UNIT -13: E-MAIL SECURITY
3. Require the user to prove his or her identity for each service invoked. Also require that servers prove their identity to clients
In a small, closed environment in which all systems are owned and operated by a single organization, the first or perhaps the second strategy may suffice. But in a more open environment in which network connections to other machines are supported, the third approach is needed to protect user information and resources housed at the server. Kerberos supports this third approach. Kerberos assumes distributed client/server architecture and employs one or more Kerberos servers to provide an authentication service.
Sequence of steps in authentication with Kerberos version is given here in table 13.1(a) to 13.1(c)
(a) Authentication Service Exchange to obtain ticket-granting ticket.
(b) Ticket-Granting Service Exchange to obtain service-granting ticket.
190
(c) Client/Server Authentication Exchange to obtain service
,v 5
,v 4 4
,v 5
5. : T ||
6. : ( , [ 1]) (for mutualauthentication)
( , [K || || AD || ID || || ])
Tables 13.1a to 13.1c: Summary of Kerberos Version4 Message Exchanges
The notations in the table are briefly explained here. The service TGS, issues tickets to users who have been authenticated to AS.
Kerberos protocol sequences of operations are described in tables 13.2 (a) to(c) Message (1)
IDC IDtgs
TS1
Client requests ticket-granting ticket.
Tells AS identity of user from this client.
Tells AS that user re quests access to TGS.
Allows AS to verify that client‟s clock is synchronized with that of AS.
Message (2)
Encryption is based on user‟s password, enabling AS and client to verify Password and protecting contents of message (2).
Copy of session key accessible to client created by AS to permit secure exchange between client and TGS without requiring them to share a permanent key.
Confirms that this ticket is for the TGS.
Informs client of time this ticket was issued.
Informs client of the lifetime of this ticket.
Ticket to be used by client to access TGS.
(a) Authentication Service Exchange
191
Tells TGS that user requests access to server V.
Assures TGS that this user has been authenticated by AS.
Generated by client to validate ticket.
Message (4)
Key shared only by C and TGS protects contents of message (4).
Copy of session key accessible to client created by TGS to permit secure
exchange between client and server without requiring them to share a permanent key.
Confirms that this ticket is for server V.
Informs client of time this ticket was issued.
Ticket to be used by client to access server V.
Reusable so that user does not have to reenter password.
Ticket is encrypted with key known only to AS and TGS, to prevent tampering.
Copy of session key accessible to TGS used to decrypt authenticator, thereby authenticating ticket.
Indicates the rightful owner of this ticket.
Prevents use of ticket from workstation other than one that initially requested the ticket.
Assures server that it has decrypted ticket properly.
Informs TGS of time this ticket was issued.
Prevents replay after ticket has expired.
Assures TGS that the ticket presenter is the same as the client for whom the ticket was issued has very short lifetime to prevent replay.
Authenticator is encrypted with key known only to client and TGS, to prevent tampering.
Must match ID in ticket to authenticate ticket.
192 ADC
TS3
Must match address in ticket to authenticate ticket.
Informs TGS of time this authenticator was generated.
(b) Ticket-Granting Service Exchange Message (5)
TicketV
Authenticatorc
Client requests service.
Assures server that this user has been authenticated by AS.
Generated by client to validate ticket.
Message (6)
Assures C that this message is from V.
Assures C that this is not a replay of an old reply.
Reusable so that client does not need to request a new ticket from TGS for each access to the same server.
Ticket is encrypted with key known only to TGS and server, to prevent tampering.
Copy of session key accessible to client; used to decrypt authenticator, thereby authenticating ticket.
Indicates the rightful owner of this ticket.
Prevents use of ticket from workstation other than one that initially requested the ticket.
Assures server that it has decrypted ticket properly.
Informs server of time this ticket was issued.
Prevents replay after ticket has expired.
Assures server that the ticket presenter is the same as the client for whom the ticket was issued; has very short lifetime to prevent replay.
Authenticator is encrypted with key known only to client and server, to prevent tampering.
Must match ID in ticket to authenticate ticket.
193 ADC
TS5
Must match address in ticket to authenticate ticket.
Informs server of time this authenticator was generated.
(c) Client/Server Authentication Exchange
Table 13.2: Rationale for the Elements of the Kerberos Version 4 Protocol 13.5 SUMMARY
In this unit, review of internet is given in section 13.1. E-mail security is the topic in section 13.2. Pretty good privacy (PGP) is widely used method for security of E-mails. User authentication protocols are described in section 13.3. Section 13.4 introduces the standard authentication service Kerberos.
13.6 KEYWORDS
IP security, OSI, TCP-IP, E-mail security, PGP, mutual authentication, one way authentication
13.7 QUESTIONS
1. Give an overview of PGP of Zimmerman.
2. Mention the reasons for popularity of PGP.
3. Describe with figures the three forms of PGP.
4. Write about E-mail compatibility.
5. Differentiate mutual and one way authentication.
6. Write a protocol for mutual and one way authentication using symmetric and asymmetric encryption.
7. Write a note on Kerberos.
13.8 REFERENCES
1. Atul Kahate, Cryptography and Network Security, Tata MCGrawHill 2. Behrouz A Forouzan, Cryptography and Network security, McGraw Hill
3. Charlie Kauffman, Radia Perlman, Mike Spciner, Network Security, Pearson Education 4. William Stallings, Cryptography and Network Security, Pearson
194
195