Criptografía y Seguridad de Redes

Double DES

Use 2 keys to encrypt. Meet in the middle attack. Find E(M1) = D(C1).

ECB

Each block is encoded with the same key, information leakage can occur with repeated messages, parallelizable. Block replay attack – While monitoring. (Find and play repeated messages)

CBC

Used with a key – but not secret. Plaintext can produce different ciphers based on IV -> limits info leaks. Patterns still emerge for long messages. The problem – no integrity.

Diffie Hellman

1. Choose two large primes: p and g.
2. Choose a and b from [1, p-2].
3. Calculate A/B = g^[a/b] mod p.
4. Calculate s = B/A^[a/b] mod p.
5. k = SHA256(s)
6. Use k as the key for CBC.

Vulnerable to Man-in-the-Middle attack: Change A and B to p.

RSA

1. Generate 2 large distinct primes p and q.
2. n = pq, phi = (p-1)(q-1).
3. Select random integer e < phi and relatively prime to phi.
4. Calculate d < phi s.t. e*d mod phi == 1.
5. Public key: [e, n], private key: [d, n].

SSL

Avoid network attacks (eavesdropper). Provide confidentiality + integrity, does not browser based attack.

TLS

Why don’t we always use HTTPS

Slows down web server, breaks internet caching. But always use SSL for hosting websites.

OSI

1. Physical: controls bits on the medium, [Physical destruction]
2. Data Link: controls interface to physical medium within frames, [MAC flooding -- inundates the network switch with data packets]
3. Network: controls routing of packets, [ICMP Flooding - A Layer 3 infrastructure DDoS attack method that uses ICMP messages to overload the targeted network's bandwidth]
4. Transport: controls error correction and packetization (breaking data into packets), [SYN Flood, Smurf Attack]
5. Session
6. Presentation
7. Application: user centric protocols that send data, [PDF GET requests, HTTP GET, HTTP POST, = website forms (login, uploading photo/video, submitting feedback)].

1. Practice defense in-depth tactics, use access controls, accountability, and auditing to track and control physical assets.
2. Allow discovered MAC addresses to be authenticated against an authentication, authorization and accounting (AAA) server and subsequently filtered.
3. Rate-limit ICMP traffic and prevent the attack from impacting bandwidth and firewall performance.
4. DDoS attack blocking, commonly referred to as blackholing, is a method typically used by ISPs to stop a DDoS attack on one of its customers.
5. Application monitoring is the practice of monitoring software applications using a dedicated set of algorithms, technologies, and approaches to detect zero day and application layer.