Key Management Notes

OverviewSearch on YouTubeBookmarkSaved

Two aspectsSearch on YouTubeBookmarkSaved

The notes give two distinct aspects of the use of public-key encryption for key management:

Four schemesSearch on YouTubeBookmarkSaved

Virtually all proposals for the distribution of public keys fit into four general schemes:

Distribution of public keysSearch on YouTubeBookmarkSaved

Public announcementSearch on YouTubeBookmarkSaved

The public key is public. Thus, with a broadly accepted algorithm such as RSA, any participant can send its public key to another participant. It can also broadcast the key to the community at large (Figure 1, "Uncontrolled Public Key").

The approach is convenient, but it has a major weakness. Anyone can forge such a public announcement.

Publicly available directorySearch on YouTubeBookmarkSaved

A publicly available, dynamic directory of public keys gives more security. A trusted entity or organisation must maintain and distribute the directory (Figure 2). The scheme has these elements:

• The authority keeps a directory with a $\{name, public\ key\}$ entry for each participant.
• Each participant registers a public key with the directory authority. The registration is in person or by secure authenticated communication.
• A participant can replace its key with a new key at any time. One reason is that the key was used for a large amount of data. Another reason is that the private key was compromised.
• Periodically, the authority publishes the full directory or updates to it. For example, it can publish a hard-copy book like a telephone book, or list updates in a newspaper.
• Participants can also access the directory electronically. This needs secure, authenticated communication from the authority to the participant.

This scheme is more secure than individual announcements, but it still has vulnerabilities:

• An opponent can get or compute the private key of the directory authority. Then the opponent can give out counterfeit public keys, impersonate any participant and eavesdrop on messages to any participant.
• An opponent can also tamper with the records that the authority keeps.

Public-key authoritySearch on YouTubeBookmarkSaved

A public-key authority gives stronger security with tighter control over the distribution of public keys from the directory.

• A central authority keeps a dynamic directory of the public keys of all participants.
• Each participant reliably knows a public key of the authority. Only the authority knows the matching private key.

Public-key certificatesSearch on YouTubeBookmarkSaved

With certificates, participants exchange keys without contact with a public-key authority.

• A certificate authority creates each certificate. The certificate contains a public key and other information.
• The CA gives the certificate to the participant that has the matching private key.
• A participant sends its key information to another participant in its certificate.
• Other participants can verify that the authority created the certificate.

The scheme has four requirements:

1. Any participant can read a certificate to find the name and public key of the owner.
2. Any participant can verify that the certificate comes from the CA and is not counterfeit.
3. Only the CA can create and update certificates.
4. Any participant can verify the currency of the certificate.

X.509 authentication serviceSearch on YouTubeBookmarkSaved

Purpose and historySearch on YouTubeBookmarkSaved

• The ITU-T recommendation X.509 is part of the X.500 series of recommendations. X.500 defines a directory service.
• X.509 defines a framework for authentication services by the X.500 directory to its users.
• The directory can be a repository of public-key certificates.
• Each certificate contains the public key of a user. The private key of a trusted CA signs it.
• X.509 uses public-key cryptography and digital signatures, for example RSA and hash functions such as MD5.

User certificates from a CA have these characteristics:

• Any user with the public key of the CA can recover the certified public key of the user.
• No party other than the CA can modify the certificate. Thus certificates can be kept in the directory without special protection.

Certificate fieldsSearch on YouTubeBookmarkSaved

Figure 3 shows the X.509 certificate format:

Distribution of secret keysSearch on YouTubeBookmarkSaved

Why use public keysSearch on YouTubeBookmarkSaved

After public keys are distributed, secure communication against eavesdropping and tampering is possible. But few users want to use only public-key encryption, because its data rates are relatively slow. Thus, public-key encryption is a vehicle to distribute secret keys for conventional encryption.

Merkle's simple schemeSearch on YouTubeBookmarkSaved

Ralph Merkle put forward an extremely simple scheme (Figure 4). If $A$ wants to communicate with $B$:

1. $A$ generates a key pair $\{KU_A, KR_A\}$. $A$ sends $KU_A$ and its identifier $ID_A$ to $B$.
2. $B$ generates a secret key $K_s$ and sends it to $A$, encrypted with $KU_A$.
3. $A$ computes $D_{KR_A}[E_{KU_A}[K_s]]$ to recover $K_s$. Only $A$ can decrypt the message, so only $A$ and $B$ know $K_s$.
4. $A$ discards $KU_A$ and $KR_A$. $B$ discards $KU_A$.

$A$ and $B$ then communicate securely with $K_s$. At the end of the exchange, both discard $K_s$.

Active attackSearch on YouTubeBookmarkSaved

The protocol is vulnerable to an active attack. An opponent $E$ who controls the channel can do this without detection:

1. $A$ generates $\{KU_A, KR_A\}$ and sends $KU_A$ and $ID_A$ to $B$.
2. $E$ intercepts the message. $E$ makes its own key pair $\{KU_E, KR_E\}$ and sends $KU_E \Vert ID_A$ to $B$.
3. $B$ generates $K_s$ and sends $E_{KU_E}[K_s]$.
4. $E$ intercepts the message and gets $K_s$ with $D_{KR_E}[E_{KU_E}[K_s]]$.
5. $E$ sends $E_{KU_A}[K_s]$ to $A$.

$A$ and $B$ both know $K_s$, but they do not know that $E$ also knows it. $E$ then only eavesdrops and decrypts all messages.

Confidentiality and authenticationSearch on YouTubeBookmarkSaved

The scheme in Figure 5 protects against active and passive attacks. It assumes that $A$ and $B$ already exchanged public keys with one of the four schemes.

1. $A \to B$: $E_{KU_b}[N_1 \Vert ID_A]$. The nonce $N_1$ identifies this transaction.
2. $B \to A$: $E_{KU_a}[N_1 \Vert N_2]$. Only $B$ could decrypt message 1. Thus $N_1$ in message 2 tells $A$ that the correspondent is $B$.
3. $A \to B$: $E_{KU_b}[N_2]$. This tells $B$ that the correspondent is $A$.
4. $A$ selects a secret key $K_s$ and sends $M = E_{KU_b}[E_{KR_a}[K_s]]$ to $B$.
5. $B$ computes $D_{KU_a}[D_{KR_b}[M]]$ to recover $K_s$.

Hybrid schemeSearch on YouTubeBookmarkSaved

IBM mainframes use a hybrid approach:

• A key distribution centre (KDC) shares a secret master key with each user.
• The KDC distributes secret session keys encrypted with the master key.
• A public-key scheme distributes the master keys.

The notes give this rationale for the three-level approach:

The public-key layer gives a secure, efficient means to distribute master keys. This is an advantage when one KDC serves a widely distributed set of users.

Quick self-testSearch on YouTubeBookmarkSaved

Give the four schemes for public-key distribution and one weakness of each.

Public announcement: anyone can forge it. Publicly available directory: an opponent can get the private key of the authority or tamper with its records. Public-key authority: it is a bottleneck, and its directory is vulnerable to tampering. Certificates: participants must trust the CA.

Why is a public announcement of keys not reliable?

An announcement has no proof of identity. Anyone can announce a key with the name of another participant.

Give the four requirements of a certificate scheme.

Any participant can read a certificate. Any participant can verify that it comes from the CA and is not counterfeit. Only the CA can create and update certificates. Any participant can verify the currency of the certificate.

Write the certificate of A and how a participant verifies it.

$C_A = E_{KR_{auth}}[T, ID_A, KU_A]$. A participant computes $D_{KU_{auth}}[C_A] = (T, ID_A, KU_A)$.

When must the X.509 version field be 2 or 3?

Version 2 when an issuer or subject unique identifier is present. Version 3 when one or more extensions are present.

Give the Merkle scheme and its weakness.

$A$ sends $KU_A$ and $ID_A$. $B$ returns $E_{KU_A}[K_s]$. $A$ decrypts with $KR_A$, then both discard the temporary keys. An active opponent replaces $KU_A$ with $KU_E$ and learns $K_s$ without detection.

In the scheme with confidentiality and authentication, how does A know that the correspondent is B?

Message 1 is encrypted with $KU_b$, so only $B$ can read $N_1$. When $N_1$ comes back in message 2, $A$ knows that $B$ sent it.

Why does the hybrid scheme use public-key encryption only for master keys?

Session keys change frequently, and public-key encryption has a high computational load. The master key changes only occasionally. The scheme also fits on top of an existing KDC.