Computer Science // Cryptology Please give brief examples for BOTH 3. Suppose we

Question

Computer Science // Cryptology

Please give brief examples for BOTH

3. Suppose we use symmetric keys for authentication and each of N users must be able to authenticate any of the other N — 1 users. Evidently, such a system requires one symmetric key for each pair of users, or on the order of N2 keys. On the other hand, if we use public keys, only N key pairs are required, but we must then deal with PKI issues.

a. Kerberos authentication uses symmetric keys, yet only N keys are required for N users. How is this accomplished?

b. In Kerberos, no PKI is required. But, in security, there is no free lunch, so what's the tradeoff?

Explanation / Answer

The authentication of entities in Kerberos uses symmetric key cryptography . This explains why the default Kerberos protocol relies on symmetric key cryptography. In symmetric key cryptography the entities use the same key for both encryption and decryption.

This is what happens when user1 wants to authenticate to a server using a symmetric key cipher

if the server can successfully decrypt the message, this means if the decryption process results in user1's name and an acceptable timestamp, the resource server knows that only user1 could have encrypted this information, Upon receipt of user1's encrypted packet, the server will compare the timestamp in user1's packet against the local time. If the time skew between these two timestamps is too big, the server will reject the authentication attempt.

Thus only N keys are required for N users.

A big problem when using a symmetric protocol is the secure distribution of the secret key. The secret key is generated at one side of the communication channel and should be sent to the other side of the communication channel in a secure way. Secure means that the confidentiality and integrity of the key should be protected. If anybody could read the secret key when it is sent across the network, the whole authentication system becomes worthless: The secrecy of the secret key is a vital part of a symmetric cipher.

To make Kerberos more scalable and secure , the Kerberos included the concept of a KDC. KDC is a trusted third party with which every entity shares a secret key: This key is called the entity's master key. All entities trust the KDC to mediate in their mutual authentication. The KDC also maintains a centralized authentication database containing a copy of every user's master key.

Related Questions

Navigate

• Browse (All)
• Browse C
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.