Tools and Techniques of Encryption Jeremy Malcolm A presentation to WASCAL on 29 May 1996

Introduction n Encryption ensures security of computer- based information n Security includes privacy and authentication n Trade-off between security and convenience n If tools are used incorrectly, security may be lost

Agenda n Importance of encryption n Applications for encryption n Principles and protocols – Secret key versus public key encryption – PGP – Other encryption standards n Using encryption tools

Importance of encryption n Lawyers have a duty to keep clients’ information confidential n messages are more like postcards than sealed letters n Using encryption for all your avoids drawing attention to confidential n Cost-benefit analysis

Applications for encryption n n Secure electronic transactions – World Wide Web (Secure Sockets Layer) eg. Netscape and Internet Explorer v.2 – Proprietary systems eg. home banking, MSN n Office equipment – DES telephones, faxes, digital mobile phones n Confidential documents in the office

Encryption in the office n Built-in encryption gives poor security – $US185 package cracks encryption schemes of WordPerfect, Lotus 1-2-3, Symphony, Quattro Pro, Paradox, Excel and MS Word 2.0 n Lotus Notes – Secret key encryption for Notes documents n Key can be made distributable or non-distributable – Public key encryption for Notes mail n Microsoft Exchange fax encryption

Principles and protocols n Public key encryption n Secret key (symmetric, conventional, password, single key) encryption n USA export controls – Some encryption software unavailable here – International Netscape substantially less secure – Phil Zimmerman prosecution

What is public key encryption? SenderRecipient public key Distribute public key Encrypt with recipient’s public key/s public key Sign with private key Verify signature with sender’s public key Decrypt message with private key

Authentication without encryption n Create a hash (checksum) for the plaintext n Encrypt the hash with your private key n This “signature” can be authenticated only with your public key From alt.security.pgp: “I am a practicing attorney in Colorado with clients in other states and in Canada, and I use e- mail to communicate with many of them. Having a verified PGP signature on from me tells the clients that the message really comes from me and that any advice or instructions contained in the is advice or instructions that I want them to follow. Hopefully, they trust me enough to do so. :-)”

Public Keys -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzDmHn0AAAEDAMzvMfAQYj2AGd6dV/ctqtKj2grlDrWW8R9B2vSe8w2lZDqb r+/msS/UvSci79vxHmppkOvKVFhCdcI9yRcsFL5BNrJf5zLTKUVZVcUhIWQXF4Db //2HwEe/5gZYw9iQAQAFEbQxSmVyZW15IE0uIE1hbGNvbG0gPHRlcm1pbnVzQG9k eXNzZXkuYXBhbmEub3JnLmF1Pg== =liEN -----END PGP PUBLIC KEY BLOCK----- n Obtained through: – , finger, WWW – Key servers – Automatic for WWW browsers

PGP - Pretty Good Privacy n De facto Internet standard n Offers public key and secret key encryption n Not an program n Variants – Freeware – Commercial: “Viacrypt” – Restricted export – International

Other encryption standards n PEM - Privacy Enhanced Mail – De jure standard (RFCs ) – Easier to integrate into third party products – Relies on hierarchy of Certifying Authorities – RIPEM - Riordan’s Internet Privacy Enhanced Mail n Less widely used than PGP n Illegal to export outside USA – TIS/PEM - Trusted Information System PEM

DES ( Data Encryption Standard) – Conventional encryption (secret key only) – Fast – Available for office equipment – Built in to application software – No longer considered sufficiently secure n Triple DES Other encryption standards

Using encryption tools n Secret key encryption requires a secure channel n “Add-ins” – Microsoft Exchange PGP add-in – Eudora, Pegasus Mail add-ins available n Stand-alone products – Power PGP (freeware) – Numerous others available

Dangers and limitations n Compromised passphrase and secret key – Remember the passphrase – Keep the key on a floppy disk n Exposure on multi-user systems – Don’t keep your secret key on such a system n Obvious passwords n Physical security breaches – Don’t save or print out plaintext

Dangers and limitations n Public key tampering – Certification by PGP signature n Bogus timestamps – Timestamping service or PGP signature n "Not quite deleted" files – Ensure software wipes plaintext files n Viruses and Trojan Horses – Anti-viral software

Summary n Security for electronic information – “Armoured van” for communications – “Safety deposit box” for documents n Less convenient to work with than plaintext, but effective if proper safeguards are taken n Encryption for Lawyers n Question time