“Secure” is not one property but four, and this short section names all four so that the rest of the chapter can deliver them one at a time.
Words you will meet
-
Alice, Bob and Trudy — the sender, the receiver, and the intruder. They appear on every page of this chapter.
-
Confidentiality confidentiality Simple Only the two of you can understand what was sent. Precise Only the sender and the intended receiver should be able to understand the contents of a transmitted message. Because eavesdroppers may intercept it, this requires the message to be encrypted so that an intercepted copy cannot be understood. introduced in ch. 8 — open in glossary — only the sender and the intended receiver can understand the message.
-
Message integrity message integrity Simple What arrives is exactly what was sent, and any change is detected. Precise The property that the content of a communication is not altered in transit, either maliciously or by accident. It is provided by extensions to the checksumming techniques already used in reliable transport and link-layer protocols. introduced in ch. 8 — open in glossary — the content did not change on the way.
-
End-point authentication end-point authentication Simple Proving that a message really came from the sender it claims to come from. Precise A mechanism that allows a receiver to determine with certainty whether a message originates from where it appears to originate. introduced in ch. 1 — open in glossary — each party can confirm who the other one is.
-
Operational security — protecting a whole organisation’s network, rather than one conversation.
-
Eavesdropping — listening to and recording what crosses the channel, without changing it.
Why this matters
Section 1.6 listed the attacks: malware, denial of service, packet sniffing, masquerading, message modification. It then said that the answers would come later, and this is later.
This page is where “later” becomes a plan. Each of the four properties named here is answered by a specific section. Once you can name which property a mechanism provides, the whole chapter stops being a list of protocols.
Read the grid below as the chapter’s table of contents, because that is what it is.
Two people, one channel, and somebody in the middle
The whole chapter runs on one scenario, and it is worth fixing in your mind now because it never changes.
Alice wants to send data to Bob. They exchange control messages and data messages, in much the same way that a TCP (Transmission Control Protocol) Transmission Control Protocol The Internet transport protocol that delivers data reliably and in order, with flow control and congestion control. introduced in ch. 1 sender and receiver exchange control segments and data segments. All or some of those messages will normally be encrypted.
Trudy is the intruder, and she sits on the channel between them.
Drag any device to rearrange the picture. Hover a link to see its rate, delay and length.
Play the three journeys in order. Only the second and third differ from an ordinary transfer, and notice that the first of those puts nothing at all onto the channel — which is why eavesdropping is so hard to detect.
Read this diagram as text
- Alice — the secure sender — wired link — Bob — the secure receiver
- Trudy — the intruder — wired link — Alice — the secure sender
- Trudy — the intruder — wired link — Bob — the secure receiver
Alice and Bob are not necessarily people. The book is explicit that they could be two routers exchanging routing tables, a client and a server establishing a secure transport connection, or two e-mail applications. All three appear later in this chapter as case studies.
Everyday picture — a letter and a postal worker
Alice posting a letter to Bob passes it through many hands she does not know. Any of them could steam it open and read it, replace the page inside, or throw it away and post their own letter signed with Alice’s name.
Sealing the envelope well makes it hard to read. It does not stop someone replacing the whole letter, and it does not prove who wrote it.
Where the picture breaks. A postal worker who opens a letter leaves physical traces, and stealing one letter takes as long as stealing one letter. On a network, copying a message leaves nothing behind and copying a million costs almost nothing more than copying one.
What Trudy can actually do
The book gives the intruder exactly two capabilities, and everything else follows from them.
She can eavesdrop: sniff and record the control and data messages crossing the channel.
She can modify, insert or delete messages, or the content inside them.
That is a short list, and it is worth noticing how much damage it permits. With those two abilities and no countermeasures, an intruder can do a great deal. She can snoop on a conversation and possibly steal passwords and data. She can impersonate another entity, or take over a session that is already running. She can deny service to legitimate users by overloading the resources they need.
In plain words
Trudy does not need to break into a computer. She only needs to be somewhere on the path.
That is the assumption this whole chapter is built on, and it is why the answers are cryptographic rather than physical. You cannot keep Trudy off the wire, so instead you make what she finds there useless to her.
The four properties
| Confidentiality§8.2 | Message integrity§8.3 | End-point authentication§8.4 | Operational security§8.9 | |
|---|---|---|---|---|
| What Alice and Bob want | ||||
| What goes wrong without it | ||||
| The tool that provides it | ||||
| Who is being protected |
Cells marked ⓘ have a reason behind them — click to read it.
This grid is the chapter's table of contents. Each property names a thing that can go wrong, and the section that fixes it. Click any cell.
Read the bottom row of that grid carefully. Three of the four properties are about one conversation between two parties. The fourth is about an organisation and its boundary, and it is a different subject that happens to live in the same chapter.
That is why operational security waits until section 8.9. Every tool the first three properties need has to be built first.
Who else needs this, besides two lovers
The book uses Alice and Bob because their names are more fun than “A” and “B”, and it admits as much. But it makes a serious point immediately afterwards.
The parties needing secure communication are often the network infrastructure itself. The domain name system of section 2.4 needs it. So do the routing daemons of chapter 5 that exchange routing information, and the network management functions of section 5.7.
An intruder able to interfere with DNS lookups, routing computations or network management could, in the book’s words, wreak havoc in the Internet. Those attacks do not read anybody’s love letters. They break the network.
The mental model
One channel, two honest parties, and one intruder who can hear everything and change anything.
Against that, four things to want. Secrecy of the contents. Certainty that they did not change. Certainty about who is at the other end. And a defended boundary around the organisation. The first three are properties of a conversation. The fourth is a property of a network.
Every remaining section of this chapter delivers one of those four, and nothing else.
Check yourself
Check yourself
0 of 5 answered1.Which of the four properties is not a property of a single conversation between two parties?
2.The book gives the intruder exactly two capabilities. What are they?
3.predictIn the figure, you play the eavesdropping journey. How many arrows leave Trudy toward the channel?
4.Alice and Bob need not be people. Which of these does the book name as a pair needing secure communication?
5.Why does the book link message integrity to the checksums you already know?
What to remember
-
“Secure” is four separate properties, not one. Confidentiality, message integrity, end-point authentication, operational security — and a mechanism that provides one of them usually provides none of the others.
-
The intruder is given exactly two powers: listening, and changing. Every attack in the chapter — impersonation, session hijacking, denial of service — is built from those two, which is why the defences are cryptographic rather than physical.
-
Three of the four properties are about a conversation; operational security is about a boundary. That difference is why firewalls wait until the end of the chapter, and why they need none of the cryptography that precedes them.