Introduction to Network Security: Theory and Practice

440 Pages·2015·9.761 MB·English

by  Kissel, Zachary A., Wang, Jie

INTRODUCTION TO
NETWORK SECURITY

INTRODUCTION TO
NETWORK SECURITY
THEORY AND PRACTICE
JieWang
UniversityofMassachusettsLowell,US
ZacharyA.Kissel
MerrimackCollege,US
Thiseditionfirstpublished2015
©HigherEducationPress.Allrightsreserved.
PublishedbyJohnWiley&SonsSingaporePteLtd,1FusionopolisWalk,#07-01SolarisSouthTower,Singapore
138628,underexclusivelicensegrantedbyHigherEducationPressLimitedCompanyforallmediaandlanguages
excludingChineseandthroughouttheworldexcludingMainlandChina,andwithnon-exclusivelicensefor
electronicversionsinMainlandChina.
Registeredoffice
JohnWiley&SonsSingaporePteLtd,1FusionopolisWalk,#07-01SolarisSouthTower,Singapore138628
Fordetailsofourglobaleditorialoffices,forcustomerservicesandforinformationabouthowtoapplyfor
permissiontoreusethecopyrightmaterialinthisbookpleaseseeourwebsiteatwww.wiley.com.
TherightoftheauthortobeidentifiedastheauthorofthisworkhasbeenassertedinaccordancewiththeCopyright,
DesignsandPatentsAct1988.
Allrightsreserved.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmitted,inany
formorbyanymeans,electronic,mechanical,photocopying,recordingorotherwise,exceptaspermittedbytheUK
Copyright,DesignsandPatentsAct1988,withoutthepriorpermissionofthepublisher.
Wileyalsopublishesitsbooksinavarietyofelectronicformats.Somecontentthatappearsinprintmaynotbe
availableinelectronicbooks.
Designationsusedbycompaniestodistinguishtheirproductsareoftenclaimedastrademarks.Allbrandnamesand
productnamesusedinthisbookaretradenames,servicemarks,trademarksorregisteredtrademarksoftheir
respectiveowners.Thepublisherisnotassociatedwithanyproductorvendormentionedinthisbook.
LimitofLiability/DisclaimerofWarranty:Whilethepublisherandauthorhaveusedtheirbesteffortsinpreparing
thisbook,theymakenorepresentationsorwarrantieswithrespecttotheaccuracyorcompletenessofthecontentsof
thisbookandspecificallydisclaimanyimpliedwarrantiesofmerchantabilityorfitnessforaparticularpurpose.Itis
soldontheunderstandingthatthepublisherisnotengagedinrenderingprofessionalservicesandneitherthe
publishernortheauthorshallbeliablefordamagesarisingherefrom.Ifprofessionaladviceorotherexpert
assistanceisrequired,theservicesofacompetentprofessionalshouldbesought.
LibraryofCongressCataloging-in-PublicationData
Wang,Jie,1961-
Introductiontonetworksecurity:theoryandpractice/JieWang,DepartmentofComputerScienceattheUniversity
ofMassachusettsLowellandZacharyA.Kissel,DepartmentofComputerScienceatMerrimackCollegeinNorth
Andover,MA.–Secondedition.
pagescm
Includesbibliographicalreferencesandindex.
ISBN978-1-118-93948-2(cloth)
1. Computernetworks–Securitymeasures. I.Kissel,ZacharyA.II.Title.
TK5105.59.W3562015
005.8–dc23
2015021074
AcataloguerecordforthisbookisavailablefromtheBritishLibrary.
ISBN:9781118939482
CoverImage:Henrik5000/iStockphoto
Typesetin10/12ptTimesLTStdbySPiGlobal,Chennai,India
1 2015
Contents
Preface xv
AbouttheAuthors xix
1 NetworkSecurityOverview 1
1.1 MissionandDefinitions 1
1.2 CommonAttacksandDefenseMechanisms 3
1.2.1 Eavesdropping 3
1.2.2 Cryptanalysis 4
1.2.3 PasswordPilfering 5
1.2.4 IdentitySpoofing 13
1.2.5 Buffer-OverflowExploitations 16
1.2.6 Repudiation 18
1.2.7 Intrusion 19
1.2.8 TrafficAnalysis 19
1.2.9 DenialofServiceAttacks 20
1.2.10 MaliciousSoftware 22
1.3 AttackerProfiles 25
1.3.1 Hackers 25
1.3.2 ScriptKiddies 26
1.3.3 CyberSpies 26
1.3.4 ViciousEmployees 27
1.3.5 CyberTerrorists 27
1.3.6 HypotheticalAttackers 27
1.4 BasicSecurityModel 27
1.5 SecurityResources 29
1.5.1 CERT 29
1.5.2 SANSInstitute 29
1.5.3 MicrosoftSecurity 29
1.5.4 NTBugtraq 29
1.5.5 CommonVulnerabilitiesandExposures 30
vi Contents
1.6 ClosingRemarks 30
1.7 Exercises 30
1.7.1 Discussions 30
1.7.2 Homework 31
2 DataEncryptionAlgorithms 45
2.1 DataEncryptionAlgorithmDesignCriteria 45
2.1.1 ASCIICode 46
2.1.2 XOREncryption 46
2.1.3 CriteriaofDataEncryptions 48
2.1.4 ImplementationCriteria 50
2.2 DataEncryptionStandard 50
2.2.1 Feistel’sCipherScheme 50
2.2.2 DESSubkeys 52
2.2.3 DESSubstitutionBoxes 54
2.2.4 DESEncryption 55
2.2.5 DESDecryptionandCorrectnessProof 57
2.2.6 DESSecurityStrength 58
2.3 MultipleDES 59
2.3.1 Triple-DESwithTwoKeys 59
2.3.2 2DESand3DES/3 59
2.3.3 Meet-in-the-MiddleAttackson2DES 60
2.4 AdvancedEncryptionStandard 61
2.4.1 AESBasicStructures 61
2.4.2 AESS-Boxes 63
2.4.3 AES-128RoundKeys 65
2.4.4 AddRoundKeys 66
2.4.5 Substitute-Bytes 67
2.4.6 Shift-Rows 67
2.4.7 Mix-Columns 67
2.4.8 AES-128Encryption 68
2.4.9 AES-128DecryptionandCorrectnessProof 69
2.4.10 GaloisFields 70
2.4.11 ConstructionoftheAESS-BoxandItsInverse 73
2.4.12 AESSecurityStrength 74
2.5 StandardBlockCipherModesofOperations 74
2.5.1 Electronic-CodebookMode 75
2.5.2 Cipher-Block-ChainingMode 75
2.5.3 Cipher-FeedbackMode 75
2.5.4 Output-FeedbackMode 76
2.5.5 CounterMode 76
2.6 OffsetCodebookModeofOperations 77
2.6.1 BasicOperations 77
2.6.2 OCBEncryptionandTagGeneration 78
2.6.3 OCBDecryptionandTagVerification 79
Contents vii
2.7 StreamCiphers 80
2.7.1 RC4StreamCipher 80
2.7.2 RC4SecurityWeaknesses 81
2.8 KeyGenerations 83
2.8.1 ANSIX9.17PRNG 83
2.8.2 BBSPseudorandomBitGenerator 83
2.9 ClosingRemarks 84
2.10 Exercises 85
2.10.1 Discussions 85
2.10.2 Homework 85
3 Public-KeyCryptographyandKeyManagement 93
3.1 ConceptsofPublic-KeyCryptography 93
3.2 ElementaryConceptsandTheoremsinNumberTheory 95
3.2.1 ModularArithmeticandCongruenceRelations 96
3.2.2 ModularInverse 96
3.2.3 PrimitiveRoots 98
3.2.4 FastModularExponentiation 98
3.2.5 FindingLargePrimeNumbers 100
3.2.6 TheChineseRemainderTheorem 101
3.2.7 FiniteContinuedFractions 102
3.3 Diffie-HellmanKeyExchange 103
3.3.1 KeyExchangeProtocol 103
3.3.2 Man-in-the-MiddleAttacks 104
3.3.3 ElgamalPKC 106
3.4 RSACryptosystem 106
3.4.1 RSAKeyPairs,Encryptions,andDecryptions 106
3.4.2 RSAParameterAttacks 109
3.4.3 RSAChallengeNumbers 112
3.5 Elliptic-CurveCryptography 113
3.5.1 CommutativeGroupsonEllipticCurves 113
3.5.2 DiscreteEllipticCurves 115
3.5.3 ECCEncodings 116
3.5.4 ECCEncryptionandDecryption 117
3.5.5 ECCKeyExchange 118
3.5.6 ECCStrength 118
3.6 KeyDistributionsandManagement 118
3.6.1 MasterKeysandSessionKeys 119
3.6.2 Public-KeyCertificates 119
3.6.3 CANetworks 120
3.6.4 KeyRings 121
3.7 ClosingRemarks 123
3.8 Exercises 123
3.8.1 Discussions 123
3.8.2 Homework 124
viii Contents
4 DataAuthentication 129
4.1 CryptographicHashFunctions 129
4.1.1 DesignCriteriaofCryptographicHashFunctions 130
4.1.2 QuestforCryptographicHashFunctions 131
4.1.3 BasicStructureofStandardHashFunctions 132
4.1.4 SHA-512 132
4.1.5 WHIRLPOOL 135
4.1.6 SHA-3Standard 139
4.2 CryptographicChecksums 143
4.2.1 Exclusive-ORCryptographicChecksums 143
4.2.2 DesignCriteriaofMACAlgorithms 144
4.2.3 DataAuthenticationAlgorithm 144
4.3 HMAC 144
4.3.1 DesignCriteriaofHMAC 144
4.3.2 HMACAlgorithm 145
4.4 BirthdayAttacks 145
4.4.1 ComplexityofBreakingStrongCollisionResistance 146
4.4.2 SetIntersectionAttack 147
4.5 DigitalSignatureStandard 149
4.5.1 Signing 149
4.5.2 SignatureVerifying 150
4.5.3 CorrectnessProofofSignatureVerification 150
4.5.4 SecurityStrengthofDSS 151
4.6 DualSignaturesandElectronicTransactions 151
4.6.1 DualSignatureApplications 152
4.6.2 DualSignaturesandElectronicTransactions 152
4.7 BlindSignaturesandElectronicCash 153
4.7.1 RSABlindSignatures 153
4.7.2 ElectronicCash 154
4.7.3 Bitcoin 156
4.8 ClosingRemarks 158
4.9 Exercises 158
4.9.1 Discussions 158
4.9.2 Homework 158
5 NetworkSecurityProtocolsinPractice 165
5.1 CryptoPlacementsinNetworks 165
5.1.1 CryptoPlacementattheApplicationLayer 168
5.1.2 CryptoPlacementattheTransportLayer 168
5.1.3 CryptoPlacementattheNetworkLayer 168
5.1.4 CryptoPlacementattheData-LinkLayer 169
5.1.5 ImplementationsofCryptoAlgorithms 169
5.2 Public-KeyInfrastructure 170
5.2.1 X.509Public-KeyInfrastructure 170
5.2.2 X.509CertificateFormats 171