1. Induction: Security and Certification –April 26-28, 2004 - 1 Security and Certification; Authentication and Authorisation John Kewley EGEE is funded by the European Union under contract IST-2003-508833

2. Induction: Security and Certification –April 26-28, 2004 - 2 Security and Certification; Authentication and Authorisation EGEE Training Team EGEE is funded by the European Union under contract IST-2003-508833

3. Induction: Security and Certification –April 26-28, 2004 - 3 Acknowledgements Some of these slides have been taken from a longer presentation by Mike Jones of the University of Manchester. Prepared by John Kewley, CCLRC Daresbury Laboratory

4. Induction: Security and Certification –April 26-28, 2004 - 4 Goals of this module Describe … Security basics Use of Certificates Importance of Certificate Authorities

5. Induction: Security and Certification –April 26-28, 2004 - 5 Overview Introduction to Security Public/private keys in action Certificates Certificate Authorities

6. Induction: Security and Certification –April 26-28, 2004 - 6 Introduction to Security What aspects of security should we be concerned about? Authentication (Identification) Confidentiality (Privacy) Integrity (non-Tampering) Authorisation Also Accounting Delegation Non-Repudiation

7. Induction: Security and Certification –April 26-28, 2004 - 7 Tools of the trade Encryption Secret “symmetric” key – both parties need to share the key DES, RC4 Comparatively efficient Public/private key – “asymmetric” - 2 keys mathematically related RSA, DSA Slower Oneway hash / message digest MD5, SHA-1 fast

8. Induction: Security and Certification –April 26-28, 2004 - 8 Gbbyf bs gur genqr Rapelcgvba Frpergt “flzzrgevp” xrl – obgu cnegvrf arrq gb funer gur xrl QRF, EP4 Pbzcnengviryl rssvpvrag Choyvp/cevingr xrl – “nflzzrgevp” - 2 xrlf zngurzngvpnyyl eryngrq EFN, QFN Fybjre Barjnl unfu / zrffntr qvtrfg ZQ5, FUN-1 Snfg

9. Induction: Security and Certification –April 26-28, 2004 - 9 Tools of the trade Encryption Secret “symmetric” key – both parties need to share the key DES, RC4 Comparatively efficient Public/private key – “asymmetric” - 2 keys mathematically related RSA, DSA Slower Oneway hash / message digest MD5, SHA-1 fast

10. Induction: Security and Certification –April 26-28, 2004 - 10 Encrypting for Confidentiality (1) Sending a message using symmetric keys 1.Encrypt message using shared key 2.Send encrypted message 3.Receiver decrypts message using shared key Only someone with shared key can decrypt message But how do the keys get shared? Sender spaceReceiver spacePublic space Hello World openssl hR3a rearj openssl Hello World 2 1 3 key

11. Induction: Security and Certification –April 26-28, 2004 - 11 Encrypting for Confidentiality Sending a message using asymmetric keys 1.Encrypt message using Receiver’s public key 2.Send encrypted message 3.Receiver decrypts message using own private key Only someone with Receiver’s private key can decrypt message Sender space Receiver spacePublic space Hello World Receiver’s Public Key Public Key Private Key Receiver’s Public Key openssl hR3a rearj openssl Hello World 2 1 3

12. Induction: Security and Certification –April 26-28, 2004 - 12 Encrypting for Confidentiality (2) Sending a message using asymmetric keys 1.Encrypt message using Receiver’s public key 2.Send encrypted message 3.Receiver decrypts message using own private key Only someone with Receiver’s private key can decrypt message Sender space Receiver spacePublic space Hello World Receiver’s Public Key Public Key Private Key Receiver’s Public Key openssl hR3a rearj openssl Hello World 2 1 3

13. Induction: Security and Certification –April 26-28, 2004 - 13 Signing for Authentication 1.Encrypt message with Sender’s private key 2.Send encrypted message 3.Message is readable by ANYONE with Sender’s public key 4.Receiver decrypts message with Sender’s public key Receiver can be confident that only someone with Sender’s private key could have sent the message Sender space Receiver space Public space Hello World Sender’s Public Key openssl n52krj rer openssl Hello World Public KeyPrivate Key Sender’s Public Key openssl Hello World 1 3 4 2

14. Induction: Security and Certification –April 26-28, 2004 - 14 Certificates A statement from someone else (the Certificate Authority), that your public key (and hence your private key) is associated with your identity A certificate can be checked if you have the public key of the party who signed it

15. Induction: Security and Certification –April 26-28, 2004 - 15 Certificate Authority A Certificate Authority (CA) issues you your certificates. By signing them it is able to vouch for you to third parties In return for this service, you must provide appropriate documentary evidence of identity when you apply for a certificate through a Registration Authority (RA)

16. Induction: Security and Certification –April 26-28, 2004 - 16 Certificate contents The certificate that you present to others contains: Your distinguished name (DN) Your public key The identity of the CA who issued the certificate Its expiry date Digital signature of the CA which issued it

17. Induction: Security and Certification –April 26-28, 2004 - 17 The Full Monty Server authenticates Client Client authenticates Server (Symmetric) Session key exchanged confidentially using public key mechanism Secure session can now commence using more efficient, agreed “session key” Secure messages will also contain a message digest to ensure integrity

18. Induction: Security and Certification –April 26-28, 2004 - 18 Summary We have looked at Security basics Use of Certificates Importance of Certification Authorities