Computer and Network Security
CS494/594            Class 3   9/12/06

Topics

• passwords and authentication protocols
• hash functions (MD5, SHA)
• lecture slides (pdf)

Required reading

• Text: 18.3, 11, 12.1, 12.3, 13.2
• Lamport paper Password authentication with insecure communication
• Smart card-based identity and access management white paper
• Improving the Security of your site by breaking into it
• Stoll's Stalking the Wily Hacker
• introduce yourself to the OpenSSL commands and crypto lib, OpenSSL documents and a how to

Additional reading

• There Be Dragons
• password cracking software and john the ripper or windows password cracker
• S/key ISOC paper (postscript, 74K)
• RFC1760 and RFC1938
• SecurID or SafeWord and paper Event-synchronous tokens versus time-dependent tokens
• smartcard login for windows white paper
• Verisign USB OTP/PKI dongle or FORTEZZA card or DoD common access smart card and paper
• cryptocard

  hashing

• MD5 animated applet padding demo
• recent attacks on MD5 and SHA-1 8/19/04 and SHA-1 broken 2/17/05 and MD5 collision example files and and collision exploit and colliding X.509 certificates and MD5 collision source code
• the hashing function lounge
• Performance Analysis of MD5 and RFC 1810
• MD5 RFC1321 and MD5 analysis and MD5 collisions
• Message Authentication with MD5
• MD2 RFC1319
• RFC 2104 HMAC: Keyed-Hashing for Message Authentication
• Bellare's Keying hash functions for message authentication HMAC info
• B. Preneel and P. van Oorschot, Building fast MACs from hash functions truncated HMAC
• UMAC fast and provably secure message authentication
• Bellare's XOR MAC paper on fast hashing
• MD5 and SHA-0 collisions
• Cryptanalysis of the Alleged SecurID Hash Function
• FIP 180-1 SHA
• ripemd 160
• OpenSSL crypto lib hash, HMAC functions
• panama or whirlpool
• tiger hash function (64-bit efficient)
• Java java.security.MessageDigest MD5 and SHA
• MAC's based on encryption functions CBC MAC and FIPS 113 or CMAC or NIST 800-38B
• speed comparison of hash functions, CRCs, encryption ....
• as always, cruise the security page