Documente Academic
Documente Profesional
Documente Cultură
Note: Most material from Harris, Shon. (2003). All-In-One CISSP Certification Exam Guide. New York: McGraw-Hill/Osborne.
4.1 Identify and explain hashing, symmetric, asymmetric (chpt. 5) 4.2 Understand cryptography and confidentiality, integrity (digital signatures), authentication, non-repudiation (digital signatures), access control (Chpt. 5) 4.3 PKI: certificates, certificate policies, revocation, trust models (Chpt. 5) 4.4 Crypto standards and protocols (Chpt. 5) 4.5 Key Management and Certificate Lifecycles (centralized v. decentralized, storage, escrow, expiration, revocation, suspension, recovery, renewal, destruction, key usage (Chpt. 6)
Sources of Lecture
Slides are drawn from several sources. Some research from Conklin, W. A., G. White, C. Cothren, D. Williams, R. Davis. (2004). Principles of Computer Security. Boston: McGraw-Hill Technology Education. Also material from Schneier, B. (2000, 2004). Secrets & Lies: Digital Security in a Networked World. Indianapolis: Wiley Publishing, Inc. Most of this material from Harris, Shon. (2003). AllIn-One CISSP Certification Exam Guide. New York: McGraw-Hill/Osborne.
Exam 1
Real exam is 90 minutes for 100 questions, you must get a score of 764, and your points are normalized from 100 to 900 points (i.e., changed in scale Our exam 1 will be from real Security + exams, and will cover sections that are matched to the chapters in our text, our lectures and the Schneier book. First exam will have 60 multiple choice questions.
History of Cryptography Common elements of all cryptographic systems Cryptographic systems strength Types of ciphers Government involvement Symmetric and asymmetric encryption Digital signatures and certificate authorities Cryptography in real networks PKI
Outline, contd.
Key escrow Methods of Encryption Symmetric cryptography in Networks Asymmetric cryptography in Networks Hybrid systems PKI CA Message Integrity and Hashes Digital Signature One time pad
Outline, contd
Key management Hardware vs. software key management Email standards, MIME, S/MIME, PEM, MSP Standard cryptography used in networks of interest Attacks on crypto systems
History of Crypto
The Code Book Substitution cipher Transposition cipher Monoalphabetic substitution Scytale cipher Caesar cipher Mary Queen of Scots Benedict Arnold Enigma and Turing Windtalkers Lucifer
Cryptanalysis. Trying to figure out the message without the key. Algorithm. Set of mathematical rules that dictate enciphering and
deciphering. Not part of the encryption process, widely known.
Key.
The key is the secret part of the process. An algorithm contains a keyspace, which is a range of values that can be used to construct a key. Key is random values within the keyspace range. The larger the key space, the more values can be used, and some think the safer the key, although Schneier disagrees.
Keyspace: Possible values to construct keys Plaintext. The original data. Ciphertext. Message after key is used following the algorithm to the
message, transforming it so eavesdroppers cannot figure it out.
Encipher: Transform data into unreadable format Decipher: Transform data into readable format Work factor: Definition of the amount of time, effort and resources necessary to break a crypto system.
Strength of encryption comes from: Algorithm, secrecy of key, length of key, initialization vectors, and how they all work together. Improper protection of the key can seriously weaken crypto. (2600 discussion) Goals of Crypto systems: confidentiality, authenticity, integrity, nonrepudiation Crypto system: The hardware and software that implement the crypto transformations
Types of Ciphers
Substitution cipher Transposition cipher Running and concealment cipher Stream and Block Ciphers A little bit different: Steganography
Government Involvement
Symmetric: Faster than asymmetric, hard to break with large key, hard to distribute keys, too many keys required, cannot authenticate or provide non-repudiation. Includes: DES, Triple DES, Blowfish, IDEA, RC4, RC5, RC6, AES
Asymmetric cryptography: Better at key distribution, better scalability for large systems, can provide authentication and non-repudiation, slow, math intensive Includes: RSA, ECC, Diffie Hellman, El Gamal, DSA, Knapsack, PGP
Called Public Key Cryptography Use asymmetric algorithm for protecting symmetric encryption keys Use asymmetric for protecting key distribution Use secret key for bulk encryption requirements Just dont let the secret key travel unless it was asymmetrically encrypted! Uses best advantages of each approach
Comprehensive approach to establishing a level of security PKI as an amalgam of approaches Infrastructure Provides authentication, confidentiality, nonrepudiation, integrity Specific protocols are not PKI, but an overarching architecture
Certificate Authority
Public Key Certificate Registration Authority Structure of Certificates Trusted Organization Can be internal or external to the organization Entrust, Verisign Certification Revocation Lists Can be provided by browser
Has message been altered? Hash, hash function One way hash Message digest Create a fingerprint of a message Message can be altered either intentionally or unintentionally
Digital Signature
Hash value encrypted with the senders private key Act of signing means encrypting messages hash value with private key Ensures that message was not altered and also came from Bob Ensures integrity, authentication, and nonrepudiation DSS
Algorithms
Asymmetric
Symmetric
Hashing Algorithms
MD2 MD4 MD5 SHA HAVAL What does a good cryptographic hash function have?
What is a one time pad? Perfect encryption Random Integrated into some applications High security But, have to distribute pad (like German High Command with submarines and Enigma codes)
Principles Key length Storage Random More used, shorter its lifetime Escrow Destroy at end of lifetime
Hardware v. Software
Software less expensive Hardware more expensive Software slower throughput Hardware faster throughput Software more easily modified High end solutions will be hardware
Email Standards
PGP
Phil Zimmerman Free Download Implement Use on email Print message encoded and decoded Web of Trust
Internet Security
Ciphertext Only Attack Know Plaintext Attack Chosen Plaintext Attack Man In the Middle Attack Dictionary Attack Side Channel