Date post: | 28-Jan-2015 |
Category: |
Education |
Upload: | d3pak-kumar |
View: | 136 times |
Download: | 5 times |
““More damage could be done by a mouse More damage could be done by a mouse click than a bomb”click than a bomb” ………… …………. Are we . Are we reallyreally prepared ??prepared ??
Cryptography
Why Encryption needed ?Why Encryption needed ?How Does Cyber Security Differs From conventional How Does Cyber Security Differs From conventional
security?security?• The parties to the transaction cannot be certain of
each other’s identities– Email addresses can be spoofed
• They cannot be sure that the messages between them have not been intercepted by third parties – Confidentiality(privacy) of the transaction (read by outsiders)– Integrity of the transaction (changed by outsiders)
• How do we achieve unequivocal agreement?– Both parties have the authority to do the transaction– Assurance that neither side can later repudiate the transaction– How do the parties sign their acceptance of the deal?
• Do we have adequate evidence to the transaction?
Pillars of reliable e- SecurityPillars of reliable e- Security
Security Infrastructure
Security Policies
Au
then
ticati
on
Pri
vacy
Au
thori
zati
on In
teg
rity
of
Data
N
on
-R
ep
ud
iati
on
Reliablee-
Transaction/ e-Business
Technology
Management
A PAIN ….Authentication
• be sure you know who you are communicating with
Privacy (Confidentiality)• keep secrets secret
Authorization(Access Control)• ensure users do not exceed their allowed authority
Integrity (of the Data)• be sure nothing is changed behind your back
Non-Repudiation• have the evidence in the event of a dispute
Pillars of reliable e- SecurityPillars of reliable e- Security
Cryptography Principles• The science of scrambling a message so that only authorized parties can read
it
• Process must be reversible
– Hiding is called encryption
– Retrieving the hidden message is decryption
• Converts the original message (“plaintext”) into a scrambled message (“cipher text”)
CONSEQUENCES OF WEAK ENCRYPTION ….
• World War I, Russian Army at Tannenberg
– Two Russian armies couldn’t communicate securely
– Germans could read their communications and attack them separately
– Result: defeat!
• Allied cracked German Enigma Cipher machine in World War 2
– Montgomery (Monty) often read Rommel’s (Desert Fox) orders before he did
– Result: tide turned in North Africa
• U.S. Navy cryptographers cracked Japanese convoy codes (“Purple”)WW2
– U.S. subs could destroy Japanese submarine ships
– Surprise attack on Midway Pacific Island
• Germans also cracked Allied codes
– U-boats were devastated in the Atlantic
Cosmetic Encryption ??
Ancient Encryption Techniques
A. Secret/Symmetric Key CryptographyUses a secret key known to both parties (“symmetric”)
1) Caesar Cipher : (Skip 2 letters) A Þ D, B Þ E, etc.- Easy to “crack” by elementary cryptanalyst
2) Mono-Alphabetic Substitution: A long sequence of key consisting of 26 alphabets. Alphabets : a b c d e f … k t .. z Key : Q W E R A B S N C
eg: Plain Text a t t a c k Cipher Text Q N N Q E S
English Letter Frequencies
• Symmetric/Secret Key Cryptography(Modern)
– DES (Data Encryption Standard)
– Triple DES
– AES (Advanced Encryption Standard)
– SkipJack
– RC2, RC4, RC5, RC6(Rivest Ciphers)
• Asymmetric Cryptography
-Public Private Key Pairs Cryptography
Encryption Techniques Encryption Techniques (Modern)(Modern)
Common Symmetric Key Algorithms Algorithm Supporter Length Availability Comments
DES NSA, NIST, 40 & 56 bits Public Domain Most widely used; ANSI now too weak
Triple-DES - same - 80 & 112 bits Public Domain Stronger variant of DES
Skipjack NSA 80 bits Recently Planned for the declassified US Govt’s Clipper
RC2, RC4 RSA variable Proprietary Very strong;
Websites: rsasecurity.com, nsa.com, nist.comNSA: Netwk Security AgencyNIST: National Institute of Standarad & TechnologyANSI: American National Standards Institute.SHA: Secure Hash AlgoNSI :Netwk Solutions Incorporation
Symmetric/Secret Cryptography System
EncryptEncrypt
Symmetric key Symmetric key (shared secret,(shared secret,known to A & B)known to A & B)
DecryptDecrypt
CiphertextCiphertext
aN!3q*nB5+aN!3q*nB5+
C=E(M, K)C=E(M, K)
C = Cipher textM = Message (plaintext)K = Secret KeyE = Encryption function
AliceAlice
PlaintextPlaintext
Hi BobAliceHi BobAlice
!!??!!??
EavesdropperEavesdropper
M=D(C, K)M=D(C, K)
D = Decryption function
BobBob
PlaintextPlaintext
Hi BobAlice
Strength OF Symmetric Key Encryption Method ?
• Strength of encryption = difficulty of cracking
• Length of key (Modern Symmetric Key Encryption uses 128, 256, 1024 bits as key)
• Strength of the mathematical algorithm (Modern method uses Hash function)
Cracking Symmetric Key EncryptionCracking Symmetric Key Encryption
Brute Force = Exhaustive search, trying all possible keys, starts at 0000…..1, etc.
• Successful attacks are now possible by using thousands of networked computers linked
on the Internet
Digital signatures vs Digital certificate
Digital certificate is a form of an electronic credential for the Internet.
Similar to a driver's license, employee ID card, a Digital certificate is issued
by a trusted third party to establish the identity of the certificate holder. The
third party who issues the Digital Certificate is known as the Certifying
Authority (CA).
Digital signatures are electronically generated and can be used
to ensure the integrity and authenticity of some data, such as an e-
mail message and protect against non-repudiation
Key Size No of Possible Keys Crack Time(*)
40 bits 1 x 1012 (1 trillion) 2 hours
56 7 x 1016 20 hrs (12/98)
64 2 x 1019 9 years
112 5 x 1033 1015 years
128 3 x 1038 1019 years
256 1 x 1077 1058 years
* Time required for a “brute force” attack, using a hypothetical special-purpose, “cracking” computer
Strength of Symmetric Key EncryptionStrength of Symmetric Key Encryption
Quote
“The problem with bad cryptography is that
it looks just like good cryptography”
- Bruce Schneider
2) Asymmetric Key Encryption: [Public-Private key pairs]
• No shared secret
• Bob has two complimentary keys
• What one key encrypts, only the other key can decrypt
• Bob keeps one key private (Private Key).
• Bob shares the other key (Public Key).
Asymmetric Key Encryption: Public-Private key pairs
Scenario 1
If Alice needs to send Bob a message:- Alice encrypts message with Bob’s public key, - Bob decrypts message with his private keyProblem:
• How would Bob ensure that the message has been sent by Alice? How would Bob ensure that the message has been sent by Alice?
• Anybody can encrypt the message using Bob’s public key as this key is publicly available. Anybody can encrypt the message using Bob’s public key as this key is publicly available.
[[Alice’s key not used at all]Alice’s key not used at all]
CiphertextCiphertext
B's public keyB's public key B's private keyB's private key
DecryptDecrypt BobBob
#d%G*!ki4i
EncryptEncrypt
PlaintextPlaintext
AliceAlice
Hi BobAlice
Hi BobAlice
Public-Private key pairs:
Scenario 2:
•Alice encrypts message with her private key & sends to Bob. Identity attached
•Bob is confirm that the message is from Alice. The message is authentic.
•Message is not confidential as anybody can decrypt it using Alice’s public key.
Problem: Bob’s key not used at allBob’s key not used at all
Putting It All Together
Let’s put Encryption and Authentication together
PROPERTIES OF A MESSAGE DIGEST (MD)/ HASH FUNCTION
• Properties of MD (or hash) functions :– Short output: reduces a message to a fixed length, say 16 to 20
characters– One way: impractical to determine a message from its hash– Unique: impractical to find 2 messages with the same hash– Sensitive: checksum changes if one bit changes or one bit is added to or
removed from the message
Hash Algo: MD-5(128 bits), SHA1(160bits)
• An MD is like a fingerprint– Less information than the original (me)– Unique to me– Unlikely to find 2 individuals with identical fingerprints– Given the fingerprint, can’t reconstruct the person
DIGITAL SIGNATURE WITH A MESSAGE DIGEST
PlaintextAliceAlice
Hi BobAliceHi BobAlice
PlaintextBobBob
Hi BobAliceHi BobAlice
=?=?
Hi BobAliceHi BobAlice
A's public key
1764890238
1764890238
5. Alice’s 5. Alice’s Message Message DigestDigest
5. Alice’s 5. Alice’s Message Message DigestDigest
Encrypted MD(“signature”)Encrypted MD(“signature”)
Unencrypted message
A’s private key
DigestDigest
1. Message Digest1. Message Digest
17648902381764890238
MD
17648902381764890238
MD3. Compute
the MD
DigitallySign
2.Sign it (Encryptthe MD)
Decrypt
Alice’sMD
Decrypt
Alice’sMD
4.
Certifying Authorities• Certifying Authority is a trusted third party
– similar to Passport Office
• Certifying Authorities issue digital certificates. Controller of Certifying Authority is the custodian of the following repositories:
-National Repository of Digital Certificates
-Certificate Revocation List
• A certificate contains the following:– Bob’s public key, Bob’s name, address, other info
– Expiration date & serial number
– The certificate authority’s name, etc.
• A digital certificate is “signed” with the Certifying Authority’s private key, to ensure authenticity
• Everyone has CA’s public key
Basic Certificate Contents as per International Standard ITU-T X.509 v3
VersionSerial number
Signature algorithm Issuer name
Validity periodSubject name
Subject public key
Identifies certificate formatIdentifies this certificate
Algorithmused to signcertificate
Name ofcertification
authority
Start dateand
end date
Public key value andindicator of its algorithm
Identifies the ownerof the key pairEnsures cert. dataEnsures cert. data
can’t be changedcan’t be changedEnsures cert. dataEnsures cert. datacan’t be changedcan’t be changed
VERISIGN CERTIFICATE CLASSES
11ClassClass
• email address, charges Rs 500/-
• Real name, real address, locale, email address• Verified using a “trusted” database (credentials like ration card, passport
ClassClass
22
• Real name, real address, locale, email address• Verified using “trusted” database• Verified in person, with notarization
ClassClass
33
https://www.ncodesolutions.com/certificates.asp
CAs licensed under the Govt. of India IT Act, 2000 (www.cca.gov.in)
•Controller of CAs
•IDRBT CA(Instt for Dev & Research in Banking Tech., IT Tech Arm of RBI)
•TCS Certifying Authority (CA) Services
•National Informatics Center CA
•SafeScrypt
•MTNL
•Customs & Central Excise
•GNFC (n)Code Solutions Ltd., (A division of Gujarat Narmada Valley Fertilizers Company Ltd.)
Countermeasures
Some of the measures that the Government has decided to take up to
counterattack Cyber Terrorism are:
• Establishment of National Level Cyber Emergency Response Units
• Conducting Security Training & Awareness Programs
• Developing Indigenous Security Software
• Deploying of Cyber Cops or Cyber Cells to keep a track of various
online activities
• Deployment of PKI Infrastructure
Tools:
1. Wondercrypt: A PKI Solution (wondercrypt.com)
2. PGP (Pretty Good Privacy)
Resources:WikipediaWebopediaSecurity freshZdnet
D3pak KumarD3pak KumarIT security & Forensic Consultant@D3pakFb/[email protected]
“BE THE CHANGE YOU WISH TO SEE IN THIS WORLD”
- Mahatma Gandhi