Cryptography Encryption/Decryption Franci Tajnik CISA Franci Tajnik

CISA 2002 Franci Tajnik cryptographic system u cryptographic algoritm ( math. function) u keys ( word, number, phrase ) u protokol u convert plain text to cipher text

CISA 2002 Franci Tajnik Symmetric method DES Cipher text Plaintext Symetric Key Sender Receiver Plaintext Cipher text

CISA 2002 Franci Tajnik Asymmetric Key Generation Seed Data Generation Program Secret Key Public Key Asymmetric Relationship

CISA 2002 Franci Tajnik Asymmetric method RSA Cipher text Plaintext Sender Receiver Plaintext Cipher text Public Private Secrecy

CISA 2002 Franci Tajnik Asymmetric method RSA Authentication Cipher text Plaintext Sender Receiver Plaintext Cipher text Public Private Plaintext

CISA 2002 Franci Tajnik PGP princip Plaintext Sender Receiver Plaintext Public Private One time Session key Encry. Session key Cipher text Encry. Session.key Cipher text Encry. Session key

CISA 2002 Franci Tajnik Digital signatures Cipher text Plaintext Sender Receiver Plaintext Cipher text Public Private

CISA 2002 Franci Tajnik Digital signature Plaintext Sender Receiver Public Private message digest 160 hash signature Plaintext signature Plaintext message digest 160 hash message digest 160

CISA 2002 Franci Tajnik Digital signature Plaintext Sender Receiver Private S message digest 160 hash signature Plaintext signature Plaintext message digest 160 hash message digest 160 Public R Private R Public S

CISA 2002 Franci Tajnik security Plaintext Sender Receiver Private S message digest 160 hash signature Plaintext signature Plaintext message digest 160 hash message digest 160 Public R Private R Public S One time Session key Dec.SESS. K e Y ENC.SESS. K E Y

CISA 2002 Franci Tajnik Certification Authority Registration Authority Holder Certificate information Public Holder CA Digital signature Private Public Holder Digital certificate RA

CISA 2002 Franci Tajnik Digital signature Plaintext Sender Receiver Private S message digest 160 hash signaturePlaintext signaturePlaintext message digest 160 hash message digest 160 Public R Private R Dig.cert. CAS

CISA 2002 Franci Tajnik Certification Authority n software for issue the certificates n creates certificates n digitaly signs certificate Registration Authority n people, processes, tools n administration of users

CISA 2002 Franci Tajnik Problems n Do you trust the certification company? n What validation process does the company undertake to ensure that an entity is who they claim to be before issuing a certificate? n Who certifies the Certification Authority?

CISA 2002 Franci Tajnik Certification Process Certification Authority User Verifies Credentials Creates Certificate Generates Key Set Presents Public Key and Credentials Receives Certificate Public Distribution

CISA 2002 Franci Tajnik Requirements for a CA n Outstanding integrity - recognised by others n Financial backing to cover potential liabilities

CISA 2002 Franci Tajnik Requirements of a CA n Physically secure environment n Tamper resistant modules for its cryptographic processing n Ability to generate key pairs n Random number generator n Ability to check signatures n Ability to sign certificates

CISA 2002 Franci Tajnik Requirements of a CA n Software to support all certificate formats n Clear security policy n Secure, auditable procedures for certificate production n Directory of certificates (including archived certificates)

CISA 2002 Franci Tajnik PGP certificate format n PGP version number n certificate holders public key n certificate holders information n digital signature of certificate owner u using holders private key (self signature) n certificate validity period n encryption algorrthm

CISA 2002 Franci Tajnik X.509 certificate format n X.509 version number n certificate holders public key n serial number of certificate n certificate holders unique identifier n certificate validity period n unique name of CA n digital signature of CA n signature algorithm

CISA 2002 Franci Tajnik Cross Verification Where there is more than one Certification Authority there must be a way of relying on certificates provided by other Certification Authorities Where there is more than one Certification Authority there must be a way of relying on certificates provided by other Certification Authorities

CISA 2002 Franci Tajnik Conclusions n The auditor has to accept the integrity of the underlying algorithms n The role of the Certification Authority is critical to the operational process n Certification Authorities will be the key to the entire Public Key Infrastructure (PKI) process