined by FA alone. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 41
of the protocol requires that , sent from MN, should also be forwarded to HA (embedded in ). » HA can check both and to determine whether the received Msg-2 is fresh one. » One may argue that, since FA may manipulate before generating for HA, FA can also alter before embedding it into . » Recall that, when MN generates , he also embeds in it, so that only HA can recover with the Diffie-Hellman key . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 42
When MN wants to update his password from to ′, he presents at the registry his smart card, which computes and submits ℎ ′ to HA. • After validating MN is legally enrolled, HA replaces the original in MN’s smart card with ′ = ℎ ′ ∥ . 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 44
and . Since ≜ ∥ , α cannot forge it without . On the other hand, ≜ ∥ is protected by ≜ ℎ ⊕ , α cannot forge without . • That is, α is blind to either or . 2. α cannot impersonate HA, due to in Msg-3, is protected by , and verified with ; is protected by and verified with . • Thus, Msg-3 is immune to replay attacks. 01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU 45
danchen
ankh2054
shimacos
chck
shibuiwilliam
.png){kind=avatar}
satai
yukinobaba
mela_dayo
puwaer
matsumooon
trafficbrain
shunk031
hopin
kristinabergwall1
livdayseo
pedronauck
jlugia
cassininazir
reverentgeek
marktimemedia
lemiorhan
lauravandoore
portentint
samtorres
![01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU](https://files.speakerdeck.com/presentations/4fa1e8c8843f27002102a5ba/slide_2.jpg){kind=link}
![01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU](https://files.speakerdeck.com/presentations/4fa1e8c8843f27002102a5ba/slide_6.jpg){kind=link}
![01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU](https://files.speakerdeck.com/presentations/4fa1e8c8843f27002102a5ba/slide_25.jpg){kind=link}
![01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU](https://files.speakerdeck.com/presentations/4fa1e8c8843f27002102a5ba/slide_45.jpg){kind=link}
![01/07/2011 S.-C. Chen, S.-H. Yang, T.-C. Li [at] CSIE, NTNU](https://files.speakerdeck.com/presentations/4fa1e8c8843f27002102a5ba/slide_46.jpg){kind=link}
