1 Certification Issue : how do we confidently know the public key of a given user? Authentication : a process for confirming or refuting a claim of identity.

Slides:

Advertisements

Similar presentations

Chapter 10 Encryption: A Matter of Trust. Awad –Electronic Commerce 1/e © 2002 Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic Algorithm.

Advertisements

Smart Certificates: Extending X.509 for Secure Attribute Service on the Web October 1999 Joon S. Park, Ph.D. Center for Computer High Assurance Systems.

Chapter 14 – Authentication Applications

Authentication Applications. will consider authentication functions will consider authentication functions developed to support application-level authentication.

Cryptography and Network Security Chapter 14

CS5204 – Operating Systems 1 Authentication. CS 5204 – Operating Systems2 Authentication Digital signature validation proves:  message was not altered.

Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York.

Public Key Infrastructure (PKI)

1 Lecture 17: SSL/TLS history, architecture basic handshake session initiation/resumption key computation negotiating cipher suites application: SET.

COMP043-Cryptology Week 4 – Certs and Sigs. Digital Signatures Digital signatures provide –Integrity –Authenticity and –Non-repudiation How do they work?

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

Network Security Essentials Chapter 4

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Geneva, Switzerland, 2 June 2014 Introduction to public-key infrastructure (PKI) Erik Andersen, Q.11 Rapporteur, ITU-T Study Group 17 ITU Workshop.

Chapter 14 From Cryptography and Network Security Fourth Edition written by William Stallings, and Lecture slides by Lawrie Brown, the Australian Defence.

Authentication Cristian Solano. Cryptography is the science of using mathematics to encrypt and decrypt data. Public Key Cryptography –Problems with key.

HIT Standards Committee: Digital Certificate Trust – Policy Question for HIT Policy Committee March 29, 2011.

Public Key Infrastructure (PKI) Providing secure communications and authentication over an open network.

Apr 2, 2002Mårten Trolin1 Previous lecture On the assignment Certificates and key management –Obtaining a certificate –Verifying a certificate –Certificate.

An Authorization System for Grid Applications Thesis Presentation 5 th Dec 2006 Author: Wang Xiao Supervisor: Professor Heikki Hämmäinen Instructor: MSc.

WAP Public Key Infrastructure CSCI – Independent Study Fall 2002 Jaleel Syed Presentation No 5.

16.1 © 2004 Pearson Education, Inc. Exam Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure.

1 Key Establishment Symmetric key problem: How do two entities establish shared secret key in the first place? Solutions: Deffie-Hellman trusted key distribution.

1 Key Establishment Symmetric key problem: How do two entities establish shared secret key over network? Solution: trusted key distribution center (KDC)

CERTIFICATES “a document containing a certified statement, especially as to the truth of something ”

Copyright, 1996 © Dale Carnegie & Associates, Inc. Digital Certificates Presented by Sunit Chauhan.

CS682- Session 10 Prof. Katz. Well-Known Attacks By far the most common security vulnerabilities Attacks that Script-Kiddies are capable of performing.

Security Management.

Computer Science Public Key Management Lecture 5.

CSCI 6962: Server-side Design and Programming

Digital Certificates With Chuck Easttom. Digital Signatures  Digital Signature is usually the encryption of a message or message digest with the sender's.

Chapter 3 Mohammad Fozlul Haque Bhuiyan Assistant Professor CITI Jahangirnagar University.

Chapter 14 Encryption: A Matter Of Trust. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond,

SSL and https for Secure Web Communication CSCI 5857: Encoding and Encryption.

Digital Certificates Made Easy Sam Lutgring Director of Informational Technology Services Calhoun Intermediate School District.

Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.

Secure Socket Layer (SSL)

SSL / TLS in ITDS Arun Vishwanathan 23 rd Dec 2003.

Information Security Fundamentals Major Information Security Problems and Solutions Department of Computer Science Southern Illinois University Edwardsville.

National Institute of Advanced Industrial Science and Technology Self-audit report of AIST GRID CA Yoshio Tanaka Information.

Gregorio Martínez Pérez University of Murcia PROVIDING SECURITY TO UNIVERSITY ENVIRONMENT COMMUNICATIONS.

Cryptography Encryption/Decryption Franci Tajnik CISA Franci Tajnik.

Introduction to Secure Sockets Layer (SSL) Protocol Based on:

Unit 1: Protection and Security for Grid Computing Part 2

Certificate-Based Operations. Module Objectives By the end of this module participants will be able to: Define how cryptography is used to secure information.

CERTIFICATES. What is a Digital Certificate? Electronic counterpart to a drive licenses or a passport. Enable individuals and organizations to secure.

Digital Envelopes, Secure Socket Layer and Digital Certificates By: Anthony and James.

Attribute Certificate By Ganesh Godavari. Talk About An Internet Attribute Certificate for Authorization -- RFC 3281.

IST E-infrastructure shared between Europe and Latin America ULAGrid Certification Authority Vanessa Hamar Universidad de Los.

Certificate Requests to HIP Jani Pellikka 80 th IETF Mar 27 th – Apr 1 st 2011 Prague, Czech Republic.

X.509 Topics PGP S/MIME Kerberos. Directory Authentication Framework X.509 is part of the ISO X.500 directory standard. used by S/MIME, SSL, IPSec, and.

Security CNS 4650 Fall 2004 Rev. 2 SSL, SASL, PKI.

Cryptography and Network Security Chapter 14 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

Module 2: Introducing Windows 2000 Security. Overview Introducing Security Features in Active Directory Authenticating User Accounts Securing Access to.

Cryptography and Network Security Chapter 14

Key Management. Authentication Using Public-Key Cryptography  K A +, K B + : public keys Alice Bob K B + (A, R A ) 1 2 K A + (R A, R B,K A,B ) 3 K A,B.

Installing a SSL Server. Creating a key Before you can create a digital signature/certificate. You need first to create a private key. To do this process.

Mar 28, 2003Mårten Trolin1 This lecture Certificates and key management Non-interactive protocols –PGP SSL/TLS –Introduction –Phases –Commands.

Key Management and Distribution Anand Seetharam CST 312.

GRID-FR French CA Alice de Bignicourt.

NECTEC-GOC CA A Brief Status Report 13 th APGrid PMA Face-to-Face meeting March 24 th, 2014 Large-Scale Simulation Research Laboratory Information Communications.

The Secure Sockets Layer (SSL) Protocol

کاربرد گواهی الکترونیکی در سیستمهای کاربردی (امضای دیجیتال)

The Secure Sockets Layer (SSL) Protocol

Presentation transcript:

1 Certification Issue : how do we confidently know the public key of a given user? Authentication : a process for confirming or refuting a claim of identity. Certification : technical and administrative means of authenticating a user types: directory (PKIX/X.509) referral (PGP) collaborative (SKIP)

2 Kinds of Certificates Identity : maintains a binding between a users identify and a public key Revocation: nullifies a previously issued identify certificate Attribute: specifies “attributes” possessed by the holder of a given identity certificate Identity : maintains a binding between a users identify and a public key Revocation: nullifies a previously issued identify certificate Attribute: specifies “attributes” possessed by the holder of a given identity certificate

3 Identity Certificates

4 Elements of Public Key Infrastructure End entity NA name Key Source key pair (name, public key) NA - Name Authority (X.500) RA - Registration Authority CA - Certification Authority repository CARA name public key secure administrative environment certificate

5 An X.509v3 Certificate

6 Example Certificate Certificate: Data: Version: 3 (0x2) Serial Number: (0x10bf74) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=Client CA v1 Validity Not Before: Jul 31 14:07: GMT Not After : Jul 31 14:07: GMT Subject: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=Client CA v1, CN=Jeffrey I Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:cf:01:0a:e5:f1:3c:60:c1:f2:c1:ca:99:96:1d: 7d:39:97:8c:72:cf:e8:7c:51:a1:84:a4:5b:b8:b3: 3a:dc:dd:c5:99:76:cb:5d:b1:24:86:67:46:52:45: 69:09:fb:01:b0:dd:41:02:de:27:c2:b7:cd:b1:cd: 47:9a:ae:55:bb:83:cd:bd:c1:aa:2b:23:3d:85:06: e0:4a:6c:a8:af:b4:cb:64:ea:c9:33:f7:ef:a9:8f: d9:7a:20:68:a1:09:c4:4e:62:20:00:d1:fd:a5:7c: 14:90:48:79:a9:7d:ef:f5:46:b6:fb:4e:c5:fc:94: 8f:11:bf:1a:ef:7b:2d:06:ef Exponent: (0x10001) X509v3 extensions: X509v3 Key Usage: : 0....]/e.ii;....m......j....Nr....$wF..t...QZ... Signature Algorithm: md5WithRSAEncryption 30:4c:3b:a5:d8:11:e1:04:61:d2:39:ff:e1:74:c3:06:2f:3b: 52:59:9c:75:05:2e:31:cc:c3:99:5c:02:e5:67:bf:06:99:7f: c8:2a:5b:dd:bd:67:a5:a7:98:74:14:44:a7:db:76:19:9c:80: 0a:58:1d:53:35:d0:75:82:9d:2a:e7:12:53:3f:8b:60:cc:a3: c9:5b:dd:34:b6:a4:33:a9:a5:93:64:3e:50:0d:e4:ae:a8:5d: c9:8d:f9:96:68:22:cd:66:3d:eb:66:11:68:04:f6:3d:64:05: 62:64:01:41:af:23:f9:d2:a3:5b:be:e3:33:45:71:08:05:e2: 2a:6e

7 Relationships Among CAs

8 Revocation Certificate

9 Attribute Certificates

10 Secure Socket Layer An example of using certificates to achieve authenticated secure communication over standard communication protocols.

11 SSL Protocol (1) client server SSL version number cipher suite(s) offered nonce SSL version number cipher suite(s) offered nonce SSL version number cipher suite(s) accepted nonce server certificate request for client certificate SSL version number cipher suite(s) accepted nonce server certificate request for client certificate

12 SSL Protocol (2) Steps taken by client to authenticating the server.

13 SSL Protocol (3) premaster secret encrypted with server’s public key server’s nonce signed with client’s private key client’s certificate premaster secret encrypted with server’s public key server’s nonce signed with client’s private key client’s certificate client (to server)

14 SSL Protocol (4) Steps taken by the server to authenticate the client.

15 SSL Protocol (5) client server Generate symmetric session key from premaster secret begin using session key Protocol completed (encrypted with session key) Protocol completed (encrypted with session key) Protocol completed (encrypted with session key) Protocol completed (encrypted with session key)