+ All Categories
Home > Documents > Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and...

Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and...

Date post: 23-Jun-2020
Category:

Documents
Upload: others
View: 0 times
Download: 0 times
Download Report this document
Share this document with a friend
74
TITLE: Practical Cryptography: Privacy for Business and E-commerce INSTRUCTOR: Frederick M. Avolio, independent security consultant SUMMARY OF TOPICS: Up Front— • Defining Terms • Basics of Cryptography—types and methods, Applications— • Private Messaging (E-mail) • Files and Directories • Strong User Authentication • Virtual Private Networks • Web Sites • Electronic Commerce • Next Steps
Transcript
Page 1: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

TITLE:Practical Cryptography: Privacy for Business and E-commerce

INSTRUCTOR:Frederick M. Avolio, independent security consultant

SUMMARY OF TOPICS:Up Front—

• Defining Terms• Basics of Cryptography—types and methods, Applications—• Private Messaging (E-mail)• Files and Directories• Strong User Authentication• Virtual Private Networks• Web Sites• Electronic Commerce• Next Steps

Page 2: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

1

Practical Cryptography:An Overview

Frederick M. Avolio<[email protected]>

Page 3: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 2

Shameless (but brief)Marketing

Avolio Consulting, http://www.avolio.com/– Network and computer security

• Training• Policy and Procedure development

• Product Review and Analysis

– Product Marketing, technical assistance– E-mail system design, configuration, and training– Writing: white papers, tutorials, product reviews

Page 4: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 3

Syllabus

• Defining Terms• Basics of Cryptography• Private Messaging (E-mail)• Files and Directories• Strong User Authentication• Virtual Private Networks• Web Sites• Electronic Commerce

Page 5: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 4

Defining Terms

Concern• Fraud• Unauthorized access• Snooping• Message Alteration• Disavowal

Requirement• Authentication• Authorization• Privacy• Data Integrity• Non-Repudiation

From Understanding Digital Signatures by Gail Grant, McGraw-Hill, 1997

Page 6: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 5

Authentication and Integrity

Guarantee to Receiver• Knows identity of sender• Message not altered• Not unduly delayed From Internet Security presentation at WICS by Whit Diffie

Page 7: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 6

Privacy or Confidentiality

Guarantee to Sender• Authorized receivers only

From Internet Security presentation at WICS by Whit Diffie

Page 8: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 7

Business Needs for Crypto

Privacy• Most businesses (and governments) don’t need long-

term security• Mailing lists, business plans, negotiations, product

R&D• Commerce privacy needs are moderate• Financial information might need to be secure for a

decade• Exceptions are embarrassments: personal, political,

business From Internet Security presentation at WICS by Bruce Schneier

Page 9: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 8

Business Needs for Crypto

Authentication• Authenticating sessions versus transactions• Need for audit trail depends on application• Audit trail must be usable in court while not

compromising the future security of the system

From Internet Security presentation at WICS by Bruce Schneier

Page 10: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 9

Basic Cryptography

• Secret key or symmetric encryption• Public key or assymmetric encryption• One-way hash functions

Page 11: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 10

EncryptionSecret-Key (Symmetric)

Now is the time for all good men...

sd84$2*q} 59(o32nvt- =gf]|@l^...

Decryption

Encryption

Now is the time for all good men...

Page 12: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 11

EncryptionSecret-Key (Symmetric)

Bob encrypts hismessages to Ted withtheir shared secret key

Ted decrypts messagesfrom Bob with the samesecret key.

Page 13: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 12

EncryptionSecret-Key (Symmetric)

Bob decrypts Ted’smessages using theirsecret key.

Ted sends messagesback to Bob with thesame secret key.

Page 14: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 13

EncryptionPublic-Key (Asymmetric)

Now is the time for all good men...

sd84$2*q} 59(o32nvt- =gf]|@l^...

Decryption

Encryption

Now is the time for all good men...

Page 15: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 14

EncryptionPublic-Key (Asymmetric)

Carol, Ted, Bob, and Alice post their public keys and keep their private keys secret

Page 16: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 15

EncryptionPublic-Key (Asymmetric)

Ted

Bob

Alice

Carol’s Public Key

Carol’s Public Key

Carol’s Public Key

Carol decrypts thesemessages using herprivate key

Page 17: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 16

EncryptionPublic-Key (Asymmetric)

Ted’s public key

Bob’s public key

Alice’s public key

Carol replies tomessages usingeach recipient’spublic key

Ted

Bob

Alice

Ted’sprivate key

Bob’sprivate key

Alice’sprivate key

Page 18: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 17

Hash Functions

• Converts a string of data of any size into afixed-length hash

• No way to go backwards• E.g., a fingerprint• Chances of any two strings of data hashing to

the same value very, very small. This is veryimportant!

Page 19: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 18

Hash Functions

MD5

Messagetext of

arbitrarysize...

Message Text

Hash of Messageof short, fixed size

Page 20: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 19

Security Problems Solved byCryptography

• Privacy of stored data, messages, andconversations

• Secure electronic commerce• Transaction non-repudiation• User and data authentication• E-mail security• Multi-party control• Secure audit logs

From Internet Security presentation at WICS by Bruce Schneier

Page 21: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 20

Application Examples

• E-mail• User Authentication• Privacy for Files and Directories• Virtual Private Networks• Web Site Security

Page 22: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 21

Private E-mail

The Goals• Confidentiality• Authentication• Non-repudiation

Securing E-mail as well or betterthan postal mail!

Page 23: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 22

Integrity and Authentication1.

M essage Signature

MD5

RSA

Now is thetime forall goodmen...

Sender’s Private Key

Message Text

Hash of Message

Page 24: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 23

Integrity and Authentication

2.

Data toSend

Now is thetime forall goodmen...

Message Signature

Message Text

Page 25: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 24

Digitally Signed MessageTO: sysadminFrom: [email protected]

-----BEGIN PGP SIGNED MESSAGE-----

Please complete the deployment of the PGP software to all employees.

Fred,CSO

-----BEGIN PGP SIGNATURE-----Version: 4.5

iQCVAgUBM+ZICTGr72+Les/dAQHmhwP/WorAeL6LzTJJre6lU77oPkNxYS+izmnM1ozOHxVD6pDlEu7pgsju0g3yRO6tKxN4uJRW5ZeOUtVEgBw+dgFptuOSD9cmDAgSw3SAEFwp9C6cPO0L9MMbc+eps3w8GKLlZkYRZPuANom0ggbmRpqDkjMIU25yEUr5Vj/P54ZuaRY==zu3P-----END PGP SIGNATURE--—

Page 26: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 25

Integrity and AuthenticationHow can anyone validate integrity and authenticate sender?

MD5

RSA

Sender’s Public Key

CompareRSA

Now is thetime forall goodmen...

Message Text

Message Signature

Page 27: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 26

TO: sysadminFrom: [email protected]

-----BEGIN PGP SIGNED MESSAGE-----

Please complete the deployment of the PGP software to all employees.

Fred, CSO

-----BEGIN PGP SIGNATURE-----Version: 4.5

iQCVAgUBM+ZICTGr72+Les/dAQHmhwP/WorAeL6LzTJJre6lU77oPkNxYS+izmnM1ozOHxVD6pDlEu7pgsju0g3yRO6tKxN4uJRW5ZeOUtVEgBw+dgFptuOSD9cmDAgSw3SAEFwp9C6cPO0L9MMbc+eps3w8GKLlZkYRZPuANom0ggbmRpqDkjMIU25yEUr5Vj/P54ZuaRY==zu3P-----END PGP SIGNATURE--—

Checking a Signed Message

Page 28: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 27

EncryptionHybrid Systems

• Symmetric key is fast for encryption, butdistributing keys is difficult

• Public key is good for key distribution, butslow at encryption

• Solution: use public key crypto as a securemeans of distributing the keys for symmetricencryption

Page 29: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 28

Adding Privacy1.

EncryptedMessage

DES

Random key

Now is thetime forall goodmen...

s5%lk)@slm#]l0|

;k^nb[wepqs...

Message Text

Page 30: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 29

Adding Privacy2.

Random key Encrypted key

RSA

Recipient’s Public Key

Page 31: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 30

Adding Privacy3.

MD5

RSA

Now is thetime forall goodmen...

Sender’s Private Key

Message Signature

Message Text

Page 32: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 31

Adding Privacy

4.

EncryptedMessage

Data toSend

Encrypted key

s5%lk)@slm#]l0|

;k^nb[wepqs...

Message Signature

Page 33: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 32

Adding Privacy

How can the recipient (and only the recipient)decrypt?–DES key is encrypted with recipients public

key–Recipient decrypts with private key (only

recipient has this)–DES key is applied to encrypted message–The result is the clear-text message

Page 34: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 33

Sample Encrypted Message

Date: Tue, 08 Jul 1997 16:39:25 -0400To: user@domainFrom: Frederick M Avolio <[email protected]>

-----BEGIN PGP MESSAGE-----hIwCMavvb4t6z90BA/42UOAdWvnzfhRG2xXyYe203CISLsn2O39vM/y640hNbSl7U29aNGZFfLMRGn7eLZG43SWwBz4cHjphG6iAzeLftRgHkLggxXA9VpGki5PyNID9B0rk4TpRVE3qzgTbdio69aMlK6BdAQ4zWkyxSCi0oR3Vpnh+VVZyOVyaX8etlYRMAvUTsuDYCkr1AQH+OlA4ntqhxoPP/SJpKm5ugMLYiiij8ak8V90a8IYMkYB0CzMrliOJ6ZZxQm1x8orgjL/6Bm5EoSvN4eCCeA/xXKYAAAHXLhG47kVhJkjlPrI/U/sr2aQEm6r+aU1s0ziU1LxF2c5DAW6cD5b4xH+EbvYrnQQJClNMh9y03SjviXvnqFDCO4M70u3iLC50+em4PouqM1DZdoW8O5pb=vhFx-----END PGP MESSAGE-----

Page 35: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 34

Date: Tue, 08 Jul 1997 16:39:25 -0400To: user@domainFrom: Frederick M Avolio <[email protected]>

-----BEGIN PGP MESSAGE-----hIwCMavvb4t6z90BA/42UOAdWvnzfhRG2xXyYe203CISLsn2O39vM/y640hNbSl7U29aNGZFfLMRGn7eLZG43SWwBz4cHjphG6iAzeLftRgHkLggxXA9VpGki5PyNID9B0rk4TpRVE3qzgTbdio69aMlK6BdAQ4zWkyxSCi0oR3Vpnh+VVZyOVyaX8etlYRMAvUTsuDYCkr1AQH+OlA4ntqhxoPP/SJpKm5ugMLYiiij8ak8V90a8IYMkYB0CzMrliOJ6ZZxQm1x8orgjL/6Bm5EoSvN4eCCeA/xXKYAAAHXLhG47kVhJkjlPrI/U/sr2aQEm6r+aU1s0ziU1LxF2c5DAW6cD5b4xH+EbvYrnQQJClNMh9y03SjviXvnqFDCO4M70u3iLC50+em4PouqM1DZdoW8O5pb=vhFx-----END PGP MESSAGE-----

Sample Encrypted Message

Page 36: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 35

Sample Encrypted Message

TO: user@domainFrom: [email protected]

We have deployed the PGP mail software and have completed training.

Fred

Page 37: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 36

Sample Encrypted Message

TO: user@domainFrom: [email protected]

We have deployed the PGP mail software and have completed training.

Fred

Page 38: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 37

Files and Directories

The Goals• Seal data files from unauthorized access or

alteration (reading, writing, etc.)

Page 39: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 38

Files and Directories

• Similar to E-mail concerns and solutions• Encrypt a file with a symmetric key• Encrypt a file with YOUR public key• Like locking drawers in a desk of file cabinet• Desert Storm …

Page 40: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 39

Files and Directories

Page 41: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 40

Files and Directories

• Need to be built into file system• Need to be built into applications• Open — automatically decrypt if encrypted• Close — automatically encrypt if was

encrypted (and delete cleartext)• Close with encrypt

Page 42: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 41

Strong User Authentication

The goals• “To establish the validity of a claimed identity

or to provide protection against fraudulenttransactions by establishing the validity of ...[the] individual ...” — NCSC “Red Book”

• To identify in a way that is not vulnerable to areplay attack

Page 43: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 42

Replay Attack

Username: fred

Password: lisa

%

Page 44: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 43

• Strong user authentication– Smart cards or tokens

• Software (server) and smartcard based• PIN-protected smartcard private key• System issues challenge based on user• User uses password to unlock smartcard,

which reads challenge, calculatescryptographic response

• Response is used as response to challenge

Authentication Techniques

Page 45: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 44

Authentication TechniquesChallenge: “876261”Server sends User “unlocks”

authentication tokenby keying in PersonalIdentification Number

User enters challengeinto authenticationtoken

Token returns anencrypted responseto the challenge

“722512”

“1105”

“876261”

User responds toserver with uniqueresponse

Server comparesresponse “722512”

(Server and tokenshare a secretencryption keythat user neverhas access to)

(Secret key: “0x8A5F42”)

Page 46: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 45

Virtual Private Networks

The goals• Privacy of communication between secure

enclaves over an untrusted network• Privacy and access for remote employees• Privacy and controlled access for remote

clients

Page 47: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 46

Encryption — “Virtual Private Networks” and “Virtual Network Perimeters”

LAN ALAN A

LAN BLAN B

Privacy

Page 48: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 47

Virtual Private Networks

• Firewall-to-firewall connections over theInternet.

• Using encrypted “tunnels” over the Internet toconnect LANs and WANs can reduce costs23-50% (US Computer March 1996).

• Secure Wide Area Networking (S/WAN).• IPv6, end-to-end encryption, IPSEC

• Firewall-to-firewall connections over theInternet.

• Using encrypted “tunnels” over the Internet toconnect LANs and WANs can reduce costs23-50% (US Computer March 1996).

• Secure Wide Area Networking (S/WAN).• IPv6, end-to-end encryption, IPSEC

Page 49: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 48

Extending the Perimeter

Public Network

Virtual NetworkPerimeter

Page 50: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 49

Global VPNs

• Key Issues– The Internet is a worldwide network– Companies cross international boundries– Partnerships cross international boundries– Privacy in business transactions is critical

to success– Network communications privacy means

employing encryption

• Key Issues– The Internet is a worldwide network– Companies cross international boundries– Partnerships cross international boundries– Privacy in business transactions is critical

to success– Network communications privacy means

employing encryption

Page 51: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 50

Global VPNs

Encryption Requirements• Strong (56 bit or better key length)• Exportable• Platform independent

Encryption Requirements• Strong (56 bit or better key length)• Exportable• Platform independent

Page 52: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 51

Web Site Security

The goals• Deployment of web sites for internal and

external use• Protection from modification• Assurance data has not been modified• Control of access

Page 53: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 52

Web Site Security

Web site attacks• CIA• DOJ• NASA• USAF• Singapore Government• Nation of Islam• MGM Studios

Page 54: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 53

Web Site Security

• Message hash of all files on web site kept– Periodic checking of stored hash against

hash of pages — integrity checking• Digitally sign pages, documents, software

– Assurance for users that data has not beenmodified

Page 55: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 54

Web Site Security

• Controlled access– Strong user authentication– User name and password over protected

channel

Page 56: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 55

Web Site Security

ftp://info.cert.org/pub/cert_advisories/CA-97.20.javascript:-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================CERT* Advisory CA-97.20Original issue date: July 8, 1997

Last revised: July 28, 1997, Appendix A - added information for Hewlett-Packard and IBM. Section III.A - slight wording change.

A complete revision history is at the end of this file.

Topic: JavaScript Vulnerability…

-----BEGIN PGP SIGNATURE-----Version: 2.6.2

iQCVAwUBM9yyN3VP+x0t4w7BAQFLAgP/Z1moGK6SI2Q3OBbV/fpCOcW2J9TdXE3/UHuZ7vHCjKDWxelHr5551JQ9i19s6sVBNDOX1W031IrlS36nIblp3vX4rVuAaufwVOxqxYg44i3gxsC8NgC/HW5j7KHsOiGzoRmU5a+vWyLmmged+Y2wBDrxGeqbHacE4S6FPph4/w8==5MP2-----END PGP SIGNATURE-----

Page 57: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 56

E-Commerce

• Transaction security– Privacy of a sale– Integrity of a sale

• Electronic payment– Privacy– Integrity– Provenance of an agreement to transfer

fundsFrom Web Security Sourcebook by Rubin, at al, John Wiley & Sons, 1997

Page 58: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 57

Transaction Security

• Virtual Private Network approach– Encryption and authentication done as part

of the network communication– Network software must be modified– Users need not modify behavior or

application software

From Web Security Sourcebook by Rubin, at al, John Wiley & Sons, 1997

Page 59: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 58

Transaction Security

• Application-level encryption– OS and platform independent– No data is exposed between client and

server software– Most web browsers are using this type of

security• SSL, SHTTP

From Web Security Sourcebook by Rubin, at al, John Wiley & Sons, 1997

Page 60: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 59

Transaction Security

• Application-level encryption– Browser and server shake hands and

decide on encryption scheme and key– Data is transmitted encrypted with the key– They shake hands at the end.

From Web Security Sourcebook by Rubin, at al, John Wiley & Sons, 1997

This is the meaning of the filled in key on the Netscapebrowsers.

Page 61: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 60

Transaction Security

• Most e-commerce today uses application-level transaction security

• Most transaction security today protectsprivacy of the data sent from the client– Order blanks or questionnaires– Credit Card numbers

• Most e-commerce on the Internet today is liketelephone catalog ordering without thecatalog or telephone

Page 62: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 61

Page 63: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 62

Page 64: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 63

Electronic Payment

• Secure payment protocols exist• Most involve a trusted third entity acting as a

gateway to financial networks or directly to abank

Page 65: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 64

Where do we go from here?

Or, what more is needed?

Page 66: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 65

Infrastructure Needed

Public Key Infrastructure• Key creation• Key distribution• Key certification• Key lookup• Key revocation• Locally and Globally

Page 67: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 66

Certificates

• A message• Name, e-mail, public key

-----BEGIN PGP PUBLIC KEY BLOCK-----Version: 4.5

mQCNAjPmUEIAAAEEAMj14c0xswae9XfbMVQeDFq8OVf29+N1745Hey5vkYw7UZUn7K1ehDYK44W+f1Y/Ns4g3lFJNxuFRbPZXUPAc8dlPiBR1xq+wqcoOIm+gpQEd5Dl1EgsUyE+3Si0WQ6zELRvKCWKww6/8egKDaMqQTgMqZFQEqjRFEvspjTJR9s3AAURtAt1c2VyQGRvbWFpbg===Cexv-----END PGP PUBLIC KEY BLOCK-----

Page 68: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 67

Certificate

• Signed by someone trustworthy

Fred Avolio<[email protected]>Public Key:dhe34j3ffhhej345

Page 69: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 68

Summary and Review

Page 70: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 69

EncryptionUses

• Encryption is the encoding of information andcan be used at many different points:

– File encryption for storage (e.g.., for laptops)– Private E-mail– Digital signatures for Doctor Orders– Integrity checking for changes to patient records– Encrypted data in transit

• Router to router encryption• Firewall to firewall encryption at the IP level

Page 71: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 70

Encryption Applications

• Access Control–Use cryptographic functions to distribute

access control lists and privileges• Authentication

–Digital Signatures provide positive proof ofidentity

–Digital certificates used to bind public keyto physical identity

Page 72: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 71

Encryption Applications

• Non-repudiation–Cryptographic functions use to provide

unforgeable proof of receipt or authorship• Availability

–Combination of applications used to reducethe chances of denial of service ormalicious system outages

Page 73: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

7/13/98 Copyright © 1998 Frederick M. Avolio 72

Basic Tools of Cryptography

• Symmetric encryption– Provides secrecy among parties who share a common key

• Message authentication codes– Provides integrity checking and authentication

• Public-key encryption

– Allows someone to receive secret message from people he’s nevermet

– Allows method of exchanging secret keys• Digital signature schemes

– Establishes integrity, authenticity, and non-repudiation• Secure hash functions

– Used to reduce a message to a fixed size for signatureFrom Internet Security presentation at WICS by Bruce Schneier

Page 74: Practical Cryptography: Privacy for Business and E-commerce• Basics of Cryptography—types and methods, Applications— ... – Network and computer security • Training • Policy

73

Practical Cryptography:An Overview

Frederick M. Avolio<[email protected]>


Recommended
Government, Cryptography, and the Right To Privacy

Government, Cryptography, and the Right To Privacy

Documents

Practical Cryptography: Privacy for Business and E-commerce · Practical Cryptography: Privacy for Business and E-commerce ... • Strong (56 bit or better key length) ... • Most

Practical Cryptography: Privacy for Business and E-commerce · Practical Cryptography: Privacy for Business and E-commerce ... • Strong (56 bit or better key length) ... • Most

Documents

Cryptography Yiwei Wu. Outline Why have cryptography History Modern cryptography – Private key – Public key Pretty Good Privacy Conclusion Reference.

Cryptography Yiwei Wu. Outline Why have cryptography History Modern cryptography – Private key – Public key Pretty Good Privacy Conclusion Reference.

Documents

Image Representation Privacy/Cryptography CS 104 October 3, 2011.

Image Representation Privacy/Cryptography CS 104 October 3, 2011.

Documents

Homomorphic Cryptography and Privacy

Homomorphic Cryptography and Privacy

Documents

The Role of Cryptography in Security for Electronic Commerce

The Role of Cryptography in Security for Electronic Commerce

Documents

Electronic Commerce: Privacy, Security, and Control

Electronic Commerce: Privacy, Security, and Control

Documents

Privacy and Security in Mobile E-Commerce

Privacy and Security in Mobile E-Commerce

Business

Privacy and e-commerce: a consumer-centric perspective and ecommerce.pdf · Privacy and e-commerce: a consumer-centric perspective ... Abstract Privacy is an ancient concept, ...

Privacy and e-commerce: a consumer-centric perspective and ecommerce.pdf · Privacy and e-commerce: a consumer-centric perspective ... Abstract Privacy is an ancient concept, ...

Documents

Control and Assurance in E-Commerce: Privacy, Integrity ...faculty.som.yale.edu/shyamsunder/Research/Accounting and Control... · Control and Assurance in E-Commerce: Privacy, Integrity,

Control and Assurance in E-Commerce: Privacy, Integrity ...faculty.som.yale.edu/shyamsunder/Research/Accounting and Control... · Control and Assurance in E-Commerce: Privacy, Integrity,

Documents

A novel privacy preserving visual cryptography based ... · A novel privacy preserving visual cryptography based scheme for telemedicine applications. Hare Ram Sah1*, G. Gunasekaran

A novel privacy preserving visual cryptography based ... · A novel privacy preserving visual cryptography based scheme for telemedicine applications. Hare Ram Sah1*, G. Gunasekaran

Documents

Privacy Preserving Secure Data Aggregation for Wireless ... · Key words: Elliptic curve cryptography, in-network processing, privacy homomorphism, secure data aggregation, wireless

Privacy Preserving Secure Data Aggregation for Wireless ... · Key words: Elliptic curve cryptography, in-network processing, privacy homomorphism, secure data aggregation, wireless

Documents

DS-06-2017: Cybersecurity PPP: Cryptography PRIViLEDGE Privacy-Enhancing Cryptography ... · 2019. 7. 2. · D6.3 – First Scientific & Research Impact Measurement [ABL+19b] Behzad

DS-06-2017: Cybersecurity PPP: Cryptography PRIViLEDGE Privacy-Enhancing Cryptography ... · 2019. 7. 2. · D6.3 – First Scientific & Research Impact Measurement [ABL+19b] Behzad

Documents

Department of Commerce Privacy Awareness. August 1, 2005 2 What is privacy protection? Privacy protection includes the protection of the personal privacy.

Department of Commerce Privacy Awareness. August 1, 2005 2 What is privacy protection? Privacy protection includes the protection of the personal privacy.

Documents

Preservation of privacy in public-key cryptography

Preservation of privacy in public-key cryptography

Documents

Spencer: Privacy and Predictive Analytics in E-commerce

Spencer: Privacy and Predictive Analytics in E-commerce

Documents

Visualj Cryptography for Biometric Privacy

Visualj Cryptography for Biometric Privacy

Documents

K. Salah1 Cryptography Module III. K. Salah2 Security Services Confidentiality/Privacy Confidentiality/Privacy Has to do with hiding information. Only.

K. Salah1 Cryptography Module III. K. Salah2 Security Services Confidentiality/Privacy Confidentiality/Privacy Has to do with hiding information. Only.

Documents