Encryption Matches Domain 4.0 Basics of Cryptography (15 percent of Security +)

1. EncryptionMatches Domain 4.0 Basics of Cryptography (15 percent of Security +) Network Security Class Dr. Kleist Note: Most material from Harris, Shon. (2003). All-In-One CISSP Certification Exam Guide. New York: McGraw-Hill/Osborne.

2. Security + Exam and Cryptography • 4.1 Identify and explain hashing, symmetric, asymmetric (chpt. 5) • 4.2 Understand cryptography and confidentiality, integrity (digital signatures), authentication, non-repudiation (digital signatures), access control (Chpt. 5) • 4.3 PKI: certificates, certificate policies, revocation, trust models (Chpt. 5) • 4.4 Crypto standards and protocols (Chpt. 5) • 4.5 Key Management and Certificate Lifecycles (centralized v. decentralized, storage, escrow, expiration, revocation, suspension, recovery, renewal, destruction, key usage (Chpt. 6)

3. Sources of Lecture • Slides are drawn from several sources. • Some research from Conklin, W. A., G. White, C. Cothren, D. Williams, R. Davis. (2004). Principles of Computer Security. Boston:  McGraw-Hill Technology Education.  • Also material from Schneier, B. (2000, 2004).  Secrets & Lies:  Digital Security in a Networked World.  Indianapolis:  Wiley Publishing, Inc. • Most of this material from Harris, Shon. (2003). All-In-One CISSP Certification Exam Guide. New York: McGraw-Hill/Osborne.

4. Exam 1 • Real exam is 90 minutes for 100 questions, you must get a score of 764, and your points are normalized from 100 to 900 points (i.e., changed in scale • Our exam 1 will be from real Security + exams, and will cover sections that are matched to the chapters in our text, our lectures and the Schneier book. • First exam will have 60 multiple choice questions.

5. Outline of Crypto Section • History of Cryptography • Common elements of all cryptographic systems • Cryptographic systems strength • Types of ciphers • Government involvement • Symmetric and asymmetric encryption • Digital signatures and certificate authorities • Cryptography in real networks • PKI

6. Outline, cont’d. • Key escrow • Methods of Encryption • Symmetric cryptography in Networks • Asymmetric cryptography in Networks • Hybrid systems • PKI • CA • Message Integrity and Hashes • Digital Signature • One time pad

7. Outline, cont’d • Key management • Hardware vs. software key management • Email standards, MIME, S/MIME, PEM, MSP • Standard cryptography used in networks of interest • Attacks on crypto systems

8. History of Crypto • The Code Book • Substitution cipher • Transposition cipher • Monoalphabetic substitution • Scytale cipher • Caesar cipher • Mary Queen of Scots • Benedict Arnold • Enigma and Turing • Windtalkers • Lucifer

9. Common Elements of All Crypto • Cryptanalysis.  Trying to figure out the message without the key. • Algorithm.  Set of mathematical rules that dictate enciphering and deciphering.  Not part of the encryption process, widely known.  • Key. The key is the secret part of the process.  An algorithm contains a keyspace, which is a range of values that can be used to construct a key.  Key is random values within the keyspace range.  The larger the key space, the more values can be used, and some think the safer the key, although Schneier disagrees.  • Keyspace: Possible values to construct keys • Plaintext. The original data. • Ciphertext.  Message after key is used following the algorithm to the message, transforming it so eavesdroppers cannot figure it out.

10. Common Elements of All Crypto • Encipher:  Transform data into unreadable format • Decipher:  Transform data into readable format • Work factor:  Definition of the amount of time, effort and resources necessary to break a crypto system.

11. Cryptographic Systems Strength • Strength of encryption comes from:  Algorithm, secrecy of key, length of key, initialization vectors, and how they all work together.  • Improper protection of the key can seriously weaken crypto.  (2600 discussion) • Goals of Crypto systems:  confidentiality, authenticity, integrity, nonrepudiation • Crypto system:  The hardware and software that implement the crypto transformations

12. Types of Ciphers • Substitution cipher • Transposition cipher • Running and concealment cipher • Stream and Block Ciphers • A little bit different: Steganography

13. Government Involvement • NSA • Clipper Chip • FBI and Wiretapping

14. Symmetric and Asymmetric Encryption • Symmetric: Faster than asymmetric, hard to break with large key, hard to distribute keys, too many keys required, cannot authenticate or provide non-repudiation. • Includes: DES, Triple DES, Blowfish, IDEA, RC4, RC5, RC6, AES

15. Symmetric and Asymmetric Encryption • Asymmetric cryptography: Better at key distribution, better scalability for large systems, can provide authentication and non-repudiation, slow, math intensive • Includes: RSA, ECC, Diffie Hellman, El Gamal, DSA, Knapsack, PGP

16. Hybrid Asymmetric and Symmetric Systems • Called Public Key Cryptography • Use asymmetric algorithm for protecting symmetric encryption keys • Use asymmetric for protecting key distribution • Use secret key for bulk encryption requirements • Just don’t let the secret key travel unless it was asymmetrically encrypted! • Uses best advantages of each approach

17. Public Key Infrastructure • Comprehensive approach to establishing a level of security • PKI as an amalgam of approaches • Infrastructure • Provides authentication, confidentiality, nonrepudiation, integrity • Specific protocols are not PKI, but an overarching architecture

18. Certificate Authority • Public Key Certificate • Registration Authority • Structure of Certificates • Trusted Organization • Can be internal or external to the organization • Entrust, Verisign • Certification Revocation Lists • Can be provided by browser

19. Message Integrity and Hashes • Has message been altered? • Hash, hash function • One way hash • Message digest • Create a fingerprint of a message • Message can be altered either intentionally or unintentionally

20. Digital Signature • Hash value encrypted with the sender’s private key • Act of signing means encrypting message’s hash value with private key • Ensures that message was not altered and also came from Bob • Ensures integrity, authentication, and non-repudiation • DSS

21. Algorithms • Asymmetric • RSA • ECC • Diffie Hellman • El Gamal • Digital Signature • Symmetric • DES, 3DES • Blowfish • IDEA • RC4 • SAFER

22. Hashing Algorithms • MD2 • MD4 • MD5 • SHA • HAVAL • What does a good cryptographic hash function have?

23. One Time Pad • What is a one time pad? • Perfect encryption • Random • Integrated into some applications • High security • But, have to distribute pad (like German High Command with submarines and Enigma codes)

24. Issues of Key Management • Principles • Key length • Storage • Random • More used, shorter its lifetime • Escrow • Destroy at end of lifetime

25. Hardware v. Software • Software less expensive • Hardware more expensive • Software slower throughput • Hardware faster throughput • Software more easily modified • High end solutions will be hardware

26. Email Standards • MIME • S/MIME • PEM • MSP

27. What do Networks Use for Real?

28. PGP • Phil Zimmerman • Free • Download • Implement • Use on email • Print message encoded and decoded • Web of Trust

29. Internet Security • HTTP • S-HTTP • HTTPS • SSL • SET • SSH • IPSec

30. Attacks on Crypto Systems • Ciphertext Only Attack • Know Plaintext Attack • Chosen Plaintext Attack • Man In the Middle Attack • Dictionary Attack • Side Channel