1. Chapter Extension 23 SSL/TLS and //https © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke

2. CE23-2 Study Questions How does SSL/TLS use encryption? What prevents spoofing of the public key? How do digital signatures detect text alteration? Why not send confidential data via e-mail? Why is //https the only practical secure transmission on public wireless networks?

3. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-3 How Does SSL/TLS Use Encryption? Encryption techniques – Senders use key to encrypt plaintext message – Recipient uses key to decrypt Symmetric encryption – Both parties use same key Asymmetric encryption – Parties use two keys Public key, private key Message encoded with one, decoded with other Slower, but easier to implement

4. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-4 Secure Socket Layer (SSL) Protocol that uses both symmetric and asymmetric encryption Works between Levels 4 and 5 of TCP-OSI protocol architecture Asymmetric encryption transmits symmetric key which is used for balance of session – Allows client to verify that it is communicating with true Web site – Web site not spoofed – Users are not verified, and may be spoofed

5. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-5 How Do Digital Signatures Detect Text Alteration? Most messages sent using plaintext – Can be intercepted and altered Digital signatures – Ensure no alteration of plaintext messages – Plaintext message hashed Method that mathematically manipulates message to create bit string

6. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-6 Digital Signature, continued Bit string called message digest – Fixed length – Protected when transmitted One-way process Authentication programs ensure hashed messages not altered

7. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-7 Authentication Message digest encrypted using sender’s private key – Called signing the message Receiver decrypts digital signature with sender’s public key – Called true party’s public key Compares message digest with original message digest – If different, then message altered

8. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-8 What Prevents Spoofing of the Public Key? You need public key from party you are communicating with SSL/TLS uses digital signatures – Supplied by certificate authorities (CA) Trusted, independent third-party companies Only verifies that company has public key, not legitimacy of company Sent in plaintext – Signed by CA with its digital signature Browsers contain public keys for common CAs

9. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-9 Why Not Send Confidential Data via E-mail? Layer 5 protocols can use SSL/TLS – //https uses SSL/TLS – Secure transmission – ftp may use SSL/TLS – Few e-mail uses SSL/TLS May be digitally signed

10. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-10 //https and Public Wireless Networks Potential intruders must get physical access to wired network No direct connection needed for wireless network – Can be protected with sophisticated equipment – Wired Equivalent Privacy (WEP) is a wireless security standard – Wi-Fi protected Access (WPA) and WPA2 offer improved security

11. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-11 Testing Security Tendency to believe that system is secure White-hat hackers break into networks for the purpose of testing system for organization – Hire only reputable firms – Ensure firms have liability insurance to cover problems How does an organization handle results? – May be too expensive – May not be able to cure problem – Knowing about weakness that can’t be fixed exposes liability

12. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE23-12 Active Review How does SSL/TLS use encryption? What prevents spoofing of the public key? How do digital signatures detect text alteration? Why not send confidential data via e-mail? Why is //https the only practical secure transmission on public wireless networks?