McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Chapter 29 Internet Security

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 CONTENTS INTRODUCTION PRIVACY DIGITAL SIGNATURE SECURITY IN THE INTERNET APPLICATION LAYER SECURITY TRANSPORT LAYER SECURITY: TLS SECURITY AT THE IP LAYER: IPSEC FIREWALLS

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 INTRODUCTION 29.1

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-1 Aspects of security

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 PRIVACY 29.2

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-2 Secret-key encryption

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 In secret-key encryption, the same key is used by the sender (for encryption) and the receiver (for decryption). The key is shared.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Secret-key encryption is often called symmetric encryption because the same key can be used in both directions.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Secret-key encryption is often used for long messages.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 We discuss one secret-key algorithm in Appendix E.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 KDC can solve the problem of secret-key distribution.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-3 Public-key encryption

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Public-key algorithms are more efficient for short messages.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 A CA can certify the binding between a public key and the owner.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-4 Combination

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 To have the advantages of both secret-key and public-key encryption, we can encrypt the secret key using the public key and encrypt the message using the secret key.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 DIGITAL SIGNATURE 29.3

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-5 Signing the whole document

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Digital signature cannot be achieved using only secret keys.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Digital signature does not provide privacy. If there is a need for privacy, another layer of encryption/decryption must be applied.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-6 Signing the digest

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-7 Sender site

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-8 Receiver site

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 SECURITY IN THE INTERNET 29.4

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 APPLICTION LAYER SECURITY 29.5

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure 29-9 PGP at the sender site

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure PGP at the receiver site

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 TRANSPORT LAYER SECURITY (TLS) 29.6

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Position of TLS

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Handshake protocol

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 SECURITY AT THE IP LAYER (IPSec) 29.7

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Authentication

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Header format

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure ESP

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure ESP format

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 FIREWALLS 29.8

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Firewall

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Packet-filter firewall

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 A packet-filter firewall filters at the network or transport layer.

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 Figure Proxy firewall

McGraw-Hill©The McGraw-Hill Companies, Inc., 2000 A proxy firewall filters at the application layer.