lesson 12 cryptography for e-commerce. approaches to network security separate security...
Post on 18-Dec-2015
216 views
TRANSCRIPT
Approaches to Network Security
• Separate Security Protocol--SSL
• Application-Specific Security--SHTTP
• Security with Core Protocols--IPsec
• Parallel Security Protocol--Kerberos
The TCP connection(“3-way Handshake”)
client ServerSYN
Client sends connection request,Specifying a port to connect toOn the server.
client ServerSYN/ACK
Server responds with both anacknowledgement and a queuefor the connection.
client ServerACK
Client returns an acknowledgementand the circuit is opened.
SSL in ActionCLIENT SERVER
1ClientHello
2ServerHello
3ServerKey Exchange
4ServerHelloDone
5
ClientKey Exchange
6ChangeCiperSpec
7Finished
SSL in ActionCLIENT SERVER
4ServerHelloDone
5
ClientKey Exchange
6ChangeCiperSpec
7Finished
8ChangeCipherSpec
9 Finished
PROTOCL COMPARISONS
• Separate Protocol
• Application Protocol
• Integrated with Core
• Parallel Protocol
A B C D E
A - Full securityB - Multiple ApplicationsC - Tailored Services
D - Transparent to ApplicationsE - Easy to Deploy
What is Cryptography
• Protecting information by transforming it into an unreadable format
• Encryption is the process that transforms the data into the unreadable format, Decryption restores it to its original format.
• Used to prevent information from “falling into the wrong hands”
• Data is only available to the people that are supposed to see it
Uses of Cryptography
Use
Keeping Secrets
Providing Identity
Verifying Info
Service
Confidentiality
Authentication
Message Integrity
Protects Against
Eavesdropping
Forgery & Masquerade
Alteration
Cryptography in Use Today
• SSL -- Secure Socket Layer• TLS -- Transport Layer Security protocol• IPsec -- Internet Protocol Security• SET -- Secure Electronic Transactions • Smart Cards• VPN -- Virtual Private Network• File or Disk Encryption Tools• Remote access: SSH -- Secure Shell • Digital Signature Algorithm -- DSA• EMAIL: PGP -- Pretty Good Privacy• PKI -- Public Key Infrastructure
Cryptographic Classifications
• Secret Key Cryptography– Symmetric Encryption– All Parties have same key
• Public Key Cryptography– Asymmetric Encryption– Different Keys: public and private
Secret Key CryptographySymmetric Encryption
Professor Student
Step 4- Decipher with secret key
Step 3 - Send Encrypted Message
Step 2-Encipher with secret key
Step 1- Secret Key Exchange occurs
Secret Key Cryptography
• PROs:– Very Secret– Key Size Determines how hard to break
• CONs:– Key Management is a Burden– Cryptography can be slow
Symmetirc Encrpytion Algorithms
• DES Data Encryption Standard• 3DES Triple-Strength DES• RC2 Rivest Cipher 2• RC4 Rivest Cipher 4
All commonly used with SSL
Public Key Cryptography
• Digital Signatures and Public Key Encryption– Message encrypted or signed with private key of
sender and public key of recipient– Recipient decrypts with own private key and
sender’s public key– Only sender has the right private key so if it
decrypts it must have come from the sender– NOTE: Assumes keys have not been compromised
Public Key CryptographyAsymmetric Encryption
Step 1- Create Public and Private Keys
Professor Student
Step 3- Encipher with public Key
Step 2 - Send Public Key to Student
Step 4 -Send Encrypted Message
Step 5- Decipher with private key
Public Key Cryptography
• PROs:– As Shown this Proves Identity– This Results in a Digital Signature
• Used to authenticate digital material• Prove identity and validity of action or material
• CONs:– Burdensome if you need widespread use
Combining the Best of Both
Professor StudentStep 1- Create Public and Private Keys
Step 1- Generatea Secret Key
Step 2 - Send Public Key to Student
Step 4 -Send Encrypted Message
Step 5- Decipher with private keyand retrieve secret key
Step 3- EncipherSecret Key with Public Key
Uses of Public Key Cryptography
• Digital Signatures– Used to authenticate digital material– Prove identity and validity of action or
material
• Transmission of symmetric key (public key encryption is generally slower)
Public Key Infrastructure
The Mainstream method (using public key cryptography ) by which to ensure key management and reliable authentication and encryption between two objects that are communicating over a single open network
Public Key Infrastructure
Purpose: provide an environment that addresses today’s business, legal, network, and security demands for trust and confidentiality
Environment: policies, protocols, services and standards that support public key cryptogrpahy
Public Key Infrastructure
Provides: – Strong user identification– Cryptographic Services– Evidence for non-repudiation among
strangers
Technology Components of PKI
• Keys: public and private• Certificate Authority (CA)
– Responsible trusted 3rd party that issues, revokes, and manages digital certificates
• Registration Authority (RA)– Optional entity implicity trusted by a CA to
validate another entity’s indentity prior to the CA issuing a digital certificate
– Usually needed in large PKI deployments
Technology Components of PKI
• Digital Certificates– Fundamental to PKI– Credentials issued to an entity that
uniquely identifies the entity for all others– The credentials act like a “passport”– Digital Certificates contain the entity’s
public key
Technology Components of PKI
• Repository– The workhorse of PKI– Stores certificates and entity information– Provides lookup and retrieval services to
an enterprise– Also handles certificate revocation list
(CRL) checking
Other Components of PKI
• Policy Management Authority (PMA) – Policy Approval Authority
• Develops governing policy for PKI
– Policy Creation Authority (PCA)• Implements PKI policy through CA
establishment
PKI Policy
• Primary PKI Policies– Certificate Policy (CP)
• What the PKI environment does• Publicly available document• Policy Approval Authority
– Certification of Practice Statement(CPS)• How the PKI environment does it• Details the functions of the PKI• Internal document
PKI in ActionCertificate Authority
Certificate Repository
ME YOU
Generate Keys
Generate Keys
Register with CA Register with CA
DigitalCertificatesReturned
PKI in ActionCertificate Authority
Certificate Repository
ME YOU
Encrypt With
Private Key
Decrypt With
Public Key
Send Encrypted Message
Request/GetDigitalCertificate