Saturday, November 24, 2007
The Name Game

State: Dry Theos.

I'm very sad for Ooi Eu Jin's family and loved ones..
He is clearly a great brother, son, student, boyfriend, and a leader.
Learning about him through this blog created in membrance of him, I'm glad that he made a difference in so many people's life.

A role model. First class honour MAE graduate from NTU. A senior China GIPer...

To his loved ones, stay strong always. Know that he had made that difference in you and continue to keep putting in your effort and maintain it. Don't let him down. Let him always be smiling.
____ . ____

Confidentiality is achieved by encryption.
Data Integrity is achieved by Message Authentication Code (MAC).
Non-repudiation is achieved by Digital Signature.

Sniffing attack is foiled by encrypted password.
Encrypted password still a victim to Replay attack and Dictionary attack.

One-time-use-then-throw password is a victim to Preplay attack. The attacker can talk to A first, get the response, and talk to B as if it is A. B will think he is talking to A.. but B is actually talking to attacker.

Salt is a random number when put into same encrypted passwords, it will result in different outcomes. This can void Replay attack. The bigger is the salt, the higher the hacking effort needed.

Session key is a temporary key that is used only during a conversation and is disgarded after conversation ends. Why? Because this can limit the amount of cryptograms that are available for cryptanalysis. This also prevent attackers from compromising the conversation again next time. If the same session key was used again and the last conversation was compromised, then the conversation will definitely be compromised again.

Reflection attack can be foiled when the final returned nonce is different from the encrypted sent nonce.

Secure Socket Layer (SSL) cannot prevent phishing because a phished website can have a valid SSL certificate.

Here's a part where Eve complains that she is unjustly being labelled the attacker.


Needham - Schroeder Public Key Authentication Scheme needs correction because its previous scheme is susceptible to Interleaving attack. When A wants to talk to M, A sends A's nonce to M. M is targeting to get B's nonce. So M will get A's nonce and send it to B as if A wants to talk to B. Then B will reply A with B's nonce together with A's nonce encrypted by A's public key. M doesn't have A's private key, so will forward B's reply to A. A opens it thinking that the nonce is from M. To verify that A received it from M, A will send the received B's nonce to M. There you go, M successfully gotten the desired B's nonce.

The correct scheme is as follows: When A wants to talk to M, A sends A's nonce to M. M is targeting to get B's nonce. So M will get A's nonce and send it to B as if A wants to talk to B. At this point, B will reply A with B's nonce together with A's nonce AND B's identity to state that the nonce belongs to B, encrypted by A's public key. Once again, M will forward B's reply to A and A will realised that B is the one A is talking with and not M. This basically foils M's plan. This is the correct working Needham - Schroeder Public Key Authentication Scheme.

What about Needham - Schroeder Secret Key Protocol?

Its just as simple.

The corrected protocol runs this way. A will send its id to B requesting to talk to B. B will encrypt idA and B's nonce back to A using B's shared key with Trent. A will forward the encrypted reply to Trent, in addition, also A's id, B's id, and A's nonce. Trent will open B's encrypted reply, check that the nonce really belongs to B, then reply A with an encrypted A's nonce, B's id, sessionkey for A and B, and also encrypted reply to B with A's id, B's nonce, and sessionkey for B and A. A upon receiving will forward Trents encrypted reply to B. B will then reply A with a nonce encrypted with the sessionkey given. A will reply B with a different nonce encrypted also with the sessionkey given by Trent. The fact that a different nonce is used is to prevent reflection attack from happening.

Diffie-Hellman Key Exchange Protocol although was successful at first due to both A and B has their individual secret number, it is computationally infeasible for M to figure out their secret number. However, it was then discovered to be susceptible to Man-in-the-Middle attack.
Why? Because it does not perform Authentication.

M can intercept when A first exchange the mod equation with B. M can change the unknown A's secret number to M's own secret number despite not knowing it, put into the mod equation and then send to B. Similarly, M will do the same when B exchange with A. The resulting mod equation will have M's secret number and M can derive the final mod value of both A and B eventually.

To twist M's plan, Diffie-Hellman Key Exchange Protocol got corrected by tagging a simple password in it. Both the password used by A and B will be the same.

When A exchanges with B the mod equation and vice versa, it will use the password to encrypt first then send. When M tries to perform Man-in-the-Middle attack again this time, it will end up getting guessed password attempts with its own secret number in it... upon decryption, it will lead to a' and b' for both A and B secret number, instead of getting a and b. Hence M won't be able to attack this time.

What is padding?
Padding is basically tagging null or garbled values to the ending block of a message before encryption so as to ensure all the message blocks are of the same length.

Why is padding required?
The length of the plaintext block and ciphertext block will be the same. Hence if the ending block is not padded, the attacker can easily find a matching ciphertext block with its corresponding plaintext block.

The reason why passwords are used for authentication.. instead of some secret-key or public key cryptography...


This ain't rocket science.
____ . ____

Before I start driving out on roads.. here's what I'll do first:
1. Get the yellow probation triangles.
2. Learn how to park on normal carpark lots... During the test we got poles to guide us.
3. Learn how to drive up a multi-storey carpark.
4. Learn the routes, expressways.

*****

Okay! Later gotta lead GEL worship, bible study, then back to palace! Got my 3 songs ready... Just got to rush to church on time to hit on my c-60. Hope I won't doze off on the snail train!