Cryptography and the Internet (2012 San Diego)

Overview  Background  Next Generation Encryption ‒ Suite B, FIPS-140-2011  Issues ‒ Crypto Globalization ‒ Quantum Computers ‒ Quantum Cryptography ‒ Post-Quantum Cryptography  RecommendationsBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 3

Background

How to detect attacks? Malware  Broken encryption ‒ Host Process Monitoring ‒ Network Monitoring ‒ Tripwire ‒ Antivirus ‒ Antimalware ‒ Product Security BulletinsBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 6

Protecting a Packet VIHL TOS Length ID F Offset IP TTL Proto Checksum Source IP Address Destination IP Address IP Options Padding Source Port Dest Port UDP UDP Length UDP Chksm V X PT Seq Num SSRC Timestamp CSRC SRTP Data Authentication TagBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 21

Encryption VIHL TOS Length ID F Offset IP TTL Proto Checksum Source IP Address Destination IP Address IP Options Padding Source Port Dest Port UDP UDP Length UDP Chksm V X PT Seq Num SSRC Timestamp CSRC SRTP Data Authentication TagBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 22

Authentication VIHL TOS Length ID F Offset IP TTL Proto Checksum Source IP Address Destination IP Address IP Options Padding Source Port Dest Port UDP UDP Length UDP Chksm V X PT Seq Num SSRC Timestamp CSRC SRTP Data Authentication TagBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 23

Authenticated Encryption with Associated Data (AEAD)  Tight binding prevents subtle attacks  BEAST, Padding Oracle, …  RFC 5116, An Interface and Algorithms for Authenticated Encryption  Standards TLS 1.2 (RFCs 5288, 5289), IKE (RFC 5282), SSH (RFC 5647), SRTP, JSON Compatible with ESP (RFC 4106) and 802.1AE draft-mcgrew-aead-aes-cbc-hmac-sha2-00BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 25

Hash Function Attacks  Collision resistance ‒ Failures: MD4, MD5, SHA-0, SHA-1  Second preimage resistance (digital signatures) ‒ Failure: MD4  HMAC Message Authentication Code ‒ Failures: MD4, SHA-0BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 32

Security at Different Layers

Certificates and Passwords

Dictionary Attack abluent Data ablush Format ablution Match ablutionary ? abluvion ably abhmo Abnaki abnegate abnegator Encrypted DataBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 52

Dictionary Attack ablush Data ablution Format ablutionary Match abluvion ? ably abhmo Abnaki abnegate abnegator Encrypted DataBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 53

Dictionary Attack ablution Data ablutionary Format abluvion Match ably ? abhmo Abnaki abnegate abnegator Encrypted DataBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 54

Time-Memory Tradeoff  Cain and Abel ‒ Krb5, NTLM, NTLMv2, OSPF, RIPv2, VRRP, VNC, IKE PSK Great Cipher, But Where Did You Get That Key?BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 57

Cryptographic Strength

FIPS-140

Advanced Encryption Standard  Standards Process ‒ Three Years, Four Workshops ‒ 15 Candidates from around the world (Belgium Won) ‒ Most analyzed cryptoalgorithm ever  Theoretical Attacks ‒ Related-key model AES-256, AES-192 ‒ Biclique cryptanalysis Chosen ciphertext attack that shaves two bits off of 128-bit keyBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 77

Suite B

Suite B  Upgrades the entire Crypto Suite  Efficient at high security levels and high speeds  USG recommended crypto algorithms ‒ Subset of FIPS-140 ‒ Selected by US National Security Agency (NSA)  Introduced into many standards ‒ RFC4869 “Suite B Cryptographic Suites for IPsec”  Approved for SECRET and TOP SECRETBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 80

Suite B – AES Galois/Counter Mode

Galois/Counter Mode (GCM)  Block cipher mode of operation for Authenticated Encryption with Associated Data (AEAD)  High speed, low latency, low cost Most efficient mode for packet networks  Widely adopted in the industry Layer 3+: IPSec, TLS, DLTS, SSH, SRTP Layer 2: 802.1AE MACSec, Gigabeam, 802.11 Storage encryption: 1619.1, LTO-4 Inside commercial crypto silicon NIST SP 800-38D Cisco Nexus 7000 Series 32-Port 10Gb Ethernet Module with 80 Gb bandwidth to the fabricBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 84

AES Counter Mode Pipeline 0000001 0000002 0000003 0000004 Round 1 Round 1 Round 1 Round 1 Round 2 Round 2 Round 2 Round 2 Round 3 Round 3 Round 3 Round 3 Round 4 Round 4 Round 4 Round 4 Round 5 Round 5 Round 5 Round 5 Round 6 Round 6 Round 6 Round 6 Round 7 Round 7 Round 7 Round 7 Round 8 Round 8 Round 8 Round 8 Round 9 Round 9 Round 9 Round 9 Round 10 Round 10 Round 10 Round 10BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 85

AES Counter Mode Pipeline 0000011 0000012 0000013 0000014 Round 1 Round 1 Round 1 Round 1 Round 2 Round 2 Round 2 Round 2 Round 3 Round 3 Round 3 Round 3 Round 4 Round 4 Round 4 Round 4 Round 5 Round 5 Round 5 Round 5 Round 6 Round 6 Round 6 Round 6 Round 7 Round 7 Round 7 Round 7 Round 8 Round 8 Round 8 Round 8 Round 9 Round 9 Round 9 Round 9 Round 10 Round 10 Round 10 Round 10 P0 P1 P2 P3 C0 C1 C2 C3BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 86

Cipher Block Chaining (CBC) P0 P1 P2 Round 1 Round 1 Round 1 Round 2 Round 2 Round 2 Round 3 Round 3 Round 3 Round 4 Round 4 Round 4 Round 5 Round 5 Round 5 Round 6 Round 6 Round 6 Round 7 Round 7 Round 7 Round 8 Round 8 Round 8 Round 9 Round 9 Round 9 Round 10 Round 10 Round 10 C0 C1 C2BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 88

Cipher Block Chaining (CBC) P0 P1 P2 Round 1 Round 1 Round 1 Round 2 Round 2 Round 2 Round 3 Round 3 Round 3 Round 4 Round 4 Round 4 Round 5 Round 5 Round 5 Round 6 Round 6 Round 6 Round 7 Round 7 Round 7 Round 8 Round 8 Round 8 Round 9 Round 9 Round 9 Round 10 Round 10 Round 10 C0 C1 C2BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 89

Suite B – Elliptic Curve Cryptography

Elliptic Curve Cryptography  Alternative crypto mathematics ‒ Invented in 1985 ‒ Used and endorsed by NSA ‒ Adopted in some niches (e.g. Smart Grid)  More efficient than RSA at higher security levels ‒ Current commercial security (96 or 112 bits) - ECC slower ‒ 128 bits strength – ECC operations faster ‒ 256 bits strength – ECC much fasterBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 91

ECC History  Many ECC patents ‒ Slow adoption  RFC 6090 Fundamental Algorithms of ECC ‒ Subset of basic ECC that predates patents ‒ Simplifies IPR analysis  Closely based on pre-1994 references ‒ Security: survived > 18 years of reviewBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 93

Timeline Meta Homogeneous ElGamal EC ElGamal Coordinates Signatures [K1987] [KMOV1991] [HMP1994] … 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 … ECC invented ECC Abbreviated ECDH Implementation EC ElGamal [M1985] [BC1989] Signatures [KT1994] EC ElGamal Signatures [A1992]BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 94

Cisco Next Generation Encryption Future Ready ‒ Meets security and scalability requirements of next two decades Communications and IT infrastructures must be defended against attack and exploitation ‒ Attackers are persistent and well-funded ‒ Computing advances driving a move to higher cryptographic strengthsBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 95

Next Generation Encryption Authenticated AES-128-GCM Encryption Authentication HMAC-SHA-256 Key Establishment ECDH-P256 Suite B Digital Signatures ECDSA-P256 Hashing SHA-256 Entropy SP800-90 Protocols TLSv1.2, IKEv2, …BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 96

Security Problems Solved by NGE 3DES 1GB limit HMAC-MD5 HMAC-SHA-256 DH, RSA 1024-bit at risk Suite B RSA, DSA 1024-bit at risk MD5, SHA-1 Collision attacks Entropy Inconsistent quality TLS1.0, IKEv1 Flaws, lack of AEBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 97

Trends and Issues

Quantum Computers  Could break RSA-2048, DH-2048 by factoring 2048- bit integers  Could break AES-128 in time 264, AES-256 in 2128  May prove impossible ‒ Active area of researchBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 101

Quantum Computers  Could break RSA-2048, DH-2048 by factoring 2048- bit integers  Could break AES-128 in time 264, AES-256 in 2128  May prove impossible ‒ Active area of research ‒Quantum Factoring Record: 15 = 3 x 5BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 102

Quantum Cryptography  Point-to-point encryption over optical fiber  Quantum mechanics eavesdropping detectable Random Random Source Source X X 0,1 0,1 + + Bit Selection Bit Selection & Privacy & Privacy Amplification Amplification key courier Shared Secret Shared SecretBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 103

Quantum Cryptography Limitations  Relies on initial pre-shared secret  Compares unfavorably to other cryptosystems ‒ Less assurance, less flexibility, higher cost ‒ Laughable data rates (< 1 kbit/sec) ‒ Quantum PHY attacks are serious threat  QC is point-to-point and requires dedicated PHY ‒ QC cannot cross routing or switching  QC has little value to most networksBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 104

How Many Do We Need?  Single Alternate Cipher ‒ Provide fallback against cryptanalytic progress on AES  Algorithm Diversity ‒ Different technical lineage than AES ‒ Focus on 192, 256-bit key strength ‒ Stronger key schedule  A single alternative could be chosen as SHOULD implement cipher ‒ Extensive Public Review ‒ Open standards processes Background: draft-irtf-cfrg-cipher-catalog-00BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 110

Recommendations

Recommendations Now Soon AES-128-GCM, AES-128-GCM, AES-128-CCM AES-128-CCM HMAC-SHA-256 HMAC-SHA-256 DH-2048, ECDH-P256 RSA-2048 RSA-2048 ECDSA-P256 SHA-256 SHA-256BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 114

Other Recommendations  Use Certificates ‒ Manually installed or authenticated good for transition ‒ Audit how your organization uses uncertified public keys  Do not use password based keys ‒ Generate with tool if need beBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 115

Other Recommendations  Use Certificates ‒ Manually installed or authenticated good for transition ‒ Audit how your organization uses uncertified public keys  Do not use password based keys ‒ Generate with tool if need be  Use Authenticated EncryptionBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 116

Complete Your OnlineSession Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Receive 20 Passport points for each session evaluation you complete. Complete your session evaluation online now (open a browser through our wireless network to access our Don‟t forget to activate your portal) or visit one of the Internet Cisco Live Virtual account for access to stations throughout the Convention all session material, communities, and on-demand and live activities throughout Center. the year. Activate your account at the Cisco booth in the World of Solutions or visit www.ciscolive.com.BRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 119

Final Thoughts Get hands-on experience with the Walk-in Labs located in World of Solutions, booth 1042 Come see demos of many key solutions and products in the main Cisco booth 2924 Visit www.ciscoLive365.com after the event for updated PDFs, on- demand session videos, networking, and more! Follow Cisco Live! using social media: ‒ Facebook: https://www.facebook.com/ciscoliveus ‒ Twitter: https://twitter.com/#!/CiscoLive ‒ LinkedIn Group: http://linkd.in/CiscoLIBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 120

Contact me: [email protected]

Backup

Export  The EU “License-Free Zone“ is the group of countries to which Cisco can export all goods, including strong encryption (restricted) items. This includes government or military end-users that if outside the “zone” would require a license.  Any government or military end customer outside the EU License free zone and US embargoed countries will require a US export license. Written Assurance required for other end customers in Export Restricted zone  Prohibited Zone - No product can be shipped to U.S.-embargoed countriesBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 125

Attacks  Attacks on IPsec ‒ Padding  Attacks on TLS ‒ Bleichenbacher chosen ciphertext attack ‒ Renegotiation attack  Side channels ‒ Timing attacksBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 126

Why is Crypto Hard?  Breaks „liberal in what you accept‟ ‒ Encapsulation, ordering, additions  Breaks Metcalf‟s law ‒ Can‟t assume that any two devices can talkBRKSEC-3009 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 127

Cryptography and the Internet (2012 San Diego)

by Cisco Security on Jun 19, 2012

Statistics

Views

Actions

0 Embeds 0

Accessibility

Categories

Upload Details

Usage Rights

Report content

Cryptography and the Internet (2012 San Diego) Presentation Transcript