Encryption and Its Application to E-commerce

The following steps will lead you to a better understanding of the whole literature:

1. Realize the major concerns in e-commerce are confidentiality, integrity, authenticity, and
non-repudiation.

2. Understand major difference the public key encryption from symmetric key encryption is that it
used two keys - public key and private key. This provides great convenience in key deployment
and other security service features.

3. Know how confidentiality, integrity and authenticity services are provided using a public key
encryption scheme, such as RSA.

4. Know what digital signature (DS) is and how to create a DS.

5. Add knowledge from 3 and 4 together you will understand how a workable authentication and
secure transmission system can be implemented

6. Understand that we need a trusted third party (TTP) to issue digital certificate. This TTP is a
certificate authority (CA). CA uses its own private key to send the digital certificate to users for
authentication purposes.

7. Know that e-commerce is mainly based on the web, so that we need secure socket layer (SSL)
and S-HTTP to secure data transmissions. Also we need security electronic transaction (SET)
for payment transactions.

Brief Q/As:

1. Review the definitions of confidentiality, integrity, authenticity, and non-repudiation in the

slides.

2. Review the definition of encryption, symmetric key encryption, and public key encryption.

3. How confidentiality is implemented using encryption?

Answer: A sender can use the receiver's public key to encrypt the message. Then receiver uses
his/her private key to decrypt the message. Since public keys are publicly accessible, there is no
problem to do so. The problem is now how the receiver knows the message is really sent by the
sent as it is claims. This is an authentication issue.

4. How authentication is implemented using encryption?

Answer: A sender can use his/her own private key to encrypt the message. Then the receiver uses
the sender's public key to decrypt the message. The problem is that anyone else can release the
message contents. Therefore, a combination of the two approaches can be used to create a
1
encryption system that provides both confidentiality and authenticity services. The reversibility of
public key encryption plays an important role in these applications.

5. How is a digital signature generated?

DS is used to provide authentication service for sending message from one user to another. Two
steps are needed: 1) using hash algorithm to generate a digest from the message to be sent, 2) using
sender's private key to encrypt the digest. The encrypted digest then becomes the sender's digital
signature.

6. What service can a digital signature provide for a secure transmission?

1) Authenticity, and 2) Integrity.

7. What is a workable secure transmission scheme?

The following diagram shows how Alice can send a message to Bob with three security features:
1) confidentiality 2) Integrity and 3) authenticity.

Message 5
Alice 4
Bob

3 7
1 6

Step1: Alice uses the Hash algorithm to extract a fix-sized data block, called digest
Step2: Alice uses her own private key to encrypt the digest to generate her digital signature.
Step3: Alice encrypts the message and digital signature together using Bob's public key.
Step 4: Bob decrypts the encrypted message received from the network using his private key.
Step 5: Bod uses the same Hash algorithm to generate a digest from the message he received.
Step 6: Bob uses Alice's public key to decrypt the digital signature and obtains the digest created
by Alice.
Step 7: Bob compares the two digests, one sent by Alice and another generated from the message
by him. If they match, the message is original.

2
So, Step 2 and Step 6 are designed for authentication. Step 3 and 4 are designed for
condifentiality. Step 1, 5, and 7 is for integrity purpose.

Key points:

1) Some information is encrypted twice and decrypted twice. This is for digital signature
2) Hash algorithm is used for extracting information to a fix-size data block. Hash algorithm can
uniquely convert a file to another one. The converted file could match more than one original
files. However, if someone want to recover the oginal from the digest file it is computationally
impossible. This means practically it is not possible for find a file that can be converted to the
same digest as is generated from another file.

8. Whether the above scheme safe enough? How can we improve it?

Not secure enough. It is because both Alice and Bob need their counterpart's public key. How can
Bob tell if a public key claimed being sent by Alice is really sent by Alice? Someone else may
pretend to be Alice and send Bob a fake public key. Then all messages Bob receives could be
actually sent by the third person and Bob would never know this. In the similar way, Alice may
send the message to another person pretending to be Bob. Therefore, we need a Trusted Third
Party (TTP) to help them. The TTP here is called certificate authority (CA). CA creates and
manages keys for Bob and Alice. When Alice and Bob request the keys, CA generates the keys and
sends digital certificates to Bob and Alice respectively. Bob and Alice can search for their
counterpart's public key from the CA's web site.

Another issue is CA must guarantee the authenticity of the digital certificate issuance. So, the CA
can use its own private key to send digital certificates to Bob and Alice. Bob and Alice and verify
the authenticity using the CA's public key that is downloadable form the CA's site.

So far we have linked major concepts in encryption/decryption together. We need to see how the
above mechanism can be applied to real e-commerce applications.

9. How is the above mechanism used in e-commerce?

SSL and S-http are based on the above mechanism. SSL runs between http and TCP. S-http
replaces regular http protocol. SET is operated on upper level of these two protocols with
application-oriented features. (see the figure)

3
 SET PGP
S/MIME

HTTP or FTP SMTP

S-HTTP

SSL or TLS

TCP

IP/IPSec

Introduction to Encryption
Introduction
A secure computing environment would not be complete without consideration of encryption
technology. The term encryption refers to the practice of obscuring the meaning of a piece of
information by encoding it in such a way that it can only be decoded, read and understood by
people for whom the information is intended. It is the process of encoding data to prevent
unauthorized parties from viewing or modifying it.
Encryption
Encryption is said to occur when data is passed through a series of mathematical operations that
generate an alternate form of that data; the sequence of these operations is called an algorithm. To
help distinguish between the two forms of data, the unencrypted data is referred to as the plaintext
and the encrypted data as ciphertext. The security of encryption lies in the ability of an algorithm to
generate ciphertext that is not easily reverted to the original plaintext.
In a very simple example, encryption of the word "secret" could result in "terces." Reversing the
order of the letters in the plaintext generates the ciphertext. This is a very simple encryption - it is
quite easy for an attacker to retrieve the original data. A better method of encrypting this message
might be to create an alternate alphabet by shifting each letter by some arbitrary number. This is
known as a substitution cipher, a form of encryption that is still used in puzzle books today. For
example, encrypting the word "secret" with an alphabet shifted by 3 letters to the right (Figure 1.)
produces "vhfuhw." A substitution cipher simply exchanges one letter or word with another. This
particular algorithm is called the "Caesar Cipher"
another. This particular algorithm is called the "Caesar Cipher"
Normal alphabet: abcdefghij kl mnopqr s t uvwxyz
Alphabet shifted by 3: def ghij klmnop qr s t uvwxyz abc

Figure 1. The Caesar Cipher and the encryption of the word "secret"

4
Keys
In the quest for a more secure method of protecting information, the introduction of a key adds
another level of security. A key is a piece of information that allows only those that hold it to
encode and decode a message. Keys come in many different forms such as passwords, numbers
generated by an algorithm, digital fingerprints and even electronic devices that work like door
keys. It is a series of numbers or symbols that are used to encode a message so that it can only be
read by someone in possession of that key or a related key. A key allows both the sender and the
recipient of the message to understand how the message has been encrypted and assures them that
nobody else knows how it has been encrypted. It is the key that enables the recipient to properly
decode the message.
Using the previous example of a substitution cipher, anyone who knows the Caesar Cipher can
decrypt all messages encrypted with it, regardless of who actually encrypted the message. One
could strengthen the substitution cipher with a key, by choosing an arbitrary number and using that
as the number of letters by which to shift when creating their alternate alphabet. That number
therefore becomes the key by which the message is unlocked.
The individual who is sending the message communicates the key to the recipient of the message,
allowing them to unlock it. One disadvantage of this system is that an attacker can decrypt the
message if the key is intercepted. To protect the key, encryption can be used during communication
or the key can be sent in a separate communication.
Symmetric and Asymmetric Encryption
There are two general categories for key-based encryption - symmetric and asymmetric. Symmetric
encryption uses a single key to encrypt and decrypt the message. This means the person encrypting
the message must give that key to the recipient before they can decrypt it. To use symmetric
encryption, the sender encrypts the message and, if the recipient does not already have a key, sends
the key and ciphertext separately to the recipient. The recipient then uses the key to decrypt the
message. This method is easy and fast to implement but has weaknesses; for instance, if an attacker
intercepts the key, they can also decrypt the messages. Furthermore, single key encryptions tend to
be easier for people to ?crack?, which means that the algorithm that is used to encode the message
is easier for attackers to understand, enabling them to more easily decode the message.
Asymmetric encryption, also known as Public-Key encryption, uses two different keys - a public
key to encrypt the message, and a private key to decrypt it. The public key can only be used to
encrypt the message and the private key can only be used to decrypt it. This allows a user to freely
distribute his or her public key to people who are likely to want to communicate with him or her
without worry of compromise because only someone with the private key can decrypt a message.
To secure information between two users, the sender encrypts the message using the public key of
the receiver. The receiver then uses the private key to decrypt the message. Unlike with single or
shared keys, in the asymmetric key system only the recipient can decrypt a message; once the
sender has encrypted the message he or she cannot decrypt it. The private key is never distributed,
therefore an attacker cannot intercept a key that decrypts the message.
Common Uses of Encryption
Authentication
5
Authentication is the process of logging in, signing on or otherwise presenting information or
oneself in a manner that proves his or her identity. The most common example of authentication is
the use of a username and password to gain access to a system, network or web site. The username
and password combination is often referred to as a person?s credentials and it is frequently sent
over networks. Encryption is used to protect these credentials. If no encryption is used to protect
the information as it is sent over the network, an attacker could capture those credentials and
assume the identity of the originator.
Validation ? Fingerprints and Digital Signatures
Validation describes the ability to provide assurance that a sender?s identity is true and that a
message, document or file has not been modified. Encryption can be used to provide validation by
making a digital fingerprint of the information contained within a message. A digital fingerprint is
a code that uniquely identifies a file or a message by reflecting the content of the file with
tremendous specificity.
The encryption program produces the digital fingerprint by performing a byte-by-byte
mathematical analysis of the message. Any attempt to modify the message will change the
fingerprint. Comparison between a fingerprint known to be good and one sent to the recipient can
indicate whether or not the message has been modified. While a fingerprint can indicate that the
message has not been tampered with, it does not assure the recipient of the identity of the sender.
For that assurance, the sender can utilize a digital signature.
A digital signature is a piece of information that proves the identity of the sender. It is a digital ?
stamp? or ?personal seal? that is made using a private key. A sender can electronically or digitally
sign a message and its fingerprint before delivery to a recipient. Upon receiving the message, the
recipient verifies this signature, using the public key that the sender has previously communicated,
indicating that the sender is the expected person. The recipient can verify the fingerprint of the
message. Upon validation, the recipient can be reasonably sure that the message came from a
trusted person and that the contents of the message have not been modified.
Data Protection
Probably the most widely-used application of encryption is in the area of data protection. The
information that a business owns is invaluable to its productive operation; consequently, the
protection of this information is paramount. For people working in small offices and home offices,
the most practical uses of encryption for data protection are file and email encryption.
Encryption of files protects the data that is written to the hard disk on the computer. This
information protection is vital in the event of theft of the computer itself or if an attacker
successfully breaks into the system. However, file encryption becomes more difficult to use and
manage if the office has multiple employees. Because each employee needs the encryption key,
protection of the key becomes a more difficult task. The more people who have access to
encryption keys, the less effective encryption becomes. The risk of loss, theft or compromise of
information rises as the number of users increases. Files that have been encrypted are also
vulnerable to employees who leave the organization or who are disgruntled and may want to cause
the organization harm.
6
Email encryption can be used more easily in office environments as private encryption keys are not
generally shared among users and each user has a separate mailbox. When sending a message to
multiple recipients, it can be encrypted for each person individually. The encryption key is
therefore still private to the sender.
Secure Socket Layers ? Encryption for E-Commerce
While we have discussed encryption in the context of file protection and e-mail security, it is also a
valuable security resource for web-based information exchange. The small office/ home office or
personal computer user often sees this when doing business via web sites. E-commerce web sites
use SSL (Secure Sockets Layer) to protect important information such as credit card numbers as
they travel across the network. SSL creates a private communication path between the web browser
and the web server, encrypting all information that goes between the systems. Most common web
browsers have SSL support built in and e-commerce companies can purchase or get freely
available web servers that support SSL.
Virtual Private Networks
The use of encryption has been extremely valuable in the increase of people who are able to work
from home. Encryption provides a secure means for users to connect to their employer?s network
from outside of the home or office. Virtual Private Networks (VPN) allow remote users to connect
to the home- and small-office network from distant places via the Internet by creating an encrypted
path to that network. This is useful when cooperating with other organizations, working from
remote locations or allowing remote users access to the local network.
Security, Encryption and the Small Office/ Home Office User
The use of encryption alone does not guarantee security; rather, it is one piece of a more complex
security puzzle. Encryption can provide a higher level of security when implemented in
conjunction with other security measures as it protects data during storage and when
communicating information between parties. It is important to note that encryption does not protect
the user or network from other security threats such as viruses, network attacks and system
compromise. Encryption can be very useful in protecting information that is being transmitted from
one computer to another; however it does nothing to protect the integrity of the channels along
which those messages travel. As such, it has no bearing on denial of service attacks, port scanning
and other network attacks.
Encryption and Viruses
Viruses infect computers many different ways, some of the most common methods are via file
transfer and email. In and of itself encryption does not prevent the transmission of malicious code
of any kind. However, the use of encryption as a validation mechanism can provide a higher level
of trust when receiving files and information from other people by ensuring that the source and
contents of the message are trusted. Digital signatures and message fingerprints can provide
reasonable assurance that the file originates from the expected party and that it has not been
tampered with. Encryption does not necessarily solve the problem completely though - a trusted
source may unsuspectingly send an already infected file that is then validated.
Denial of Service Attacks
Encryption can protect a user's credentials from capture, but is somewhat helpless against attacks
that are intended to compromise a system. System compromise results from attacks against an
7
operating system feature or service, and can only be rectified by secure development practices and
analysis of the software. Encryption does not protect against network attacks such as denial of
service, port scanning and other information gathering tactics. These attacks are generally
independent of the use of encryption within a network or system.
Encryption for Small Offices/Home Offices? Pros and Cons
Implementation and Use
When working in or establishing a small office and home office environment it is important to
establish the need for security of company files, data and information. Encryption can help provide
a high level of security, but there are other pertinent factors that can help users decide if it is the
best solution for their needs.
Aside from the technical aspects and benefits of it encryption technology, it is important to
consider the surrounding business issues with the use of encryption. Cost and technical support
along with ease of implementation and use are factors that merit consideration. Encryption
technology is very complex and requires deep technical knowledge to be implemented properly.
The implementation often requires additional hardware and software, as well as the aid of technical
experts to setup the system. As well, as a business enterprise grows, costs for encryption may also
increase. It is vital that small office and home office users decide whether or not encryption is
necessary or justified for their security purposes before undertaking the monetary and time
commitments required to implement encryption properly.
There are many commercial packages that provide data encryption, network security and other
features. Commercial vendors make encryption technology easy to use by helping them with
installation, setup and the support of experts. They also provide simple user interfaces that make
them easy to use. The cost for this level of involvement and support is high.
As an alternative to these commercial applications, free encryption technology can be found on the
Internet; however, they may require a high degree of technical understanding because the
installation, setup, use and management falls on the shoulders of the business and its users. Users
must rely on Internet mailing lists and newsgroups for information, as dedicated support resources
are often unavailable. In short, there are monetary and complexity costs that need consideration
with both commercial and alternative packages.
What is a Virtual Private Network (VPN)?
A VPN or Virtual Private Network is a network connection that enables you to create a secure
connection over the public Internet to private networks at a remote location. With a VPN, all
network traffic (data, voice, and video) goes through a secure virtual tunnel between the host
device (client) and the VPN providers servers, and is encrypted. VPN technology uses a
combination of features such as encryption, tunneling protocols, data encapsulation, and certified
connections to provide you with a secure connection to private networks and to protect your
identity.
VPN connections technically give you all the benefits of a Local Area Network (LAN), which is
similar to that found in many offices but without requiring a hard-wired connection.
Early VPNs were often set up to give individual employees secure remote access to their company
networks, hence the name virtual private network. By connecting to the companys network, an

8
individual employee can access all the companys resources and services as if the employee were
inside the company.
Since then, VPNs have evolved to provide the same level of secure communication between any
device on the internet. Today, using VPN is increasingly popular among consumers as a means to
protect their privacy online, secure their browsing sessions, and get unrestricted access to content
or websites that are otherwise blocked or censored.

Types of VPNs
VPNs differ by architecture, purpose of usage, and accessibility. Two basic types of accessibility
are site-to-site VPN and remote access VPN.

Figure 1. Site-to-Site VPN and Remote Access VPN connecting to a Corporate Network
Site-to-site VPNs are used in the corporate environment. A site-to-site VPN ensures the safe
encrypted connection of two or more local area networks (LANs) of the same company or of
different companies. It means two geographically separated offices are virtually bridged together
into a single LAN and users can access data throughout this network.
Remote Access VPNs connect an individual computer to a private network. This type of VPN can
be divided again into two groups:
Corporate VPNs Corporate VPNs allow business travelers and telecommuters to connect
to their company networks and remotely access resources and services on the networks.
When a user connects his/her device to the companys VPN, the VPN thinks that the users
computer is on the same local network as the VPN.
Personal VPNs Personal VPNs provide consumers with the same private and secure
connection as the corporate VPNs. However, personal VPNs are not used to connect to
private networks to access private resources.
Nowadays, consumers use personal VPN services mainly to browse the web anonymously,
secure their web browsing sessions at public WiFi with HTTPs encryption, and bypass
internet restrictions to get access to blocked websites and internet services (i.e. Skype,
Gmail).

9
Personal VPN services are especially useful when connecting to a public WiFi network. It is
estimated that nearly 90% of public WiFi networks are not secured. By using a VPN service, all
your internet communications will be encrypted, making it almost impossible for hackers and
snoopers to read and steal your private information.
There are many personal VPN service providers available for consumers to choose from, with
many offering VPN services to consumers for free or for a low monthly subscription fee. These
services also make it easy and quick for you to install and use a VPN on practically any platform,
including mobile and tablet devices.

Benefits of Masking Your IP Address

A VPN masks your IP address, giving you much greater privacy for your online activities.
Unshielded, this IP address the unique address for each device on the internet can be misused to
reveal your identity, location, ISP, and even the specifics of your online activity.
When you use a VPN, your IP address is masked so you can surf the web anonymously. Thus, no
one can find out where you connect from or what you do online.
Moreover, by exchanging your IP address with the VPN servers IP address, you can virtually
connect from a geographic location that is different from where you are physically located.
For instance, you may be sitting inside a coffee shop in Dubai, but by connecting to a remote VPN
server, you can appear to connect to the Internet from another location (i.e. San Francisco or New
York) which hosts the VPN server youre connecting to.
This enables you to bypass regional internet restrictions and get access to content (i.e. YouTube,
Facebook) or internet services (i.e. Skype, Gmail, Viber) that are otherwise restricted or censored
in the location you are staying in.

VPN Hardware and Software

VPN is a client-server technology that is made up of hardware and software components on both
the client (user) side and the server side. As VPNs have progressed from a corporate tool into
todays personal VPN, the installation requires no additional hardware on the user side other than
the computer or device for accessing the internet.
10
Client (your computer)
The hardware is the personal computer, smart phone or tablet
The software is the VPN client app running on your device

VPN Server
The hardware are server computers and traffic routers
The software controls the traffic routing and communication between the servers and the
client (your computer).

VPN traffic flow

Both inbound and outbound traffic is routed through VPN servers. Depending on the traffic
direction, the data is encrypted and decrypted either on the clients computer or on the VPN server.
For example, lets assume you want to watch video on YouTube. You search for the video on
YouTube and play it. Since this is outbound traffic, this data is encrypted on your computer by the
VPN client.
Encrypted commands are sent to the closest VPN server, which then forwards the encrypted
commands through the network of the servers to the gateway server, where the command is
decrypted and sent through the public internet to YouTube.
As the video is played, since it is inbound traffic, the process is repeated in reverse. The video
stream goes to the VPN server where it gets encrypted, sent to the closest client server, and
forwarded to the client where it is decrypted and played in the clients internet browser. You, as the
user (client), get the IP address of the VPN gateway server so it is difficult to track down your real
IP address and pinpoint your geographical location.

Security at the packet level

VPN security begins at the data packet level the basic building block of online communication.
Each data packet is encrypted, packaged in multiple envelopes, and treated as a certified letter.
Taken together, these steps ensure data is secure even against deep data packet analysis and
potential eavesdropping anywhere between the two connected computers.

Encryption
Full data encryption is a basic element in a VPN. With a VPN, all traffic between the two
computers is encrypted and isolated in a secure tunnel, shutting out ISPs from eavesdropping and
logging your web activity.
Encryption for devices connected to a VPN goes beyond just web browsing. It includes VOIP
communication, Skype, emails anything that uses an online connection. This gives you more
comprehensive protection than a proxy server, which is limited to only shielding your web
browsing activity.

11
Envelope Strategy
VPNs use various tunneling protocols to encapsulate data packets for secure transit. Tunneling
protocols essentially place the individual data packets open postcards with the names of the
sender and recipient and the data payload into new sealed envelopes marked with the IP address
of the VPN. Each envelope contains and conceals the earlier message envelopes. In addition to the
layered envelopes, the original message within is also encrypted.

Point-to-point Communication
When a VPN tunnel connection is opened up, it authenticates sender identity and the integrity of
the sent messages. Similar to a registered letter providing point-to-point communication, it ensures
that no unauthorized people can intercept the message and that data packets are not tampered with.

VPN Security Protocols

In the pursuit of creating a virtual private network, with its combination of tunneling, encryption,
and data encapsulation, security experts have created three different families of VPNs, each with
their own specific characteristics: IPsec, PPTP, and SSL. There is no one-size-fits-all list of specs
for a VPN. Computer experts primarily divide them by technical details and consumers distinguish
them by ease of use and portability.

IPsec Family
Internet Protocol Security (IPsec) With IPsec, all application traffic is secured across an
IP network. IPsec protocol provides session authentication and data packet encryption
between the two connected parties. It is primarily designed for protecting the data flows
between networks (network-to-network) and the individual workers remote connection to
the company network.
Layer 2 Tunneling Protocol (L2TP) L2TP is used to make a tunnel between two L2TP
control connection endpoints. Because it does not provide any encryption or authentication
features by itself, it is usually paired with an encryption protocol such as IPsec.

PPTP family
Point Tunneling Protocol (PPTP) uses a point-to-point protocol to make a direct connection
between two nodes. It was the first VPN protocol to be supported by Microsoft Dial-up
Networking and has been bundled into all releases of Microsoft Windows since Windows 95. The
Microsoft connection has been an important part of PPTPs acceptance in the market.
While the PPTP protocol has the advantage of a pre-installed client base on Windows platforms,
analysis by cryptography experts have identified several security issues such as its vulnerability to
password guessing attacks.

12
SSL family
Secure Sockets Layer (SSL) and Transport Layer Security (TLS) SSL is commonly
used to secure online shopping as a users web browsers can almost transparently switch to
SSL without requiring additional configuration or extra software. SSL was the industry
standard before it evolved into Transport Layer Security. The SSL protocol works at the
application level independent of the specific network. The sockets part of the term refers
to the sockets method of passing data back and forth between a client and a server or
program layers in the same computer.

SSL uses the public-and-private key encryption system from RSA, which also includes the
use of a digital certificate. TLS and SSL are an integral part of most Web browsers (clients)
and Web servers.
Open VPN OpenVPN is an open source VPN based on the SSL protocol that is focused on
organizations in the SME (Small and Medium Enterprise) and enterprise segment. It
provides portability, ease of configuration, and compatibility with NAT (Network Address
Translation) and dynamic addresses.

13