2. cnp3-ebook
3. principles/security
4. English
5. Zen

6 ../../principles/security.rst:62
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Threats 7/10000 · 7
7 ../../principles/security.rst:64
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — When analyzing security issues in computer networks, it is useful to reason about the capabilities of the attacker who wants to exploit some breach in the security of the network. There are different types of attackers. Some have generic capabilities, others are specific to a given technology or network protocol. In this section, we discuss some important threats that a network architect must take into account. 414/10000 · 414
8 ../../principles/security.rst:73
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The first type of attacker is called the `passive attacker`. A `passive attacker` is someone able to observe and usually store the information (e.g. the packets) exchanged in a given network or subset of it (e.g. a specific link). This attacker has access to all the data passing through this specific link. This is the most basic type of attacker and many network technologies are vulnerable to such attacks. In the above example, a passive attacker could easily capture the password sent by Alice and reuse it later to be authenticated as Alice on the remote computer. This is illustrated in the figure below where we do not show anymore the ``DATA.req`` and ``DATA.ind`` primitives but only the messages exchanged. Throughout this chapter, we will always use `Eve` as a user who is able to eavesdrop the data passing in front of her. 836/10000 · 836
9 ../../principles/security.rst:113
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — In the above example, `Eve` can capture all the packets exchanged by Bob and Alice. This implies that Eve can discover Alice's username and Alice's password. With this information, Eve can then authenticate as Alice on Bob's computer and do whatever Alice is authorized to do. This is a major problem from a security point of view. To prevent this attack, Alice should never send her password in clear over a network where someone could eavesdrop the information. In some networks, such as an open wireless network, an attacker can easily collect all the data sent by a particular user. In other networks, this is a bit more complex depending on the network technology used, but various software packages exist to automate this process. As will be described later, the best approach to prevent this type of attack is to rely on cryptographic techniques to ensure that passwords are never sent in clear. 902/10000 · 902
10 ../../principles/security.rst:132
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Pervasive monitoring 20/10000 · 20
11 ../../principles/security.rst:134
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — In the previous example, we have explained how Eve could capture data from a particular user. This is not the only attack of this type. In 2013, based on documents collected by Edward Snowden, the press revealed that several governmental agencies were collecting lots of data on various links that compose the global Internet [Greenwald2014]_. Thanks to this massive amount of data, these governmental agencies have been able to extract lots of information about the behavior of Internet users. Like Eve, they are in a position to extract passwords, usernames and other privacy sensitive data from all the packets that they have captured. However, it seems that these agencies were often more interested in various meta data, e.g. information showing with whom a given user communicates than the actual data exchanged. These revelations have shocked the Internet community and the `Internet Engineering Task Force <https://www.ietf.org>`_ that manages the standardization of Internet protocols has declared in :rfc:`7258` that such pervasive monitoring is an attack that need to be countered in the development of new protocols. Several new protocols and extensions to existing ones are being developed to counter these attacks. 1228/10000 · 1228
12 ../../principles/security.rst:155
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Eavesdropping and pervasive monitoring are not the only possible attacks against a network. Another type of attacker is the active attacker. In the literature, these attacks are often called `Man in the middle` or `MITM` attacks. Such attacks occur when one user, let us call him `Mallory`, has managed to configure the network so that he can both capture and modify the packets exchanged by two users. The simplest scenario is when Mallory controls a router that is on the path used by both Alice and Bob. For example, Alice could be connected to a WiFi access router controlled by Mallory and Bob would be a regular server on the Internet. 641/10000 · 641
13 ../../principles/security.rst:179
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — As Mallory receives all the packets sent by both Bob and Alice, he can modify them at will. For example, he could modify the commands sent by Alice to the server managed by Bob and change the responses sent by the server. This type of attack is very powerful and sometimes difficult to counter without relying on advanced cryptographic techniques. 347/10000 · 347
14 ../../principles/security.rst:187
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The last type of attack that we consider in this introduction are the `Denial of Service` or DoS attacks. During such an attack, the attacker generates enough packets to saturate a given service and prevent it from operating correctly. The simplest Denial of Service attack is to send more packets that the bandwidth of the link that attaches the target to the network. The target could be a single server, a company or even an entire country. If these packets all come from the same source, then the victim can identify the attacker and contact the law enforcement authorities. In practice, such denial of service attacks do not originate from a single source. The attacker usually compromises a (possibly very large) set of sources and forces them to send packets to saturate a given target. Since the attacking traffic comes from a wide range of sources, it is difficult for the victim to locate the culprit and also to counter the attack. Saturating a link is the simplest example of `Distributed Denial of Service (DDoS)` attacks. 1035/10000 · 1035
15 ../../principles/security.rst:198
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — In practice, there is a possibility of denial of service attacks as soon as there is a limited resource somewhere in the network. This resource can be the bandwidth of a link, but it could also be the computational power of a server, its memory or even the size of tables used by a given protocol implementation. Defending against real DoS attacks can be difficult, especially if the attacker controls a large number of sources that are used to launch the attacks. In terms of bandwidth, DoS attacks composed of a few Gbps to a few tens of Gbps of traffic are frequent on the Internet. In 2015, `github.com <http://www.github.com>`_ suffered from a distributed DoS that reached a top bandwidth of 400 Gbps according to some `reports <http://www.techworld.com/news/security/worlds-largest-ddos-attack-reached-400gbps-says-arbor-networks-3595715/>`_. 848/10000 · 848
16 ../../principles/security.rst:213
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — When designing network protocols and applications that will be deployed on a large scale, it is important to take those DDoS attacks into account. Attackers use different strategies to launch DDoS attacks. Some have managed to gain control of a large number of sources by injecting malware on them. Others, and this is where protocol designers have an important role to play, simply exploit design flaws in some protocols. Consider a simple request-response protocol where the client sends a request and the server replies with a response. Often the response is larger or much larger than the request sent by the client. Consider that such a simple protocol is used over a datagram network. When Alice sends a datagram to Bob containing her request, Bob extracts both the request and Alice's address from the packet. He then sends his response in a single packet destined to Alice. Mallory would like to create a DoS attack against Alice without being identified. Since he has studied the specification of this protocol, he can send a request to Bob inside a packet having Alice's address as its source address. Bob will process the request and send his (large) response to Alice. If the response has the same size as the request, Mallory is producing a `reflection attack` since his packets are reflected by Bob. Alice would think that she is attacked by Bob. If there are many servers that operate the same service as Bob, Mallory could hide behind a large number of such reflectors. Unfortunately, the reflection attack can also become an amplification attack. This happens when the response sent by Bob is larger than the request that it has received. If the response is :math:`k` times larger than the request, then when Mallory consumes 1 Gbps of bandwidth to send requests, his victim receives :math:`k` Gbps of attack traffic. Such amplification attacks are a very important problem and protocol designers should ensure that they never send a large response before having received the proof that the request that they have received originated from the source indicated in the request. 2092/10000 · 2092
17 ../../principles/security.rst:245
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Cryptographic primitives 24/10000 · 24
18 ../../principles/security.rst:247
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Cryptography techniques have initially been defined and used by spies and armies to exchange secret information in manner that ensures that adversaries cannot decode the information even if they capture the message or the person carrying the message. A wide range of techniques have been defined. The first techniques relied on their secrecy to operate. One of the first encryption schemes is attributed to Julius Caesar. When he sent confidential information to his generals, he would encode each message by replacing each letter with another letter that is :math:`n` positions after this letter in the alphabet. For example, the message `SECRET` becomes `VHFUHW` when encoded using Caesar's cipher. This technique could have puzzled some soldiers during Caesar's wars, but today even young kids can recover the original message from the ciphered one. 852/10000 · 852
19 ../../principles/security.rst:261
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — The security of the Caesar cipher depends on the confidentiality of the algorithm, but experience has shown that it is impossible to assume that an algorithm will remain secret, even for military applications. Instead, cryptographic techniques must be designed by assuming that the algorithm will be public and known to anyone. However, its behavior must be controlled by a small parameter, known as the key, that will only be known by the users who need to communicate secretly. This principle is attributed to Auguste Kerckhoff, a French cryptographer who first documented it : 579/10000 · 579
20 ../../principles/security.rst:270
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — `A cryptographic algorithm should be secure even if the attacker knows everything about the system, except one parameter known as the secret key.` 146/10000 · 146
21 ../../principles/security.rst:279
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — This principle is important because it remains the basic assumption of all cryptographers. Any system that relies on the secrecy of its algorithm to be considered secure is doomed to fail and be broken one day. 210/10000 · 210
22 ../../principles/security.rst:287
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — With the Kerckhoff principle, we can now discuss a simple but powerful encryption scheme that relies on the `XOR` logic operation. This operation is easily implemented in hardware and is supported by all microprocessors. Given a secret, :math:`K`, it is possible to encode a message `M` by computing :math:`C_M = K \oplus M`. The receiver of this messages can recover the original message as since :math:`M = K \oplus (K \oplus M)`. This `XOR` operation is the key operation of the perfect cipher that is also called the Vernam cipher or the one-time pad. This cipher relies on a key that contains purely random bits. The encrypted message is then produced by XORing all the bits of the message with all the bits of the key. Since the key is random, it is impossible for an attacker to recover the original text (or plain text) from the encrypted one. From a security viewpoint, the one-time-pad is the best solution provided that the key is as long as the message. 965/10000 · 965
23 ../../principles/security.rst:301
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Unfortunately, it is difficult to use this cipher in practice since the key must be as long as the message that needs to be transmitted. If the key is smaller than the message and the message is divided into blocks that have the same length as the key, then the scheme becomes less secure since the same key is used to decrypt different parts of the message. In practice, `XOR` is often one of the basic operations used by encryption schemes. To be usable, the deployed encryption schemes use keys that are composed of a small number of bits, typically 56, 64, 128, 256, ... 574/10000 · 574
24 ../../principles/security.rst:310
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — A secret key encryption scheme is a perfectly reversible functions, i.e. given an encryption function `E`, there is an associated decryption function `D` such that :math:`\forall k \forall M : D(K, E(M,K))=M`. 209/10000 · 209
25 ../../principles/security.rst:316
	English ↹ ↵ NBS … “ ” ‘ ’ ﹙-﹚ ‐ – — Various secret key cryptographic functions have been proposed, implemented and deployed. The most popular ones are : 116/10000 · 116