?? 22-03.html
字號(hào):
<html><head><TITLE>APPLIED CRYPTOGRAPHY, SECOND EDITION: Protocols, Algorithms, and Source Code in C:Key-Exchange Algorithms</TITLE>
<!-- BEGIN HEADER --><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><SCRIPT><!--function displayWindow(url, width, height) { var Win = window.open(url,"displayWindow",'width=' + width +',height=' + height + ',resizable=1,scrollbars=yes');}//--></SCRIPT></HEAD><body bgcolor="ffffff" link="#006666" alink="#006666" vlink="#006666"><P>
<CENTER><B>Applied Cryptography, Second Edition: Protocols, Algorthms, and Source Code in C (cloth)</B>
<FONT SIZE="-2">
<BR>
<I>(Publisher: John Wiley & Sons, Inc.)</I>
<BR>
Author(s): Bruce Schneier
<BR>
ISBN: 0471128457
<BR>
Publication Date: 01/01/96
</FONT></CENTER>
<P>
<!-- Empty Reference Subhead -->
<!--ISBN=0471128457//-->
<!--TITLE=APPLIED CRYPTOGRAPHY, SECOND EDITION: Protocols, Algorithms, and Source Code in C//-->
<!--AUTHOR=Bruce Schneier//-->
<!--PUBLISHER=Wiley Computer Publishing//-->
<!--CHAPTER=22//-->
<!--PAGES=518-521//-->
<!--UNASSIGNED1//-->
<!--UNASSIGNED2//-->
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="22-02.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="22-04.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
<P><BR></P>
<P>At step (3), both Alice and Bob know <I>K´</I> and <I>K. K</I> is the session key and can be used to encrypt all other messages between Alice and Bob. Eve, sitting between Alice and Bob, only knows <I>EP</I>(<I>K´</I>), <I>E</I><SUB>P</SUB>(<I>E</I><SUB>K´</SUB>(<I>K</I>)), and some messages encrypted with <I>K.</I> In other protocols, Eve could make guesses at <I>P</I> (people choose bad passwords all the time, and if Eve is clever she can make some good guesses) and then test her guesses. In this protocol, Eve cannot test her guess without cracking the public-key algorithm as well. And if both <I>K´</I> and <I>K</I> are chosen randomly, this can be an insurmountable problem.</P>
<P>The challenge-response portion of the protocol, steps (3) through (6), provides validation. Steps (3) through (5) prove to Alice that Bob knows <I>K;</I> steps (4) through (6) prove to Bob that Alice knows <I>K.</I> The Kerberos protocol timestamp exchange accomplishes the same thing.</P>
<P>EKE can be implemented with a variety of public-key algorithms: RSA, ElGamal, Diffie-Hellman. There are security problems with implementing EKE with a knapsack algorithm (aside from the inherent insecurity of knapsack algorithms): The normal distribution of the ciphertext messages negates the benefits of EKE.</P>
<P><FONT SIZE="+1"><B><I>Implementing EKE with RSA</I></B></FONT></P>
<P>The RSA algorithm seems perfect for this application, but there are some subtle problems. The authors recommend encrypting only the encryption exponent in step (1) and sending the modulus in the clear. An explanation of the reasoning behind this recommendation, as well as other subtleties involved in using RSA, is in [109].
</P>
<P><FONT SIZE="+1"><B><I>Implementing EKE with ElGamal</I></B></FONT></P>
<P>Implementing EKE with the ElGamal algorithm is straightforward, and there is even a simplification of the basic protocol. Using the notation from Section 19.6, <I>g</I> and <I>p</I> are parts of the public key and are common to all users. The private key is a random number <I>r.</I> The public key is <I>g</I><SUP>r</SUP> mod <I>p.</I> The message Alice sends to Bob in step (1) becomes</P>
<DL>
<DD>Alice, <I>g</I><SUP>r</SUP> mod <I>p</I>
</DL>
<P>Note that this public key does not have to be encrypted with <I>P.</I> This is not true in general, but it is true for the ElGamal algorithm. Details are in [109].</P>
<P>Bob chooses a random number, <I>R</I> (for the ElGamal algorithm and independent of any random numbers chosen for EKE), and the message he sends to Alice in step (2) becomes</P>
<DL>
<DD><I>E</I><SUB>P</SUB>(<I>g</I><SUP>R</SUP> mod <I>p, Kg</I><SUP>Rr</SUP> mod <I>p</I>)
</DL>
<P>Refer back to Section 19.6 for restrictions on choosing the variables for ElGamal.
</P>
<P><FONT SIZE="+1"><B><I>Implementing EKE with Diffie-Hellman</I></B></FONT></P>
<P>With the Diffie-Hellman protocol, <I>K</I> is generated automatically. The final protocol is even simpler. A value for <I>g</I> and <I>n</I> is set for all users on the network.</P>
<DL>
<DD><B>(1)</B> Alice picks a random number, <I>r</I><SUB>A</SUB>, and sends Bob
<DL>
<DD><I>A,</I> <I>g<SUP>r<SMALL><SMALL>A</SMALL></SMALL></SUP></I> mod <I>n</I>
</DL>
<BR>With Diffie-Hellman, Alice does not have to encrypt her first message with <I>P.</I>
<DD><B>(2)</B> Bob picks a random number, <I>r</I><SUB>B,</SUB> and calculates
<DL>
<DD><I>K</I> = <I>g</I><SUP>r</SUP>A*<SUP>r<SMALL><SMALL>B</SMALL></SMALL></SUP> mod <I>n</I>
</DL>
<BR>He generates a random string <I>RB,</I> then calculates and sends Alice:
<DL>
<DD><I>E</I><SUB>P</SUB>(<I>g</I><SUP>r<SMALL><SMALL>B</SMALL></SMALL></SUP> mod <I>n</I>), <I>EK</I>(<I>RB</I>)
</DL>
<DD><B>(3)</B> Alice decrypts the first half of Bob’s message to obtain <I>g</I><SUP>r</SUP>B mod <I>n.</I> Then she calculates <I>K</I> and uses <I>K</I> to decrypt <I>R</I><SUB>B</SUB>. She generates another random string, <I>R</I><SUB>A</SUB>, encrypts both strings with <I>K,</I> and sends Bob the result.
<DL>
<DD><I>E</I><SUB>K</SUB>(<I>R</I><SUB>A</SUB>, <I>R</I><SUB>B</SUB>)
</DL>
<DD><B>(4)</B> Bob decrypts the message to obtain <I>R</I><SUB>A</SUB> and <I>R</I><SUB>B</SUB>. Assuming the <I>R</I><SUB>B</SUB> he received from Alice is the same as the one he sent to Alice in step (2), he encrypts <I>R</I><SUB>A</SUB> with <I>K</I> and sends it to Alice.
<DL>
<DD><I>E</I><SUB>K</SUB>(<I>R</I><SUB>A</SUB>)
</DL>
<DD><B>(5)</B> Alice decrypts the message to maintain <I>R</I><SUB>A</SUB>. Assuming the <I>R</I><SUB>A</SUB> she received from Bob is the same as the one she sent to Bob in step (3), the protocol is complete. Both parties now communicate using <I>K</I> as the session key.
</DL>
<P><FONT SIZE="+1"><B><I>Strengthening EKE</I></B></FONT></P>
<P>Bellovin and Merritt suggest an enhancement of the challenge-and-response portion of the protocol—to prevent a possible attack if a cryptanalyst recovers an old <I>K</I> value.</P>
<P>Look at the basic EKE protocol. In step (3), Alice generates another random number, <I>S</I><SUB>A</SUB>, and sends Bob</P>
<DL>
<DD><I>E</I><SUB>K</SUB>(<I>R</I><SUB>A</SUB>, <I>S</I><SUB>A</SUB>)
</DL>
<P>In step (4), Bob generates another random number, <I>SB,</I> and sends Alice</P>
<DL>
<DD><I>E</I><SUB>K</SUB>(<I>R</I><SUB>A</SUB>, <I>R</I><SUB>B</SUB>, <I>S</I><SUB>B</SUB>)
</DL>
<P>Alice and Bob now can both calculate the true session key, <I>S</I><SUB>A</SUB> ⊕ <I>S</I><SUB>B</SUB>. This key is used for all future messages between Alice and Bob; <I>K</I> is just used as a key-exchange key.</P>
<P>Look at the levels of protection EKE provides. A recovered value of <I>S</I> gives Eve no information about <I>P,</I> because <I>P</I> is never used to encrypt anything that leads directly to <I>S.</I> A cryptanalytic attack on <I>K</I> is also not feasible; <I>K</I> is used only to encrypt random data, and <I>S</I> is never encrypted alone.</P>
<P><FONT SIZE="+1"><B><I>Augmented EKE</I></B></FONT></P>
<P>The EKE protocol suffers from one serious disadvantage: It requires that both parties possess the <I>P.</I> Most password-based authentication systems store a one-way hash of the user’s password, not the password itself (see Section 3.2). The Augmented EKE (A-EKE) protocol uses a one-way hash of the user’s password as the superencryption key in the Diffie-Hellman variant of EKE. The user then sends an extra message based on the original password; this message authenticates the newly chosen session key.</P><P><BR></P>
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="22-02.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="22-04.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
[an error occurred while processing this directive]
</body></html>?? 快捷鍵說明
復(fù)制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號(hào)
Ctrl + =
減小字號(hào)
Ctrl + -