session 13 secure messaging using digital certificates

Session 13Secure Messaging Using Digital Certificates

©If appropriate, Insert your organization’s copyright information

Secure Messaging Using Digital Certificates

Session 13

George G. McBride, CISSP

Tuesday (9/30) 1:30 PM – 3:30 PM


About Me

Senior Manager at Lucent Technologies leading the risk assessment and “ethical hacking” team (about 5 Years)

Responsible for application, network, architecture, and process assessments

Formerly a consultant at Global Integrity performing risk assessments and ethical hacking (about 3 Years)


Goals of this afternoon’s talk

We’ve only got 90 minutes We’re supposed to talk about…

– Cryptography concepts and functions– Keys to the kingdom: public, private and

hybrid– Basic Components of a Public Key

Infrastructure (PKI)– Effective certificate management through

issuance, revocation, renewal, expiration, and disposal


Goals (Continued)

And also talk about…– Private key management considerations– How PKI is addressed by:

• Windows 2000 Server Certificate Services• Windows 2000 Server Advanced Security – Key

Management Service• Windows 2003 Server

We should have some time for questions


Do we need encryption?


E-Mail Risks

Risks associated with E-Mail– Theft of proprietary information – Eavesdropping– Impersonation of users/clients/servers (“spoofing”)– Interception/modification of information before it

arrives at its final destination– Interception/re-direction of information to other

destinations– Offensive/threatening correspondence– Deliberate Denial-of-service attacks (DoS) that

exploit the inherent weaknesses of IP networks – Bugs in protocol implementation (SMTP, other)


Objectives of Secure E-Mail

Confidentiality– Protection from disclosure to unauthorized persons

Integrity,– Maintain data consistency

Authentication– Assurance of identity of person or originator of data

Non-repudiation– Originator of communications can’t deny it later


What Can We Do?

Encryption– Protects message and attachments from unauthorized persons

(confidentiality/integrity)

Digital Signatures– Positively identify the sender (authentication/ non-repudiation)

Digital Certificates– A third party is used to certify the authenticity of the message

(confidentiality/integrity/authentication/ non-repudiation)

Other Protection– Anti-Virus, Content Filtering


What is encryption?

– Method of transforming original data (plaintext/cleartext) into a form that appears to be random or unreadable (cyphertext)

– Dates back to 1900 (BC) hieroglyphics

– Evolved from a method of reflecting events (hieroglyphics) to a method of hiding information


Cryptography TimelineEgyptian scribe uses non-standard hieroglyphs in an inscription

1900BC

500-600 BC

Julius Caesar used a simple substitution with the normal alphabet in government communciations.

50-60 BC

Thomas Jefferson invented the wheel cipher. This was re-invented in several forms later and used in WW-II by the US Navy as the Strip Cipher, M-138-A.

Blaise de Vigenère wrote a book on ciphers, including the first authentic plaintext and ciphertext autokey systems (in which previous plaintext or ciphertext letters are used for the current letter's key).

1585 1790’s

During the Civil War, possibly among other ciphers, the Union used substitution of select words followed by word columnar-transposition while the Confederacy used Vigenère

1861-1865

The Enigma Machine was not a commercial success but it was taken over and improved upon to become the cryptographic workhorse of Nazi Germany.

1933-1945

A design by IBM, based on the Lucifer cipher and with changes (including both S-box improvements and reduction of key size) by the US NSA, was chosen to be the U.S. Data Encryption Standard (DES).

1976

Whitfield Diffie and Martin Hellman published ``New Directions in Cryptography'', introducing the idea of public key cryptography.

Rivest, Shamir and Adleman publish the RSA public key algorithm.

1977-1978

International Data Encryption Algorithm (IDEA) is proposed (DES replacement). IDEA uses a 128-bit key.

1990


Cryptography Timeline

Phil Zimmermann released his first version of PGP (Pretty Good Privacy) in response to the threat by the FBI to demand access to the cleartext of the communications of citizens.

1990

Charles H. Bennett, Gilles Brassard published their experimental results on Quantum Cryptography, which uses single photons to communicate a stream of key bits for some later Vernam encipherment of a message (or other uses). Assuming the laws of quantum mechanics hold, Quantum Cryptography provides not only secrecy but a positive indication of eavesdropping and a measurement of the maximum number of bits an eavesdropper might have captured. On the downside, QC currently requires a fiber-optic cable between the two parties.

1991 1994

Ron Rivest, author of the earlier RC2 and RC4 algorithm, published a proposed algorithm, RC5, on the Internet.

National Institute of Standards and Technologies announces that 56-bit DES is no longer sufficient and recommends use of Triple DES.

Digital Signature Algorithm (DSA) Banking Standard is published (ANSI X9.30)

1995Digital Signature Algorithm (DSA) Federal Standard is published (FIPS PUB 186)

1999 2000

The U.S. government issues new encryption export regulations that make it much easier for companies and individuals in the United States to widely export strong encryption in common products regardless of their strength or the type of technology they use.


Encryption 101

Encryption Concepts/Definitions

– Cryptography: science of using mathematic algorithms to hide the meaning of a communication (message)

– Cryptoanalysis: science of studying and breaking the secrecy of encryption algorithms and their necessary pieces (“crypto cracking”)

– Encryption: process of turning plaintext into ciphertext

– Decryption: process of turning ciphertext into plaintext


Encryption 101

Encryption Concepts/Definitions (cont.)

– Requirements for encryption and decryption:

• an encryption algorithm • a key

– Types of Ciphers or Encryption:

• Symmetric (“same key” – shared secret key)

• Asymmetric (public key/private key pair combination)

• Hybrid (uses a combination of symmetric and asymmetric encryption)

• Note: secret <> private key


Encryption 101

Components of Modern Encryption Systems

– Encryption Algorithms

• Symmetric (DES, Triple DES, etc.)• Asymmetric (RSA, Elliptic Curve, etc.)• Hybrid = Symmetric + Asymmetric Algorithms

– Message Digest Functions (“one-way hash”)

• Hashing algorithm - validates that the message has not been tampered – message authentication

• Uses message and a hashing algorithm to create the message digest (included in the message transmission)

• One-way hashing function is kept secret between the sender and receiver


MAC Types


HMAC

Keyed Hashing for MAC From RFC 2104:

– HMAC(text) = H(K XOR opad, H(K XOR ipad, text))– Where H is some hashing function, ipad=0x36, opad=0x5c, K is

the cryptographic key (appended with 0’s to length B)– Hash function (ie, SHA-1, MD5) independent– Provides authentication through the use of a shared secret key– Keys must be chosen at random or using a cryptographically

strong pseudo-random generator seeded with a random seed), and periodically refreshed.


Digital Signatures

Provide non-repudiation and authentication

Significant as a legal tool:– Evidence: authenticates the sender– Ceremony: Calls attention to signing– Approval: Expresses signer’s approval– Efficiency: Provide clarity and finality


Symmetric Key Cryptography

Uses the same, shared secret key to encrypt and decrypt messages between parties



Generally speaking, larger key sizes increase the strength of the protection

– 16 bit key = 216 = 64,536 possible keys– 56 bit key = 256 = 72 quadrillion possible keys (72,057,594,037,927,936)– 57 bit key = 257 = 2 * 72 quadrillion = 144 quadrillion– 58 bit key = 258 = 22 * 72 quadrillion = 288 quadrillion– …– 128 bit key = 2128 = 256 * 288 quadrillion =

340,282,366,920,938,000,000,000,000,000,000,000,000 Possible Keys

A larger key space increases the difficulty of “brute-forcing” the key



Advantages:– Much faster than asymmetric (details to follow) encryption

systems

– Becomes exponentially harder to break as the key size increases

Disadvantages:– Scalability: each pair of sender/receiver will require a unique

key • (number of keys grows exponentially – more time

consuming/difficult to manage)• It will become unmanageable


Symmetric Key Cryptography More Disadvantages:

– Key Distribution: Secret key must be sent in a secure fashion separate from encrypted message

– Limited Security: Only addresses confidentiality of message (not integrity, authentication or non-repudiation)

– The more the key is used, the more the key is exposed to being identified

If the intruder sniffs and captures traffic for a period of time, they may be able to eventually identify the key being used, then being able to decypher previous and current/future traffic

– Cannot be used for digital signatures

Digital signatures use the user’s private key which can only reside in one location – the owner’s machine – to uniquely identify the individual



Symmetric Encryption Systems

• Data Encryption Standard (DES) 64 bit (56 bit key + 8 parity bits) Performs 16 iterations of substitutions and transpositions considered unsafe for financial purposes since 1998

• Triple-DES (3DES) Uses same algorithm as DES (3 keys – 3 times) 112 bit (2 keys) – 168 bit (3 keys) ~ 120 bit strength Performs 48 iterations (16 * 3) of substitutions and

transpositions using 2-3 different keys



Symmetric Encryption Systems

– Advanced Encryption Standard (AES) Uses Rijndael Encryption algorithm (NIST choice to replace DES) Uses 128, 192 or 256 bit keys (variable) US official standard for sensitive but unclassified data encryption

– International Data Encryption Algorithm (IDEA) Uses 128 bit key

– Blowfish Uses up to 256 bit keys (variable)

– RC5 (Rivest Cipher 5) Uses up to 2048 bit keys (variable)



Why do we need anything else?– It’s Fast, but doesn’t scale too well


Asymmetric Key Cryptography


Diagram Page

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

1996 1997 1998

Diskette

E-mail

Download

Don’t know


Key Points

List the 4 or 5 main topics you plan to discuss

This is a main topic This is another main topic This is another main topic This is another main topic


Screen Print Page


Summary

Conclusion #1 Conclusion #2 Conclusion #3 Conclusion #4 Conclusion #5

session 13 secure messaging using digital certificates

Documents