How Secure Works Stephen Smith | November 27, 2013

Outline  Why Should I Secure My ?  Encryption  Authentication  Key Exchange  Summary  Questions

Why Should I Secure My ? AKA “Why should you not?”

Why Should I Secure My ?  contains some of our most closely guarded secrets  What we order from Amazon  What newsletters we subscribe to  Who we correspond with, and what we say to them  It’s perfectly fine to be an open book  But why not demand control of who you share with?

Why Should I Secure My ?  In business, the case is even more obvious  Competitors want your data Subject: Totally Awesome Idea We Sure Hope Nobody Steals Subject: Insider Knowledge That Would Totally Tank Our Stock If It Were Released Today Subject: Current Salary And Benefits Package For Employee Our Competitors Want To Poach

Encryption Making sure the message can’t be read

Encryption  Two different types  Symmetric and Public-Key  Symmetric  What most people think of  Password A to encrypt, Password A to decrypt  The problem with using this for  Everyone who can encrypt messages to you can also decrypt every message sent to you  Bad things.

Public-Key Cryptography  Message is encrypted with public key  Closing the padlock  Message is decrypted with private key  Literal key to lock  Many can encrypt  Only one can decrypt

Authentication Making sure the message REALLY came from them

Authentication  Reverse of encryption process  Encrypt with private key  Decrypt with public key  Adds no security  But proves you touched the message

Key Exchange AKA, “How do you send the keys securely, smart guy?”

Key Exchange  If encryption depends on keys, how do you send the keys?  Encrypt them, of course!  Wait…

Diffie-Hellman-Merkle Protocol  We each buy two jugs of paint from Home Depot  One common colour we’ve agreed on  One secret colour only we know about  We go home, mix the two colours, and send half our mixture to each other  We then mix each half together in our own houses  We are now guaranteed to have the same colour, without ever communicating it  This is why I love crypto. So cool!

Summary

 Message is encrypted with receiver’s public key  Message is signed with sender’s private key  Message is transmitted  Message authenticity and integrity are checked with sender’s public key  Message is decrypted with receiver’s private key

Questions?