INFORMATION SECURITY: PRINCIPLES AND PRACTICE
CONTENTS 1 INTRODUCTION THE CAST OF CHARACTERS ALICE’S ONLINE BANK CON?DENTIALITY, INTEGRITY, AND AVAILABILITY BEYOND CIA ABOUT THIS BOOK CRYPTOGRAPHY ACCESS CONTROL PROTOCOLS SOFTWARE THE PEOPLE PROBLEM PRINCIPLES AND PRACTICE PROBLEMS I CRYPTO 2 CRYPTO BASICS INTRODUCTION HOW TO SPEAK CRYPTO CLASSIC CRYPTO SIMPLE SUBSTITUTION CIPHER CRYPTANALYSIS OF A SIMPLE SUBSTITUTION DE?NITION OF SECURE DOUBLE TRANSPOSITION CIPHER ONE-TIME PAD PROJECT VENONA CODEBOOK CIPHER CIPHERS OF THE ELECTION OF 1876 MODERN CRYPTO HISTORY A TAXONOMY OF CRYPTOGRAPHY A TAXONOMY OF CRYPTANALYSIS SUMMARY 3 SYMMETRIC KEY CRYPTO STREAM CIPHERS A5/1 RC4 BLOCK CIPHERS FEISTEL CIPHER DES TRIPLE DES AES THREE MORE BLOCK CIPHERS TEA BLOCK CIPHER MODES INTEGRITY 4 PUBLIC KEY CRYPTO KNAPSACK RSA RSA EXAMPLE REPEATED SQUARING SPEEDING UP RSA DIF?E-HELLMAN ELLIPTIC CURVE CRYPTOGRAPHY ELLIPTIC CURVE MATH ECC DIF?E-HELLMAN PUBLIC KEY NOTATION USES FOR PUBLIC KEY CRYPTO CON?DENTIALITY IN THE REAL WORLD SIGNATURES AND NON-REPUDIATION CON?DENTIALITY AND NON-REPUDIATION PUBLIC KEY INFRASTRUCTURE 5 HASH FUNCTIONS AND OTHER TOPICS WHAT IS A HASH FUNCTION? THE BIRTHDAY PROBLEM NON-CRYPTOGRAPHIC HASHES TIGER HASH HMAC USES OF HASH FUNCTIONS ONLINE BIDS SPAM REDUCTION OTHER CRYPTO-RELATED TOPICS SECRET SHARING RANDOM NUMBERS INFORMATION HIDING 6 ADVANCED CRYPTANALYSIS LINEAR AND DIFFERENTIAL CRYPTANALYSIS QUICK REVIEW OF DES OVERVIEW OF DIFFERENTIAL CRYPTANALYSIS OVERVIEW OF LINEAR CRYPTANALYSIS TINY DES DIFFERENTIAL CRYPTANALYSIS OF TDES LINEAR CRYPTANALYSIS OF TDES BLOCK CIPHER DESIGN SIDE CHANNEL ATTACK ON RSA LATTICE REDUCTION AND THE KNAPSACK HELLMAN’S TIME-MEMORY TRADE-OFF POPCNT CRYPTANALYTIC TMTO MISBEHAVING CHAINS SUCCESS PROBABILITY II ACCESS CONTROL 7 AUTHENTICATION AUTHENTICATION METHODS PASSWORDS KEYS VERSUS PASSWORDS CHOOSING PASSWORDS ATTACKING SYSTEMS VIA PASSWORDS PASSWORD VERI?CATION MATH OF PASSWORD CRACKING OTHER PASSWORD ISSUES BIOMETRICS TYPES OF ERRORS BIOMETRIC EXAMPLES BIOMETRIC ERROR RATES BIOMETRIC CONCLUSIONS SOMETHING YOU HAVE TWO-FACTOR AUTHENTICATION SINGLE SIGN-ON AND WEB COOKIES 8 AUTHORIZATION ACCESS CONTROL MATRIX ACLS AND CAPABILITIES CONFUSED DEPUTY MULTILEVEL SECURITY MODELS BELL-LAPADULA BIBA’S MODEL MULTILATERAL SECURITY COVERT CHANNEL INFERENCE CONTROL CAPTCHA FIREWALLS PACKET FILTER STATEFUL PACKET FILTER APPLICATION PROXY PERSONAL FIREWALL DEFENSE IN DEPTH INTRUSION DETECTION SIGNATURE-BASED IDS ANOMALY-BASED IDS III PROTOCOLS 9 SIMPLE AUTHENTICATION PROTOCOLS SIMPLE SECURITY PROTOCOLS AUTHENTICATION PROTOCOLS AUTHENTICATION USING SYMMETRIC KEYS AUTHENTICATION USING PUBLIC KEYS SESSION KEYS PERFECT FORWARD SECRECY MUTUAL AUTHENTICATION, SESSION KEY, AND PFS TIMESTAMPS AUTHENTICATION AND TCP ZERO KNOWLEDGE PROOFS THE BEST AUTHENTICATION PROTOCOL? 10 REAL-WORLD SECURITY PROTOCOLS SECURE SOCKET LAYER SSL AND THE MAN-IN-THE-MIDDLE SSL CONNECTIONS SSL VERSUS IPSEC IPSEC IKE PHASE 1: DIGITAL SIGNATURE IKE PHASE 1: SYMMETRIC KEY IKE PHASE 1: PUBLIC KEY ENCRYPTION IPSEC COOKIES IKE PHASE 1 SUMMARY IKE PHASE 2 IPSEC AND IP DATAGRAMS TRANSPORT AND TUNNEL MODES ESP AND AH KERBEROS KERBERIZED LOGIN KERBEROS TICKET KERBEROS SECURITY GSM GSM ARCHITECTURE GSM SECURITY ARCHITECTURE GSM AUTHENTICATION PROTOCOL GSM SECURITY FLAWS GSM CONCLUSIONS 3GPP IV SOFTWARE 11 SOFTWARE FLAWS AND MALWARE SOFTWARE FLAWS BUFFER OVER?OW INCOMPLETE MEDIATION RACE CONDITIONS MALWARE BRAIN MORRIS WORM CODE RED SQL SLAMMER TROJAN EXAMPLE MALWARE DETECTION THE FUTURE OF MALWARE CYBER DISEASES VERSUS BIOLOGICAL DISEASES MISCELLANEOUS SOFTWARE-BASED ATTACKS SALAMI ATTACKS LINEARIZATION ATTACKS TIME BOMBS TRUSTING SOFTWARE 12 INSECURITY IN SOFTWARE SOFTWARE REVERSE ENGINEERING ANTI-DISASSEMBLY TECHNIQUES ANTI-DEBUGGING TECHNIQUES SOFTWARE TAMPER RESISTANCE GUARDS OBFUSCATION METAMORPHISM REVISITED DIGITAL RIGHTS MANAGEMENT WHAT IS DRM? A REAL-WORLD DRM SYSTEM DRM FOR STREAMING MEDIA DRM FOR A P2P APPLICATION DRM IN THE ENTERPRISE DRM FAILURES DRM CONCLUSIONS SOFTWARE DEVELOPMENT OPEN VERSUS CLOSED SOURCE SOFTWARE FINDING FLAWS OTHER SOFTWARE DEVELOPMENT ISSUES 13 OPERATING SYSTEMS AND SECURITY OPERATING SYSTEM SECURITY FUNCTIONS SEPARATION MEMORY PROTECTION TRUSTED OPERATING SYSTEM MAC, DAC, AND MORE TRUSTED PATH TRUSTED COMPUTING BASE NEXT GENERATION SECURE COMPUTING BASE NGSCB FEATURE GROUPS NGSCB COMPELLING APPLICATIONS CRITICISMS OF NGSCB