1. Chapter 14 Encryption: A Matter Of Trust

2. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic Algorithm Digital Signatures Major Attacks on Cryptosystems Digital Certificates Key Management Internet Security Protocols and Standards Government Regulations

3. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 3 WHAT IS ENCRYPTION? Based on use of mathematical procedures to scramble data to make it extremely difficult to recover the original message Converts the data into an encoded message using a key for decoding the message

4. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 4 WHAT DOES ENCRYPTION SATISFY? Authentication Integrity Nonrepudiation Privacy

5. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 5 BASIC CRYPTOGRAPHIC ALGORITHM Secret Key –The sender and recipient possess the same single key Public Key –One public key anyone can know to encrypt –One private key only the owner knows to decrypt –Provide message confidentiality –Prove authenticity of the message of originator

6. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 6 COMMON CRYPTOSYSTEMS RSA Algorithm –Most commonly used but vulnerable Data Encryption Standards (DES) –Turns a message into a mess of unintelligible characters 3DES RC4 International Data Encryption Algorithm (IDEA)

7. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 7 DIGITAL SIGNATURES Transform the message signed so that anyone who reads it can be sure of the real sender A block of data representing a private key Serve the purpose of authentication

8. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 8 MAJOR ATTACKS ON CRYPTOSYSTEMS Chosen-plaintext Attack Known-plaintext Attack Ciphertext-only Attack Third-party Attack

9. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 9 DIGITAL CERTIFICATES An electronic document issued by a certificate authority (CA) to establish a merchant’s identity by verifying its name and public key Includes holder’s name, name of CA, public key for cryptographic use, duration of certificate, the certificate’s class and ID

10. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 10 CLASSES OF CERTIFICATES Class 1 –Contains minimum checks on user’s background –Simplest and quickest Class 2 –Checks for information e.g. names, SSN, date of birth –Requires proof of physical address, etc.

11. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 11 CLASSES OF CERTIFICATES (Cont’d) Class 3 –You need to prove exactly who you are and you are responsible –Strongest Class 4 –Checks on things like user’s position in an organization in addition to class 3 requirements

12. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 12 KEY MANAGEMENT Key Generation and Registration Key Distribution Key Backup / Recovery Key Revocation and Destruction

13. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 13 THIRD-PARTY SERVICES Public Key Infrastructure –Certification Authority –Registration Authority –Directory Services Notary Services Arbitration Services

14. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 14 INTERNET SECURITY PROTOCOLS & STANDARDS Web Application –Secure Socket Layer (SSL) –Secure Hypertext Transfer Protocol (S-HTTP) E-Commerce –Secure Electronic Transaction (SET) E-Mail –PGP –S/MIME

15. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 15 SSL Operates between application and transport layers Most widely used standard for online data encryption Provide services: –Server authentication –Client authentication –Encrypted SSL connection

16. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 16 S-HTTP Secure Web transactions Provides transaction confidentiality, integrity and nonrepudiation of origin Able to integrate with HTTP applications Mainly used for intranet communications Does not require digital certificates / public keys

17. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 17 SET One protocol used for handling funds transfer from credit card issuers to a merchant’s bank account Provide confidentiality, authentication and integrity of payment card transmissions Requires customers to have digital certificate and digital wallet

18. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 18 PGP Encrypts the data with one-time algorithm, then encrypts the key to the algorithm using public-key cryptography Supports public-key encryption, symmetric- key encryption and digital signatures Supports other standards, e.g. SSL

19. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 19 S/MIME Provides security for different data types and attachments to e-mails Two key attributes: –Digital signature –Digital envelope Performs authentication using x.509 digital certificates

20. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 20 GOVERNMENT REGULATIONS National Security Agency (NSA) National Computer Security Center (NCSC) National Institute of Standards and Technology (NIST) Office of Defense Trade Controls (DTC)

21. Chapter 14 Encryption: A Matter Of Trust