1. Symmetric Encryption Mom’sSecretApplePieRecipe Mom’sSecretApplePieRecipe The same key is used to encrypt and decrypt the data. DES is one example. Pie Key Important Concepts

2. Symmetric Encryption The Advantages ° Secure ° Widely Used ° The encrypted text is compact ° Fast The Disadvantages ° Complex Administration ° Requires Secret Key Sharing ° Large Number of Keys ° No non-repudiation ° Keys are Subject to interception Important Concepts

3. Asymmetric Encryption One half of a key pair is used to encrypt, the other half is used to decrypt. RSA is one example. Mom’sSecretApplePieRecipe Mom’sSecretApplePieRecipe PublicKeyRecipient’sPublicKeyRecipient’sPrivateKeyPrivateKey Important Concepts

4. Asymmetric Encryption The Advantages ° Secure ° No secret sharing ° No prior relationship ° Easier Administration ° Far fewer keys ° Supports non- repudiation The Disadvantages ° Slower than symmetric key ° The encrypted text is larger than a symmetric version ° point to multi-point does not scale Important Concepts

5. The Combination Mom’sSecretApplePieRecipe RandomSymmetricKey Bill’sPublicKey Mom’s Secret Apple Pie Recipe Encrypted To:Bill “Digital Envelope” “Key Wrapping” Important Concepts

6. The Combination You get the best of both worlds ° The benefits of Symmetric Key Speed Compact Encrypted Text ° The benefits of Public Key Simpler Key management Digital Signature Non-Repudiation

7. Mom’sSecretApplePieRecipe Digest Certifying Authority’s Digital Signature Digital Certificates Encrypted Certificate Name, Address, OrganizationOwner’s Public Key Certificate Validity Dates All you need is the CA’s public key to verify the certificate and extract the certified public key Important Concepts

8. What is a Certificate? A signed packet of identifying attributes Identifying Attributes: ° Subject Name (the user being identified) ° Public Key ° Issuer Name (trusted source identifying user) ° Validity Period ° Signature Specified in: ° RFC 2459 ° x.509 v 1-3 Serial Number : 6cb0dad0137a5fa79888f Validity : Nov.08,1997 - Nov.08,1998 Subject / Name / Organization Locality = Internet Organization = VeriSign, Inc. Organizational Unit = VeriSign Class 2 CA - Individual Subscriber Organizational Unit = www.verisign.com/repository/CPS Incorp. by Ref.,LIAB.LTD(c)96 Organizational Unit = Digital ID Class 2 - Netscape Common Name = Mom Email Address = mom@ne.mediaone.net Unstructured Address = RR2, Pieland, USA Status: Valid Public Key: ie86502hhd009dkias736ed55ewfgk98dszbcvcq m85k309nviidywtoofkkr2834kl Signed By : VeriSign, Inc.: kdiowurei495729hshsg0925h309afhwe09721h481 903207akndnxnzkjoaioeru10591328y5 Important Concepts

9. Digital Signatures Clear Text “Hash” Digest 564553 Clear Text Encrypted Digest *@!$^& Hi level Functionality Non-Repudiation

10. Digital Signatures Mom’sSecretApplePieRecipe “Hash Function” Digest Mom’sSecretApplePieRecipe DigestEncrypted Digest ‘ DigestEncrypted “match?” Signer’sPublicKey Hi level Functionality Non-Repudiation

11. Key Generation Standards ° RFC 2510 Key may be generated by End Entity, RA, or CA – ANSI x.9.57 - not specified but commonly used ° PKCS #11 Key may be generated by End Entity, RA, or CA – RSA (512 - 2048) – DSA (512 - 2048) – ECDSA Certificate Issuance

12. Certificate Creation Standards ° PKCS #1 ° RFC 2459 Certificate and CRL Profile Specifies the the type and format of a certificate – essentially x.509 with some modification Uses PKCS #1 specifiers – MD5 with RSA for signature – SHA-1 with RSA for signature Certificate Issuance

13. How do you assure that you get a real (and valid) public key? X.509 Digital Certificate “I officially notarize the association “I officially notarize the association between this particular User, and between this particular User, and this particular Public Key” this particular Public Key”

14. How do I validate a certificate? For a certificate to be valid, the following checks must normally succeed: ° today’s date must fall between the starting and ending validity dates for the certificate ° the signature must be valid ° the contents of the certificate must not have changed ° the certificate issuer must be one we trust ° the certificate must not have been revoked