Cryptography Chapter 14

Learning Objectives Understand the basics of algorithms and how they are used in modern cryptography Identify the differences between asymmetric and symmetric algorithms Have a basic understanding of the concepts of cryptography and how they relate to network security continued…

Learning Objectives Discuss characteristics of PKI certificates and the policies and procedures surrounding them Understand the implications of key management and a certificate’s lifecycle

Cryptography Study of complex mathematical formulas and algorithms used for encryption and decryption Allows users to transmit sensitive information over unsecured networks Can be either strong or weak

Cryptography Terminology Plaintext  Data that can be read without any manipulation Encryption  Method of disguising plaintext to hide its substance Ciphertext  Plaintext that has been encrypted and is an unreadable series of symbols and numbers

How Encryption and Decryption Work

Algorithms Mathematical functions that work in tandem with a key Same plaintext data encrypts into different ciphertext with different keys Security of data relies on:  Strength of the algorithm  Secrecy of the key

Hashing Method used for verifying data integrity Uses variable-length input that is converted to a fixed-length output string (hash value)

Symmetric versus Asymmetric Algorithms Type of Algorithm AdvantagesDisadvantages SymmetricSingle keyRequires sender and receiver to agree on a key before transmission of data Security lies only with the key High cost AsymmetricEncryption and decryption keys are different Decryption key cannot be calculated from encryption key Security of keys can be compromised when malicious users post phony keys

Symmetric Algorithms Usually use same key for encryption and decryption Encryption key can be calculated from decryption key and vice versa Require sender and receiver to agree on a key before they communicate securely Security lies with the key Also called secret key algorithms, single-key algorithms, or one-key algorithms

Encryption Using a Symmetric Algorithm

Categories of Algorithms Stream algorithms  Operate on the plaintext one bit at a time Block algorithms  Encrypt and decrypt data in groups of bits, typically 64 bits in size

Asymmetric Algorithms Use different keys for encryption and decryption Decryption key cannot be calculated from the encryption key Anyone can use the key to encrypt data and send it to the host; only the host can decrypt the data Also known as public key algorithms

Common Encryption Algorithms Lucifer (1974) Diffie-Hellman (1976) RSA (1977) DES (1977) Triple DES (1998) IDEA (1992) Blowfish (1993) RC5 (1995)

Primary Functions of Cryptography Confidentiality Authentication Integrity Nonrepudiation

Digital Signatures Based on asymmetric algorithms, allow the recipient to verify whether a public key belongs to its owner

Certificates Credentials that allow a recipient to verify whether a public key belongs to its owner  Verify senders’ information with identity information that is bound to the public key Components  Public key  One or more digital signatures  Certificate information (eg, user’s name, ID)

Public Key Infrastructure (PKI) Certificates Certificate storage facility that provides certification management functionality (eg, ability to issue, revoke, store, retrieve, and trust certificates) Certification authority (CA)  Primary feature of PKI  Trusted person or group responsible for issuing certificates to authorized users on a system  Creates certificates and digitally signs them using a private key

PKI Policies and Practices Validity establishes that a public key certificate belongs to its owner CA issues certificates to users by binding a public key to identification information of the requester User can manually check certificate’s fingerprint

PKI Revocation Certificates have a restricted lifetime; a validity period is created for all certificates Certificate revocation list (CRL)  Communicates which certificates within a PKI have been revoked

Trust Models Techniques that establish how users validate certificates  Direct trust  Hierarchical trust  Web of trust

Direct Trust Model User trusts a key because the user knows where it came from

Hierarchical Trust Model Based on a number of root certificates

Web of Trust Combines concepts of direct trust and hierarchical trust Adds the idea that trust is relative to each requester Central theme: the more information available, the better the decision

Key and Certificate Life Cycle Management Setup or initialization Administration of issued keys and certificates Certificate cancellation and key history

Setup and Initialization Registration Key pair generation Certificate creation Certificate distribution Certificate dissemination Key backup

Registration User requests certificate from CA CA verifies identity and credentials of user Certificate practice statement  Published document that explains CA structure to users Certificate policy establishes:  Who may serve as CA  What types of certificates may be issued  How they should be issued and managed

Key Pair Generation Involves creation of one or more key pairs using different algorithms Dual or multiple keys are often utilized to perform different roles to support distinct services Key pair can be restricted by policy to certain roles based on usage factors Multiple key pairs usually require multiple certificates

Certificates Distinguished name (DN)  Unique identifier that is bound to a certificate by a CA  Uses a sequence of character(s) that is unique to each user Appropriate certificate policies govern creation and issuance of certificates

Certificate Dissemination Techniques Securely make certificate information available to requester without too much difficulty  Out-of-band distribution  In-band distribution  Publication  Centralized repositories with controlled access

Key Backup Addresses lost keys Helps recover encrypted data Essential element of business continuity and disaster recovery planning

Key Escrow Key administration process that utilizes a third party Initialization phase involves:  Certificate retrieval and validation  Key recovery and key update

Cancellation Procedures Certificate expiration Certificate revocation Key history Key archive

Certificate Expiration Occurs when validity period of a certificate expires Options upon expiration  Certificate renewal  Certificate update

Certificate Revocation Implies cancellation of a certificate prior to its natural expiration Revocation delay  Delay associated with the revocation requirement and subsequent notification

Certificate Revocation How notification is accomplished  Certificate revocation lists (CRLs)  CRL distribution points  Certificate revocation trees (CRTs)  Redirect/Referral CRLs Notification is unnecessary for:  Short certificate lifetimes  Single-entity approvals

Key History Deals with secure and reliable storage of expired keys for later retrieval to recover encrypted data Applies more to encryption keys than signing keys

Key Archive Service undertaken by a CA or third party to store keys and verification certificates Meets audit requirements and handles resolution of disputes when used with other services (eg, time stamping and notarization)

Setting up an Enterprise PKI Extremely complex task with enormous demands on financial, human, hardware, and software resources Areas to explore  Basic support  Training  Documentation issues

Areas to Explore in Detail When Setting up an Enterprise PKI Support for standards, protocols, and third- party applications Issues related to cross-certification, interoperability, and trust models Multiple key pairs and key pair uses How to PKI-enable applications and client- side software availability continued…

Areas to Explore in Detail When Setting up an Enterprise PKI Impact on end user for key backup, key or certificate update, and nonrepudiation services Performance, scalability, and flexibility issues regarding distribution, retrieval, and revocation systems Physical access control to facilities

Chapter Summary Ways that algorithms and certificate mechanisms are used to encrypt data flows Concepts of cryptography Key and certificate life cycle management