1. Chapter 17 Security

2. Information Systems Cryptography Key Exchange Protocols Password Combinatorics Other Security Issues 12-2

3. Chapter Goals Cryptography Techniques Information Security Issues 12-3

4. Cryptography and Information Security 12-4

5. 5 Cryptography The field of study related to encoded information (comes from Greek word for "secret writing") Encryption The process of converting plaintext into ciphertext Decryption The process of converting ciphertext into plaintext

6. 6 Cryptography plaintext message ciphertext message Encryption Decryption Encrypted(Information) cannot be read (understood ) Decrypted(Encrypted(Information)) can be

7. 7 Cryptography Cipher An algorithm used to encrypt and decrypt text Key The set of parameters that guide a cipher Neither is any good without the other Need to keep at least one of these secret (or even better, both)

8. 8 Cryptography Substitution cipherSubstitution cipher -- A cipher that substitutes one character with another Caesar cipher -- A substitution cipher that shifts characters a certain number of positions in the alphabet Transposition ciphers --A cipher that rearranges the order of existing characters in a message in a certain way (e.g., a route cipher)

9. 9 Substitution cipher A B C D E F G H I J K L M N O P Q R S T U V W X Y Z D E F G H I J K L M N O P Q R S T U V W X Y Z A B C Encrypt(COMPUTER) = FRPSXWHU Decrypt(FRPSXWHU) = COMPUTER Why is this called the Caesar cipher? What is the key?

10. 10 Transposition Cipher T O D A Y + I S + M O N D A Y Algorithm 1: Write across rows Read down columns Encrypt(TODAY IS MONDAY) = T+OOINDSDA+AYMY The key is the table dimensions, 5 x 3

11. 11 Transposition Cipher T O D A Y + I S + M O N D A Y Algorithm 2: Write across rows Read in a counter clockwise spiral from top-left Encrypt(TODAY IS MONDAY) = T+ONDAYMYADOIS+

12. 12 Cryptanalysis Decrypting a message without knowing the cipher or the key Substitution and transposition ciphers are easy for modern computers to break using frequency analysis of characters and patterns To protect information more sophisticated schemes are needed

13. 13 Cryptanalysis with Frequency analysis Frequency Analysis Breaking a cipher by looking for the frequency of letters (or other patterns) English  LetterFrequency A8.23 B1.26 C4.04 D3.40 E12.32 F2.28 G2.77 H3.94 I8.08 J0.14 K0.43 L3.79 M3.06 N6.81 O7.59 P2.58 Q0.14 R6.67 S7.64 T8.37 U2.43 V0.97 W1.07 X0.29 Y1.46 Z0.09

14. Encryption Standards There are 2 standard encryption systems: 1)3DES aka Private Key Cryptography Efficient, but needs a secret key! 2)RSA aka Public-Key Cryptography Actually uses a pair of keys, one public, one private 12-14

15. 15 3DES (Triple Data Encryption Standard) 3DES Uses multiple substitutions and transpositions to hide patterns Etext appears essentially random it is very hard to crack The cipher algorithm is public The key is kept secret

16. 16 3DES (Triple Data Encryption Standard) 3DES Since the cipher is public, bad guys can always try to guess the key The key is 128 bits so quessing takes a loooooooooooooooong time: 2 ^ 128 = 340,000,000,000,000,000,000,000,000,000,000,000,000 keys PROBLEM: How to keep the key secret????

17. 17 RSA Public Key Cryptography Public-key cryptography There are two related keys, one public and one private Sender encrypts an outgoing message, using the Receiver's public key Only the Receiver's private key can decrypt the message

18. Exchanging Secret Keys 3DES is a more efficient algorithm than RSA However, the problem with 3DES is how to do the secret exchange of the private “session key” between sender and receiver RSA can help with this exchange 12-18

19. RSA Public Key Cryptography Session Key Exchange 1)B generates a “session key”, encrypts it using A’s public key, and sends it to A 2)A uses its private key to decrypt the session key 12-19

20. 3 Things RSA can help do Session Key Exchange Used to exchange 3DES “session keys” Authentication - Are you who you say you are? – Like a written signature says: “I am me” Certification - Are you a “good guy” – Like a drivers license says “CA says I can drive” – Or a Diploma says “FLC says I am educated” 12-20

21. 21 Authentication Digital Signatures Key Exchange Protocol with Authentication: A encrypts a random number using B’s public key B decrypts A’s number using B’s private key, combines the number with a Session Key, encrypts the whole message using A’s public key, and sends it to A A decrypts the message using A’s private key, if the random number matches the message must be from B. – ( Or at least from the same person who sent “B’s public key”)

22. 22 Certification Digital certificate Uses a Third Party to prove you are a “good guy” Example: Verisign Made possible by RSA key pairs Certificates can only be decrypted by Certificate Issuer, essentially validating the certificate bearer

23. Passwords Combinations 12-23

24. 24 Password Strength Math number bases can be used to calculate password strength Questions how many combinations are there for a 4 digit base ten number? how about a 4 digit binary number? How about a 4 (capital) letter password?

25. 25 Password Strength Answers 9999 = 9999 1111 2 = 15 10 ZZZZ = ??

26. More Security Issues 12-26

27. 27 Computer Security Malicious Code A computer program that attempts to bypass appropriate authorization and/or perform unauthorized functions Worm stands alone, targets network resources Trojan horse disguised as benevolent resource Virus self-replicating Logic bomb set up to execute at system event

28. 28 Computer Security Security Attacks An attack on the computer system itself Password guessing Phishing trick users into revealing security information Spoofing malicious user masquerades as authorized user Back door unauthorized access to anyone who knows it exists

29. 29 Computer Security Denial-of-service attack that overwhelms a system Man-in-the-middle network communication is intercepted in an attempt to obtain key data