Scribd
Upload
75 views22 pages

Cryptography

This document provides a summary of the key topics covered in a course on computer and network security. The course covered cryptography, access control, authentication protocols, software security issues, and an outlook on challenges in the field. It summarizes the material presented on symmetric and public key cryptography, hashing, digital signatures, authentication methods, authorization models, protocols like SSL and Kerberos, software vulnerabilities, and predictions for ongoing issues.

Uploaded by

ga18392
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
75 views22 pages

Cryptography

This document provides a summary of the key topics covered in a course on computer and network security. The course covered cryptography, access control, authentication protocols, software security issues, and an outlook on challenges in the field. It summarizes the material presented on symmetric and public key cryptography, hashing, digital signatures, authentication methods, authorization models, protocols like SSL and Kerberos, software vulnerabilities, and predictions for ongoing issues.

Uploaded by

ga18392
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 22

Conclusion

Conclusion 1
Course Summary
 Crypto
o Basics, symmetric key, public key, hash
functions and other topics, cryptanalysis
 Access Control
o Authentication, authorization
 Protocols
o Simple authentication
o Real-World: SSL, IPSec, Kerberos, GSM
 Software
o Flaws, malware, SRE, development, OS issues

Conclusion 2
Crypto Basics
 Terminology
 Classic cipher
o Simple substitution
o Double transposition
o Codebook
o One-time pad
 Basic cryptanalysis

Conclusion 3
Symmetric Key
 Stream ciphers
o A5/1
o RC4
 Block ciphers
o DES
o AES, TEA, etc.
o Modes of operation
 Data integrity (MAC)

Conclusion 4
Public Key
 Knapsack (insecure)
 RSA
 Diffie-Hellman
 Ellipticcurve crypto (ECC)
 Digital signatures and non-repudiation
 PKI

Conclusion 5
Hashing and Other
 Birthday problem
 Tiger Hash
 HMAC
 Clever uses: online bids, spam reduction
 Other topics
o Secret sharing
o Random numbers
o Information hiding (stego, watermarking)

Conclusion 6
Advanced Cryptanalysis
 Linearand differential cryptanalysis
 RSA side channel attack
 Knapsack attack (lattice reduction)
 Hellman’s TMTO attack on DES

Conclusion 7
Authentication
 Passwords
o Verification and storage (salt, etc.)
o Cracking (math)
 Biometrics
o Fingerprint, hand geometry, iris scan, etc.
o Error rates
 Two-factor, single sign on, Web cookies

Conclusion 8
Authorization
 ACLs and capabilities
 MLS  BLP, Biba, compartments,
covert channel, inference control
 CAPTCHA
 Firewalls
 IDS

Conclusion 9
Simple Protocols
 Authentication
o Using symmetric key
o Using public key
o Establish session key
o PFS
o Timestamps
 Authentication and TCP
 Zero knowledge proof (Fiat-Shamir)

Conclusion 10
Real-World Protocols
 SSL
 IPSec
o IKE
o ESP/AH
 Kerberos
 GSM
o Security flaws

Conclusion 11
Software Flaws and Malware
 Flaws
o Buffer overflow
o Incomplete mediation, race condition, etc.
 Malware
o Brain, Morris Worm,Code Red, Slammer
o Malware detection
o Future of malware
 Other software-based attacks
o Salami, linearization, etc.

Conclusion 12
Insecurity in Software
 Software reverse engineering (SRE)
o Software protection
 Digital
rights management (DRM)
 Software development
o Open vs closed source
o Finding flaws (math)

Conclusion 13
Operating Systems
 OS security functions
o Separation
o Memory protection, access control
 Trusted OS
o MAC, DAC, trusted path, TCB, etc.
 NGSCB
o Technical issues
o Criticisms

Conclusion 14
Crystal Ball
 Cryptography
o Well-established field
o Don’t expect major changes
o But some systems will be broken
o ECC is a “growth” area
o Quantum crypto may prove worthwhile…
o …but beware of hype!

Conclusion 15
Crystal Ball
 Authentication
o Passwords will continue to be a problem
o Biometrics should become more widely used
o Smartcard/tokens will be used more
 Authorization
o ACLs, etc., well-established areas
o CAPTCHA’s interesting new topic
o IDS is a very hot topic

Conclusion 16
Crystal Ball
 Protocols are challenging
 Very difficult to get protocols right
 Protocol development often haphazard
o Kerckhoffs Principle for protocols?
o How much would it help?
 Protocols will continue to be a significant
source of security failure

Conclusion 17
Crystal Ball
 Software is a huge security problem today
o Buffer overflows should decrease
o Race condition attacks might increase
 Virus writers are getting smarter
o Polymorphic, metamorphic, what’s next?
o How to detect future malware?
 Malware will continue to plague us

Conclusion 18
Crystal Ball
 Other software issues
o Reverse engineering will not go away
o Secure development will remain hard
o Open source is not a panacea
 OS issues
o NGSCB will change things…
o …but for better or for worse?

Conclusion 19
The Bottom Line
 Security knowledge is needed today…
 …and it will be needed in the future
 Necessary to understand technical issues
o The focus of this class
 But technical knowledge is not enough
o Human nature, legal issues, business issues, etc.
o Experience also important

Conclusion 20
A True Story
 The names have been changed…
 “Bob” took my undergrad security class
 Bob then got an intern position
o At a company that does security
 At a meeting, an important customer asked
o “Why do we need signed certificates?”
o After all, they cost money!
 The silence was deafening

Conclusion 21
A True Story
 Bob’s boss remembered that Bob had taken
a security class
o So he asked Bob, the lowly intern, to answer
o Bob mentioned “man-in-the-middle” attack
 Customer wanted to hear more
o Bob explained MiM attack in some detail
 The next day, “Bob the lowly intern”
became “Bob the fulltime employee”

Conclusion 22

You might also like