Cryptography Chapter 14. Learning Objectives Understand the basics of algorithms and how they are used in modern cryptography Identify the differences.

Cryptography

Chapter 14

Learning Objectives

Understand the basics of algorithms and how they are used in modern cryptography

Identify the differences between asymmetric and symmetric algorithms

Have a basic understanding of the concepts of cryptography and how they relate to network security

continued…

Learning Objectives

Discuss characteristics of PKI certificates and the policies and procedures surrounding them

Understand the implications of key management and a certificate’s lifecycle

Cryptography

Study of complex mathematical formulas and algorithms used for encryption and decryption

Allows users to transmit sensitive information over unsecured networks

Can be either strong or weak

Cryptography Terminology

Plaintext Data that can be read without any manipulation

Encryption Method of disguising plaintext to hide its substance

Ciphertext Plaintext that has been encrypted and is an unreadable

series of symbols and numbers

How Encryption and Decryption Work

Algorithms

Mathematical functions that work in tandem with a key

Same plaintext data encrypts into different ciphertext with different keys

Security of data relies on: Strength of the algorithm Secrecy of the key

Hashing

Method used for verifying data integrity Uses variable-length input that is

converted to a fixed-length output string (hash value)

Symmetric versus Asymmetric Algorithms

Type of Algorithm

Advantages Disadvantages

Symmetric Single key Requires sender and receiver to agree on a key before transmission of data

Security lies only with the key

High cost

Asymmetric Encryption and decryption keys are different

Decryption key cannot be calculated from encryption key

Security of keys can be compromised when malicious users post phony keys

Symmetric Algorithms

Usually use same key for encryption and decryption

Encryption key can be calculated from decryption key and vice versa

Require sender and receiver to agree on a key before they communicate securely

Security lies with the key Also called secret key algorithms, single-key

algorithms, or one-key algorithms

Encryption Using aSymmetric Algorithm

Categories of Algorithms

Stream algorithms Operate on the plaintext one bit at a time

Block algorithms Encrypt and decrypt data in groups of bits,

typically 64 bits in size

Asymmetric Algorithms

Use different keys for encryption and decryption

Decryption key cannot be calculated from the encryption key

Anyone can use the key to encrypt data and send it to the host; only the host can decrypt the data

Also known as public key algorithms

Common Encryption Algorithms

Lucifer (1974) Diffie-Hellman

(1976) RSA (1977) DES (1977)

Triple DES (1998) IDEA (1992) Blowfish (1993) RC5 (1995)

Primary Functions of Cryptography

Confidentiality Authentication Integrity Nonrepudiation

Digital Signatures

Based on asymmetric algorithms, allow the recipient to verify whether a public key belongs to its owner

Certificates

Credentials that allow a recipient to verify whether a public key belongs to its owner Verify senders’ information with identity

information that is bound to the public key Components

Public key One or more digital signatures Certificate information (eg, user’s name, ID)

Public Key Infrastructure (PKI) Certificates

Certificate storage facility that provides certification management functionality (eg, ability to issue, revoke, store, retrieve, and trust certificates)

Certification authority (CA) Primary feature of PKI Trusted person or group responsible for issuing

certificates to authorized users on a system Creates certificates and digitally signs them using a

private key

PKI Policies and Practices

Validity establishes that a public key certificate belongs to its owner

CA issues certificates to users by binding a public key to identification information of the requester

User can manually check certificate’s fingerprint

PKI Revocation

Certificates have a restricted lifetime; a validity period is created for all certificates

Certificate revocation list (CRL) Communicates which certificates within a PKI

have been revoked

Trust Models

Techniques that establish how users validate certificates Direct trust Hierarchical trust Web of trust

Direct Trust Model

User trusts a key because the user knows where it came from

Hierarchical Trust Model

Based on a number of root certificates

Web of Trust

Combines concepts of direct trust and hierarchical trust

Adds the idea that trust is relative to each requester

Central theme: the more information available, the better the decision

Key and Certificate Life Cycle Management

Setup or initialization Administration of issued keys and

certificates Certificate cancellation and key history

Setup and Initialization

Registration Key pair generation Certificate creation Certificate distribution Certificate dissemination Key backup

Registration

User requests certificate from CA CA verifies identity and credentials of user Certificate practice statement

Published document that explains CA structure to users

Certificate policy establishes: Who may serve as CA What types of certificates may be issued How they should be issued and managed

Key Pair Generation

Involves creation of one or more key pairs using different algorithms

Dual or multiple keys are often utilized to perform different roles to support distinct services

Key pair can be restricted by policy to certain roles based on usage factors

Multiple key pairs usually require multiple certificates

Certificates

Distinguished name (DN) Unique identifier that is bound to a certificate

by a CA Uses a sequence of character(s) that is unique

to each user Appropriate certificate policies govern

creation and issuance of certificates

Certificate Dissemination Techniques

Securely make certificate information available to requester without too much difficulty Out-of-band distribution In-band distribution Publication Centralized repositories with controlled access

Key Backup

Addresses lost keys Helps recover encrypted data Essential element of business continuity

and disaster recovery planning

Key Escrow

Key administration process that utilizes a third party

Initialization phase involves: Certificate retrieval and validation Key recovery and key update

Cancellation Procedures

Certificate expiration Certificate revocation Key history Key archive

Certificate Expiration

Occurs when validity period of a certificate expires

Options upon expiration Certificate renewal Certificate update

Certificate Revocation

Implies cancellation of a certificate prior to its natural expiration

Revocation delay Delay associated with the revocation

requirement and subsequent notification

Certificate Revocation

How notification is accomplished Certificate revocation lists (CRLs) CRL distribution points Certificate revocation trees (CRTs) Redirect/Referral CRLs

Notification is unnecessary for: Short certificate lifetimes Single-entity approvals

Key History

Deals with secure and reliable storage of expired keys for later retrieval to recover encrypted data

Applies more to encryption keys than signing keys

Key Archive

Service undertaken by a CA or third party to store keys and verification certificates

Meets audit requirements and handles resolution of disputes when used with other services (eg, time stamping and notarization)

Setting up an Enterprise PKI

Extremely complex task with enormous demands on financial, human, hardware, and software resources

Areas to explore Basic support Training Documentation issues

Areas to Explore in Detail When Setting up an Enterprise PKI

Support for standards, protocols, and third-party applications

Issues related to cross-certification, interoperability, and trust models

Multiple key pairs and key pair uses How to PKI-enable applications and client-

side software availability

continued…

Areas to Explore in Detail When Setting up an Enterprise PKI

Impact on end user for key backup, key or certificate update, and nonrepudiation services

Performance, scalability, and flexibility issues regarding distribution, retrieval, and revocation systems

Physical access control to facilities

Chapter Summary

Ways that algorithms and certificate mechanisms are used to encrypt data flows

Concepts of cryptography Key and certificate life cycle management