adoptedglobalsign

163Chapter8CryptographyIntroductionItiseasyforsomeonetoreaddataifitisinplaintext,andconfidentialandsensitivemessagesinplaintextcanbeeasilycompromised.
Informationmeantforaspecificsetofeyesmustbecarefullyguarded.
Spiesusesecretcodestocommunicatewiththeirsecretagents.
JuliusCaesarnevertrustedhismessengerscarryingmessagetohisgenerals.
HeencryptedhismessagesbyreplacingeveryAwithaD,everyBwithE,andsoon,soonlytheintendedrecipientcoulddecipherthemessage.
Informationsecurityistheprotectionoforganizational/personaldatafromunauthorizedusers.
ThebasiccomponentsofInformationsecurityare:Confidentiality,IntegrityandAuthenticity,andAvailability.
Confidentialityissecrecy.
Nooneelseshouldreadthedataapartfromtheonewhoissendingthedataandtheauthorizedreceiver.
WiththeincreasinguseoftheInternetasane-commercetool,itisimportantforusers,banks,andcommercialinstitutionstomakesurethattheirinformationissecuredandnooneisabletoreadchangethedataduringitstransmission.
Whencomputersystemscancodeplaintextandtherecipientunderstandsandinterpretsthiscodedmessage,usersfeelmoresecuretransmittingdataovertheInternet,oranyothermedia.
Thismethodofcodingaplaintextmessageintoasecretcodedmessageiscalledcryptography.
Themethodofdisguisingplaintexttohidetheactualdataiscalledencryption.
Thenewencryptedtextiscalledciphertext.
Theencrypteddataisnotreadablebyothersandhenceitissecur.
Onceitreachesitsdestination,thereceivercanreversetheprocesstoreadtheciphertext.
Thisprocessiscalleddecryption.
ThetypicalprocessofencryptionanddecryptionisillustratedinFigure8-1.
PlainTextencryptiondecryptionPlainTextFigure8-1.
EncryptionandDecryptionCryptographyistheprocessofconvertingsimpleplaintextintosecrettextcalledciphertext,andconvertingciphertextbacktoitsoriginalsimpletext,asshownintheFigure8-1.
Theprocessusesalgorithmsknownascrypto-algorithmstoperformtheencryptionanddecryptionprocess.
Chapter8Cryptography164Encryptionanddecryptionaredoneusinga"key"or"code.
"Sometimes,onlyonekeyisusedtoperformbothencryptionanddecryption;sometimestwoseparatekeysareused,oneforencryptionandtheotherkeyfordecryption.
Intoday'sInternetworld,cryptographyapplicationsareusedtoenabledigitalsignatures,moneytransfers,onlineshopping,onlinebooking,andcreditcardpayments,whereauthenticationandprivacyarecrucial.
Cryptographymakestransactionsonthewebmoresecurethroughdigitalcertificates,3-Dsecure,andotherencryptiontechnology.
WiththeriseingovernmentsurveillanceofInternetdata,whichismakingheadlineseveryday,peopleareevenmoreconcernedabouttheirprivacyandpersonaldata.
E-mailssentinplaintextcanbecomeaseriousproblem,assomeonecouldtapthenetworkandreadyourpersonale-mail–somethingthathasbecomequitecommon.
Hence,companiesprefertouseencryptede-mailforemployees–certainly,forseniorexecutivesattheveryleast.
Thoughencryptinge-mailmayormaynotprotectanindividualorbusinesscompletelyfromgovernmentsurveillance,itcancertainlykeepyourdatasafefromintruderswhoarelookingtofindusefulinformationfromyoure-mail.
Cryptographyismainlyusedtoprotectconfidentialityofthedata.
However,itisnotrestrictedtotheconfidentiality.
Itisusedforcheckingintegrityandauthenticationprocessesaswell.
Forexample,inmanygovernanceprocesses,asignatureisanessentialpartoftheprocessforauthenticationandmaintainingintegrity.
Ifwemakethisprocesscomputerized,whereapproval,andothergovernanceisdonevianetworkorInternet,thenweneedamechanismtoauthenticatetheuser'ssignaturedigitally(digitalsignatures),andprovideadigitaltimestamp.
Cryptographyprovidessuchamechanism.
Cryptographyisalsousedtoregulateaccesstoyourcableorsatellitetelevision.
Itiscontrolledcentrallyandonlythechannelsyouaresubscribedtocanbeaccessedandallothersignalsare"scrambled"usingcryptographictechnology.
Forexample,pay-per-view,annual,ormonthlysubscriptionsareallcontrolledcentrallybyscramblingandunscramblingsignalsbasedonthepayment.
Setupboxesinstalledathouses,hotels,andotherplaceswillhavetheabilitytodecodethechannelsonlyuponreceiptofpayments.
Althoughcryptographyiswidelyused,itsapplicationontheInternetisincreasinglydemandingandgrowingashackersarecrackingcryptographicalgorithms.
Researchersareworkingonprovidingbetteralgorithmsandkeyssothatusersdataandauthenticationisprotected.
Cryptographyisstillfundamentallybasedonproblemsthataredifficulttosolvebecauseofthecomplexityofthekeysfordecryptingandencryptingmessagesorsigningdocumentsdigitally.
Cryptography,cryptanalysis,andcryptologyareinterrelated.
Ingeneralcryptographyreferstothetechniqueofencryptinganddecryptingplaintext.
Cryptanalysisreferstoanalyzingandbreakingthekeysusedforencryptionanddecryption(generallyusedbyhackers).
Cryptologyreferstoboth:studyofcryptographyandcryptanalysis.
Inthischapter,wewillfocusonthebasicsofcryptographyanditsapplication.
Wewillnotbecoveringin-depthanalysisofcryptographyitself.
Thereareseveraltextbooksandpapersthatexclusivelydiscussdifferentcryptographicalgorithmsandtechniques.
BruceSchneierisknownasanauthorityoncryptography.
Hehascontributedtothecommunitywithmorethan10usefulbooksrelatedtotheconceptofcryptographyandhasseveralblogsonthetopic.
CryptographicAlgorithmsIncryptography,encryptionanddecryptionareperformedusingamathematicalfunction,oftenknownascryptographicalgorithm.
Themathematicalfunctionconsistsofkeys:aword,number,orphrase.
Thecryptographicalgorithmmakesuseofoneormoreofthesekeystoencryptthedata.
Thesameplaintextcanbeencryptedusingdifferentkeystogetdifferentciphertext.
Thestrengthoftheencryptiondependsonthekeysandcryptographicalgorithmwhichmakesuseofthesekeystoencrypt.
Chapter8Cryptography165Therearethreetypesofcryptoalgorithms(basedonkey),whicharediscussedindetailinthischapter:SymmetricKey(SecretKeyCryptography):UsesasinglekeytoencryptanddecryptthemessagesAsymmetricKey(PublicKeyCryptography):UsesonekeytoencryptandanotherkeytodecryptthemessagesHashFunctions:Usesamathematicaltransformationthattransformsthemessageintoafixedlengthdatathatisuniquetothecorrespondingsource.
Thesetransformationsarecarriedoutusinghashingfunctions/algorithmsandarenotnormallyreversibleorareonewayhashes.
Figure8-2illustratestheabovethreetypesofcryptography.
PlainTextCyphertextPlainTextCryptoAlgorithmCryptoAlgorithmSymmetricCryptography(OneKeyforbothencryptionanddecryption)PlainTextCyphertextPlainTextCryptoAlgorithmCryptoAlgorithmAsymmetricCryptography(OneKeyforencryptionandonekeyfordecryptionPlainTextCyphertextHashFunctionHashFunction(onewaycryptography):OnlyencryptionofPlaintext.
Figure8-2.
ThreetypesofCryptographyForanyencryptionapproach,therearetwomajorchallenges:keydistributionandkeymanagement.
Keydistributionisamechanismtoconveythekeystothosewhoneedthemtoestablishsecurecommunication.
Keymanagementistomanagelargenumberofkeysandprovidetherightkeytotherightuserasneeded.
SymmetricKeyCryptographyInthistechniqueasinglekeyisusedtoencryptanddecryptthedata.
Both,thesenderandreceivermustsharethesamekeyinordertoshareconfidentialinformation.
Becauseasinglekeyisusedforbothencryptionanddecryption,thismethodiscalledsymmetriccryptography.
Inthismethod,asinglekey,whichissecret,mustbeknowntoboththesenderandreceiver.
Symmetrickeycryptographyoperatesintwomodes,streamorblock.
Instreammode,eachbitisconsideredforencryptionwhereasinblockmode,blocksofdataareconsideredforencryption.
Incaseofblockmode,oneblockofdataisencryptedusingthesamekeybutincaseofstreammode,thesameblockwillhavemultiplekeytoencryptthedata.
Sincethemessagesarenormallymorethanoneblock,blockmodemethodneedsamechanismtoarrangedifferentblockstogether.
Figure8-3illustrateshowthesymmetrickeycryptographyisusedtoensureconfidentialityofthemessagethatissent.
Chapter8Cryptography166Thereareseveralalgorithmsdevelopedforboththemodes.
TheDataEncryptionStandard(DES)andtheAdvancedEncryptionStandard(AES)aretwoblockcipheralgorithmsrecognizedbyUSgovernment.
DESwasdevelopedbyIBMasastandardforapplicationsin1977andsincethenithasbeenusedinmanyapplications.
DESwasthemostpopularalgorithmusedacrossawiderangeofapplicationsfromATMencryptiontoe-mailprivacy.
1However,theknownandexploitableweaknessesofDEShavecausedthecommunitytodiscourageitsuse.
Instreammode,encryptionisperformedonebyteatatime.
Insteadofblocksofdata,eachbyteisencryptedusingastreamofkeys.
RC4isavariable-key-sizestreamcipherdevelopedin1987byRivest.
RC4isastreamcipherlicensedbyRSAwhichisawidelyusedstreamcyphermethod.
Someofthemostpopularcryptoalgorithmsare:DataEncryptionStandard(DES)AdvancedEncryptionStandard(AES)RivestCipher(RC)InternationalDataEncryptionAlgorithm(IDEA)BlowfishDESisoneofthefirstwidelyusedalgorithmsbutithasbeencrackedandnolongerconsideredsecured.
AESisusedbytheUSgovernmentandIDEAisusedbyEuropeannations.
Blowfishisanopen-sourcesymmetricalgorithmcreatedin1993.
KeyDistributionDistributionofthekeyandmanagingthekeybetweendifferentsetofusersisthemostchallengingtask.
Symmetrickeycryptographyismoreusefulforencryptionoffilesorfilesystemsinthelocalmachinesandlessusefulforcommunicationbetweenthetwosystemsinthenetworkbecauseof"keydistribution"challenges.
PlaintextMessage(X)EncryptionAlgorithmSymmetricKeyDecryptionAlgorithmPlaintextMessage(X)SymmetricKeyCiphertext(Y)SENDERRECEIVERSYMMETRICKEYCRYPTOGRAPHY:SamekeysharedbybothsenderandreceiverpairMessageConfidentialityisensuredFigure8-3.
SymmetricKeyCryptographyChapter8Cryptography167Therearetwowaysofsolvingkeydistributionproblems.
Oneapproachistophysicallyexchangethekeysinadvance.
Thesecretkeysarepersonallyhandedovertotheparties,whichismanual.
Thesecondapproachistousea"TrustedKeyDistributionCenter"todistributethekeys,atrustednetworkentitywithwhomonehassharedthesecretkey.
Thisprocesscanbeautomated.
SupposeAnnaandBarrywanttocommunicateusingasymmetrickey.
But,theyhavenevermetbeforeandthustheydonothavethesharedkeystoexchangeinformation.
Now,therearetwoproblems,oneissharingthekeybutmoreimportantissharingthekeywithapersonwhoisastrangerbutstillwantstocommunicate.
AsolutionthatisoftenadoptedistouseatrustedpartyknownasKeyDistributionCenter(KDC).
TheKDCisaserverthatmanagesdifferentsymmetrickeyswitheachoftheregistereduser.
EachuserwhowantstocommunicatewiththeotherusermustregisterwithKDC.
KDCwillcheckthecredentialsofeachusertoascertaintheauthenticity.
Auserwhowishestocommunicatewiththeotheruser,let'ssay,AnnawantstocommunicatewithBarry,AnnaandBarrybothhavetofirstregisterwithKDC.
Annatakesthefirststeptosendarequestforakeyaswellastheuseritwantstocommunicate.
Oncetherequestisprocessedwithproperauthentication,KDCsendssharedkeytobothAnnaandBarry.
Henceforth,bothcancommunicatewitheachotherwiththesecretkeythatwasgiventothembyKDC.
KDCcanalsosetexpirationandotherparametersofthekey.
Figure8-4illustratestheentireprocessofsymmetrickeydistributionthroughtheKDC.
Figure8-4.
SymmetricKeyDistributionCenterAsymmetricKeyCryptographyTherearetwoproblemswithsymmetrickeycryptography:Distributionofkey–Secretkeysharingamongsendersandreceivers.
Iftherearenpartiesinvolvedinthecommunicationthenn(n-1)keystobedistributed.
Managingthismanykeysisanotherproblem.
Authenticity–TrustandAuthenticityoftwoparties.
In1976,DiffieandHellmanatStanfordUniversitycameupwithanewmethodtosolveboththeproblemsofsymmetriccryptographythatchangedtheworldofcryptographyanddigitalcommunicationradically.
ThisnewmethodiscalledPublicKeyCryptographyalsoknownasAsymmetricKeyCryptography.
Chapter8Cryptography168PublicKeyCryptographyPublickeycryptographyusesapairofkeysforencryptionanddecryption.
Apublickeyisusedtoencryptthedataandaprivatekeyisusedtodecryptthedata.
Usingthepublickey,anyonecanencryptthedata,buttheycannotdecryptthedata.
Inthisapproach,bothsenderandreceiverhavetheabilitytogeneratebothkeys(usingacomputersystem)together.
However,onlythepublickeyismadeknowntotheotherparty,whocandownloadthiskeyevenfromawebserver;theprivatekeyisnotknowntoanyone.
Itisnotsenttotheotherparty,hencetheproblemofdistributionofthekeyneverarises.
Incaseofintrusionoranyotherproblems,thesystemcangenerateaprivatekey,andacorrespondingpublickeythatcanbepublishedagain.
Thealgorithmsthatgeneratekeysarerelatedtoeachothermathematicallyinsuchawaythatknowledgeofonekeydoesnotpermitanyonetodeterminetheotherkeyeasily.
Figure8-5illustrateshowtheconfidentialityofamessageisensuredthroughasymmetrickeycryptography(alternativelyknownaspublickeycryptography).
PlaintextMessage(X)EncryptionAlgorithmPublicKeyofReceiverDecryptionAlgorithmPlaintextMessage(X)PrivateKeyofReceiverCiphertext(Y)SENDERRECEIVERASYMMETRICKEYCRYPTOGRAPHY:PublicKeyofreceiversharedwithall,PrivateKeyofreceiverheldsecretbyreceiverMessageConfidentialityisensuredFigure8-5.
PublicKeyCryptography–HowConfidentialityisensuredFigure8-6illustrateshowtheauthenticityofthemessageisensuredthroughasymmetrickeycryptography(i.
e.
,publickeycryptography).
Chapter8Cryptography169Figure8-7illustrateshowboththemessageconfidentialityandauthenticityareensuredthroughasymmetrickeycryptography(i.
e.
,publickeycryptography).
PlaintextMessage(X)EncryptionAlgorithmPrivateKeyofSenderDecryptionAlgorithmPlaintextMessage(X)PublicKeyofSenderCiphertext(Y)SENDERRECEIVERASYMMETRICKEYCRYPTOGRAPHY:PublicKeyofsenderandreceiversharedwithall,PrivateKeyofsenderandreceiverheldsecretbysenderandreceiverrespectivelyMessageAuthenticityisensuredFigure8-6.
PublicKeyCryptography–HowAuthenticityisensuredPlaintextMessage(X)EncryptionAlgorithmPrivateKeyofSenderDecryptionAlgorithmPlaintextMessage(X)PrivateKeyofReceiverCiphertext(Z)SENDERRECEIVERMessageConfidentiality&AuthenticityareensuredEncryptionAlgorithmPublicKeyofReceiverDecryptionAlgorithmPublicKeyofSenderASYMMETRICKEYCRYPTOGRAPHY:PublicKeyofsenderandreceiversharedwithall,PrivateKeyofsenderandreceiverheldsecretbysenderandreceiverrespectivelyYYFigure8-7.
PublicKeyCryptography–HowbothConfidentialityandAuthenticityareensuredChapter8Cryptography170ThePublicKeyCryptography(PKC)conceptwasinventedbyWhitefieldDiffieandMartinHellmanin1976paper.
TheprimarybenefitofthePKCisthatonlythepublickeyisshared,theneedtoshareprivatekeyviasomesecurechanneliseliminated,andprivatekeysarenottransmittedorshared.
Apublickeysystemisconstructedusingamathematicallyinfeasiblesolutionwhereonekeycannotbegeneratedusingtheotherkeyandboththekeysarerequiredforasecuredcommunication.
ThehistorianDavidKahn2describedpublickeycryptographyas"themostrevolutionarynewconceptinthefieldsincepolyalphabeticsubstitutionemergedintheRenaissance.
"TherearemanyalgorithmsbasedonPKC,butthemostpopularonesare:DiffieHellmanRSA(Rivest,Shamir,Adleman)DigitalSignatureAlgorithm(DavidKravitz)RSAAlgorithmRSAisanencryptionandauthenticationalgorithmdevelopedbyRonRivest,AdiShamir,andLeonardAdleman.
Itisusedinmanyapplicationsincludingbrowsers.
ThealgorithmisownedandlicensedbyRSASecuritywhichispartofEMC2.
Itusesonekeyforencryptionandanotherkeyfordecryption.
ThemathematicalfunctionforgeneratingkeysitselfcanbefoundinspecificationsandstandardsaswellasintheRSAwebpage.
Usingthemathematicalfunctions,twosetsofnumbers(keys)aregenerated:publickeyandprivatekey.
BoththepublickeyandprivatekeysarerequiredforencryptionanddecryptionbutprivatekeysarekeptprivatebytheownerandareneversentacrosstheInternet.
Thepublickeyisusedtoencryptthedataandprivatekeyisusedtodecryptwhenthemessageconfidentialityhastobemaintained.
AuthenticationcanbeprovidedbyusingthePKCsystemandRSAalgorithm(RFC3447).
Themessageisencryptedusingtheprivatekeyofthesendertoauthenticatethesender.
Asthesender'sprivatekeyisonlyheldbythesender,encryptionbyusingtheprivatekeybythesenderauthenticatesthatthemessagewasinfactoriginatedbythesenderhimself.
Duringtheauthenticationprocess,aprivatekeyisusedbythesenderandthereceiverdecryptsusingthepublickey.
Thisdoesnotguaranteeconfidentiality,butdoesassuretheauthenticityofthemessage.
Whentheoriginalmessageistransformedusingthemessagedigestfunctionandencryptedbytheprivatekey,itisknownasadigitalsignature.
Itisalsopossibletoencryptaportionofthemessagebeingsentusingtheprivatekeyofthesendertodemonstratetheauthenticityratherthanencryptingtheentiremessage.
Suchasystemshouldhavethecapabilitythattheunencryptedportionisnotpossibletobemodifiedwithoutthemodificationoftheencryptedportion.
Table8-1summarizestheentireauthenticationprocess.
Table8-1.
StepsintheAuthenticationProcessProcessKeyOwnerSendencryptedmessagedigest(i.
e.
,digitalsignature)PrivateKeyofsenderSenderDecryptsignaturePublicKeyofsenderReceiverSendencryptedmessagePublicKeyofreceiverSenderDecryptmessagePrivateKeyofreceiverReceiverTheRSAkeysarederivedfromavariablesizeencryptionblockandavariablesizekey.
Thekey-pair(publicandprivate)isderivedfromaverylargeprimenumber,chosenaccordingtospecialrules.
ThestrengthofRSAdependsonthekeylengthbutchoosingalongkeycanslowdownthesystem.
Forbulkdataencryption,itisrecommendedtouseDESforbetterperformance.
Chapter8Cryptography171Ifyouwantboththeconfidentialityandtheauthenticityofthemessage,thefollowingencryptionmechanismhastobeused:Themessagehastobefirstencryptedusingtheprivatekeyofthesender.
Theencryptedmessageisthenencryptedusingthepublickeyofthereceiver.
Theencryptedmessageissenttothereceiver.
Thereceiveronreceivingtheencryptedmessagedecryptsitusinghis(receiver's)privatekey.
Thesemi-decryptedmessageisthendecryptedusingthepublickeyofthesender.
Thereceiverobtainstheplaintextmessage.
AdvantagesofPublicKeyCryptographyTheadvantagesofpublickeycryptographyare:NoneedtoexchangethekeysAnotherkeycannotbederivedfromonekeyTheconfidentialityofthemessagecanbeensuredbyusingthepublickeycryptographyItispossibletoestablishauthenticationofthesenderbyusingpublickeycryptography(digitalsignature)ItispossibletoensuretheconfidentialityandauthenticationofthemessageatthesametimeItispossibletousepublickeycryptographyforsessionkeyexchangeApplicationsofPKCPublicKeyCryptographyisusedinanumberofapplicationsandsystemssoftware.
Someexamplesofapplicationofcryptographyare:DigitallysigneddocumentE-mailencryptionsoftwaresuchasPGPandMIMERFC3161authenticatedtimestampsDigitalsignaturesintheOperatingSystemsoftwaresuchasUbuntu,RedHatLinuxpackagesdistributionSSLprotocolSSHprotocolPublicKeyInfrastructure(PKI)APublicKeyInfrastructure(PKI)enablesuserstosecurelytransactthroughtheuseofpublickeycryptography.
Keypairsareobtainedfromathird-partytrustedauthoritycalledCertificateAuthority(CA).
ThePKIprovidesaninfrastructuretoissuea"digitalcertificate"thatidentifiesanindividualororganization.
Basedontheidentityofthedigitalcertificate,transactionsaremadesecurelyoverpublicnetworkssuchastheInternet.
ThePKIisbasedontheuseofpublickeycryptography,whichiscommonlyused.
Chapter8Cryptography172Apublickeyinfrastructureconsistsof:ACertificateAuthority(CA)thatissuesandverifiesdigitalcertificates.
AcertificateincludesthepublickeyorinformationaboutpublickeyAregistrationAuthority(RA)whichverifiestheuser'sauthenticityforCAbeforeCAissuesadigitalcertificateAsecuredstorageplacetoholdthecertificatesandpublickeysAcertificatemanagementsystemHardware,software,policies,procedures,andpeopleusedtocreate,manage,andrevokedigitalcertificatesalongwiththedistributionandstorageofthedigitalcertificatesAcertificatecontainsinformationreferringtoapublickey,issuedbyaCertificationAuthority(CA).
TheinformationinthecertificateshouldconformtotheITU(IETF)standardX.
509v3.
Certificatesconformingtothatstandardincludeinformationaboutthepublishedidentityoftheownerofthecorrespondingpublickey,thekeylength,thealgorithmused,associatedhashingalgorithm,datesofvalidityofthecertificate,andtheactionsthekeycanbeusedfor.
CertificateAuthority(CA)ACAisresponsibleforissuingcertificates.
CAissuesthedigitalcertificatebasedontherecommendationofRA.
ThisdigitalcertificateissignedbytheCAusingitsownprivatekey.
TheCAissuesthecertificatewhichcontainsthepublickeyofthepartywhoownsthecertificate.
CertificateshavetobepurchasedfromtheCA.
CAcanissueacertificateonlyafteritconfirmsallthecredentialstoproveyouridentity.
Onceidentityisproved,itstampsthecertificatetopreventmodificationsofthedetailscontainedinthecertificate.
CAisanalogoustoapassportagency.
AnindividualororganizationmayhaveanynumberofcertificatesissuedbydifferentCAs.
Differentwebapplicationsmayinsisttouseaparticularcertificate.
Forexample,aparticularbankmayinsisttouseacertificateissuedbythatbankforasecuredtransaction,whereassomeotherwebsitemayacceptanycertificateissuedbyanyCA.
RegistrationAuthority(RA)isathird-partyverificationagencyforaCertificateAuthority(CA),toperformtheverificationoftheorganizationorindividualswhohaveappliedforthecertificate.
FinalcomponentofthePKIistheCertificateManagementSystem(CMS)throughwhichcertificatesarepublished,renewed,orrevoked.
ExamplesofCertificateAuthority(CA)includeVerisign,Thawte,SSL.
com,RapidSSL,NetworkSolutions,GlobalSign,Digicert,Enutrust.
net,PinkRoccade,andPKI.
CAcert.
24DigitalCertificateDigitalCertificateprovidesanelectronicidentitytoconductsecuretransactionsbyprovidingyouridentity(authentication).
Itissimilartoapassportordriver'slicense.
Withadigitalcertificate,anorganizationoranindividualcanprovideauthenticationforallthetransactionswithfriends,businesspartners,andotheronlineservices.
Digitalcertificateassuresidentityamongallthepartiesinvolvedinthetransactions.
ThemostwidelyusedformatofadigitalcertificateisasdefinedbytheCCITTX.
509standards.
25Digitalcertificateusespublickeycryptographytoverifytheintegrityofthecertificateitself.
HashFunctionCryptographyHashfunctions,alsocalledmessagedigests,useafixedlengthhashvaluetotransformthedatathatmakesitdifficultforsomeonetodecryptorchangethedatawithoutaffectingthehashvalue,thussecuringthedatafromintruders.
Hashingfunctionsareone-waymathematicalfunctionsthatareeasytocomputebuthardtoreverse.
AhashfunctionChapter8Cryptography173H(),appliedoninput(x),andreturnsafixedstring,hs.
Mathematicallyitiswrittenashs=H(x).
Acryptographichashfunctioningeneralshouldhavethefollowingproperties:Flexibleinputlength(x)H(x)shouldberelativelyeasytocomputeH(x)isonewayfunctionandcannotbereversibleTheoutputisoffixedlengthanddoesnotdependoninputlengthHashingisgenerallyusedinthefollowingsituations:PasswordmanagementincaseofPPP,CHAP,andMicrosoftEAP.
Thismethodofcryptographyisnormallyusedinoperatingsystemstoprotectpasswords.
Digitalsignaturesandfileintegritycheckerstochecktheintegrityofdata.
Hashingfunctionsareusedtovouchfortheintegrityofthemessagebyappendingthemessagewiththehashvalue.
Ifthemessageischanged,thehashvaluewhenrecomputedwillnotmatchtheprecomputedhashvalue.
Inordertoavoidman-in-themiddleattacks,itisidealtosendthehashvalueinasecurewaytotheintendedparty.
Suchsecuretransferispossibleusingpublickeycryptography.
Further,hashvalueisusedtostorepasswordsoftheoperatingsystemslikeMicrosoftWindows.
Here,theoriginalpasswordsarenotstored;insteadtheSAMcorrespondinghashvaluesarestored.
Theseprovidehighsecuritytothepasswords,ashashvalueisnotreversibletofindouttheoriginalpassword.
OnlywhenthepasswordsareenteredinthesystemwillitcomputethehashvalueandcheckwiththehashvaluestoredintheSAM.
"Salting"thepasswordbeforehashingbyeithersuffixingorprefixingitwitharandomstringdecreasesthepossibilityofcrackingthepassword.
Hashingisalsousedinsomeoftheimplementationofdigitalsignatureswhichvouchesfortheintegrityofthemessagesent.
Hashingfunctionsarealsousedinvirusdetectionaswellasintrusiondetection.
Figure10-8illustrateshowhashingensurestheintegrityofthemessagethatissent.
DataIntendedforSendingDataReceivedDataIntendedforSendingSentHashValueHashValueHashValueMessageHashedSENDERRECEIVERHashValueMessageHashedComparedTalliedMessageIntegrityisensuredthroughHashingYESMessageIntegrityConfirmedNOMessageTamperedwithFigure8-8.
MessageIntegrityCheckthroughHashingChapter8Cryptography174PopularHashesMD5(MessageDigestFunction5),SHA1(SecureHashAlgorithm1),SHA2(SecureHashAlgorithm2),andSHA3(SecureHashAlgorithm3)arethepopularhashingfunctions/algorithms.
MD5outputsareof128bitsandarepopularlyusedforstoringofthepasswordsaswellastoensurefileintegrity.
MD5isproneforcollision.
SHAalgorithmsagainprovideforonewayhash.
SHA1providesfor160bitoutput.
SHA-224,SHA-256,SHA-384,andSHA-512areknownasSHA-2.
SHA3isthemostadvancedhashingfunctionwhichwasannouncedbyNISTin2012.
SHA-3hasauniquestructureknownasspongeconstruction.
MAC(MessageAuthenticationCode)isanotherpopularhashfunctionwhichisalsoknownasaKeyedHashFunction.
DigitalSignaturesAdigitalsignatureislikeahandwrittensignaturebutitisinthedigitalformforanelectronicdocument.
Thedocumentcontainingthedigitalsignatureisverifiedbytherecipientusingahashfunctiontocheckwhetherthemessagehasbeenalteredeitherintentionallyoraccidentallyduringthetransmission.
Ifthemessageisaltered,thehashfunctionreturnsadifferentresult.
Digitalsignatureensuresauthenticityandnon-repudiation.
Here,usuallythehashvalueisencryptedwiththesender'sprivatekey.
Thisprovidesfortheauthenticity.
Whenthereceiverdecryptstheprivatekeyusingthesender'spublickey,hegetsthehashvalue.
Hecancheckthishashvaluewiththehashvaluegeneratedusingthehashalgorithmfromthemessagereceived.
Alternatively,boththemessageandtheappendedhashvaluebothcanbeencryptedwiththesender'sprivatekeyinasimilarwayasabove.
Ifboththehashvaluereceivedandthehashvaluegeneratedfromthemessagereceivedtallythatmeanstheintegrityofthemessageismaintained.
Becauseithasbeensignedbythesender'sprivatekey,themessagesenderisalsoauthenticated.
Anotheralternativeistoencryptthemessageandthehashvalueusingthesymmetrickeysharedbetweenboththeparties.
SummaryofCryptographyStandardAlgorithmsTable8-2summarizessomeoftheSymmetriccryptographicalgorithmsthatareusedtoday.
Table8-2.
SummaryofSymmetricCryptographicAlgorithmsSymmetricKeyDescriptionDataEncryptionStandard(DES)DevelopedbyIBMin1970adoptedbyNationalInstituteofStandardsandtechnology(NIST)Triple-DESAvariantofDESthatemploysuptothree56-bitkeysandisrecommendedreplacementofDES.
DESXDevisedbyRonRivestwitha120-bitkeylengthAdvancedEncryptionStandard(AES)OfficiallyreplacedDESin2001.
Usesakeylengthof128,192,or256bitsandblocksoflength128,192,or256bits.
FederalInformationProcessingStandard(FIPS)PUB1973describesa128-bitblockcipheremploying128,196,or256bitkey.
CAST-128/256DES-likesubstitutionpermutationalgorithmemploying128bitkeylengthof64-bitblock.
ItisdefinedinRFC21444andRFC21625.
CASTisnamedafteritsinventors,CarlisleAdamsandStaffordTavares.
(continued)Chapter8Cryptography175SymmetricKeyDescriptionRivestCiphers(Ron'sCode)(namedafterRonRivest)RC1–notimplementedRC26–64-bitcipherRC4–variablelengthkeyRC57–Ablockciphersupporting32,64,or128bitkeylengthRC6–128bitkeyimprovementoverRC5Blowfish8Asymmetric64-bitblockcipherinventedbyBruceSchneier.
ItisasubstituteforDESandisinusebylargenumberofcommercialproducts.
Twofish9DesignedbyBruceSchneierandteam.
A128bitblockcipherwith128,192,or256keylength.
Usedinhardwareencryption.
Camellia10Developedin2000byNipponTelegraphandTelephone(NTT)CorpandMitsubishiElectricCorporation(MEC).
Suitableforbothhardwareandsoftwareimplementation.
Isa128-bitblocksize,supports128,192,or256keylength.
RFC4312describestheapplicationofCamelliainIPSec.
RFC5581describestheapplicationinOpenPGP.
MISTY111Ablockcipherusinga128-bitkeylengthand64-bitblocks.
Itisusedinbothhardwareandsoftwareapplications.
DescribedinRFC2994SEED12128-bitkeylengthand128-bitblocks.
DevelopedbyKoreanInformationSecurityAgency(KISA)andadoptedasanationalstandardencryptionalgorithminSouthKorea.
DescribedinRFC4269ARIA13A128-bitblockcipheremploying128,192,or256-bitkeylength.
DescribedinRFC5794CLEFIA14128-bitblockcipherwithakeylengthof192,256bitsdevelopedin2007bySONYcorporation.
Isoneofthelatestalgorithmstosupporthighperformancesoftwareandhardwareapplications.
DescribedinRFC6114KCipher-215K-Cipher-2hasbeenusedforindustrialapplicationsespeciallyformobilehealthmonitoringanddiagnosticservicesinJapan.
DescribedinRFC7008GSM(GlobalSystemforMobile)EncryptionAllmobilecommunicationsareovertheairandvulnerabletosecuritythreatsasitisopentoeavesdropperswithanappropriatereceivers.
SeveralsecurityfunctionsarebuiltintotheGSMtosafeguardsubscribersprivacy16:AuthenticationoftheregisteredsubscribersSecuredatatransferSubscriberidentityprotectionForauthenticationprocess,A3authenticationalgorithmsareused.
ForencryptionanddecryptionofdataA8algorithmsareused.
GPRSEncryptionTheA5/4,A5/3,andGEA4,GEA3algorithmsarebasedonthe3GPPcipheringalgorithm(F8).
MitsubishiElectricCorporationholdsessentialpatentsontheAlgorithms17ETSIisCustodianofthe3GPPconfidentialityandintegrityalgorithmsUEA2&UIA2,UEA1&UIA1,andEEA3&EIA3whichhavebeendevelopedthroughthecollaborativeeffortsoftheEuropeanTelecommunicationsStandardsInstitute(ETSI),theAssociationofRadioIndustriesandBusinesses(ARIB),theTelecommunicationsTechnologyAssociation(TTA)andATISTable8-2.
(continued)Chapter8Cryptography176Table8-4summarizessomeoftheHashfunctionalgorithmsthatarecommonlyused.
Table8-3.
SummaryofPublic-KeyCryptographyAlgorithmsPublicKeyCryptographyAlgorithmsDescriptionRSA18RSAisanencryptionandauthenticationalgorithmdevelopedbyRonRivest,AdiShamir,andLeonardAdleman.
Itisusedinmanyapplicationsincludingbrowsers.
ThealgorithmisownedandlicensedbyRSASecuritywhichispartofEMC2NISTcurrentlysupportsthreedifferentRSAalgorithmimplementations.
ANSIX9.
31-1998andiscalledRSA.
TheotheralgorithmsarespecifiedinthePKCS#1v2.
1:RSACryptographyStandarddatedJune2002.
TheyaredefinedassignatureschemeswithappendixandarecalledRSASSA-PSSandRSASSA-PKCS1-v1_5.
FIPS186-4imposesadditionalconstraintsontheseRSAalgorithmimplementations19Diffie-HellmanDiffieandHellmancameupwiththeirownalgorithmbutdoesnotsupportauthentication.
DetailsaredescribedinRFC2631DigitalSignatureAlgorithm(DSA)SpecifiedbyNIST'sDigitalSignatureStandardfordigitalsignatureauthenticationprocessEllipticalCurveCryptography(ECC)20APKCalgorithmbasedonellipticcurveswithsmallkeys.
PublicKeyCryptographyStandards(PKCS)AsetofinteroperablestandardsandguidelinesdevelopedbyRSASecurity(nowEMC2):RFC3447:RSACryptographyStandardRFC2898:PasswordbasedCryptographyStandardsRFC2986:CertificationRequestSyntaxStandardversion1.
7RFC2315:CryptographicMessageSyntaxVersion1.
5RFC2985:SelectedObjectClassesandAttributeTypesversion2.
0RFC5208:Public-KeyCryptographyStandards(PKCS)#8:PrivateKeyInformationSyntaxSpecificationVersion2Table8-3summarizesthePublic-KeyCryptographyAlgorithmsthatarecommonlyusedtoday.
Chapter8Cryptography177Table8-4.
SummaryofHashFunctionAlgorithmsHashfunctionAlgorithmDescriptionMD2Producesanoutputof128-bit"messagedigest".
21Itisconjuredthatitiscomputationallyinfeasibletoproducetwosimilarmessagedigest.
Analgorithmintendedfordigitalsignatureapplicationwhereafilemustbecompressed.
Designedforsystemswithlimitedmemory,suchassmartcards.
DescribedinRFC131921andRFC6149MD4Designedspecificallyforfastprocessingsoftwareapplications.
DescribedinRFC1320andRFC6150MD5ImprovementofMD4algorithm.
DescribedinRFC1321SecureHashAlgorithm(SHA)1NIST'sSecureHashStandardalgorithm.
Produces160bithashvalue.
PublishedinNIS'sFIPSPUB180-1andRFC3174SecureHashAlgorithm(SHA)2TheUnitedStateshasadoptedasuiteofSecureHashAlgorithms(SHAs),includingfourbeyondSHA-1,aspartofaFederalInformationProcessingStandard(FIPS),specificallySHA-224(RFC3874),SHA-256,SHA-384,andSHA-512.
22.
Thiscanproducehashvaluesthatare224,256,384,or512bitsinlengthSHA-3SHA-3isanewalgorithmasanalternativetoSHA-2.
In2007,SHA-3competition23wasalaunchedanditreceived64submissions.
NISTannouncedKeccakasthewinedoftheSHA-3cryptographyhashalgorithmcompetitionandthenewSHA-3algorithmisinpressrelease.
KeccakwasdesignedbyateamofcryptographersfromBelgiumandItaly.
Theyare:GuidoBertoniJoanDaemonMichaelPeetersGillesVanAsscheOthersRIPEMD–optimizedfor32-bitprocessorstoreplace128-bithashfunctionHAVAL(HAshofVAriableLength–cancreatehashvaluesof128,160,192,224,or256bitslengthTiger:ReplacementforSHAandMD5.
Runefficientlyon64-bitprocessor.
EachofthealgorithmsinTable8-4isusedindifferentapplicationsandfordifferentpurposes.
Forexample,Hashfunctionalgorithmsarewellsuitedfordataintegrity.
Anychangemadetothecontentduringthetransmissionwillresultinahashvaluedifferentfromtheoriginalvaluesentbythesender.
Sinceitishighlyunlikelythatthesamehashvalueisgeneratedfortwodifferentmessages,dataintegrityisensured.
Symmetrickeycryptographyissuitedforencryptinganddecryptingmessages,thusprovidingprivacyandconfidentiality.
Thesendercangenerateakeyforeachdatasessiontoencryptthemessageandthereceivercandecryptthemessagebutneedstohavethesamekeyforthesamesession.
Symmetrickeycryptographyalsomaybeusedforfileencryptions.
PublicKeycryptographytechniqueusesapairofkeyscalledprivateandpublic.
Thisisusedfornotonlyconfidentialityofmessagebutalsofornon-repudiationanduserauthentication.
Table8-4providedanoverviewofdifferentalgorithmsusedfordifferenttypesofcryptographytechniques.
Table8-5providesanoverviewofsomeofthecommoncryptographicalgorithmsthatareusedinvariousapplications,particularlyine-commerceapplications.
Chapter8Cryptography178Table8-5.
OverviewofcommoncryptographicalgorithmsusedinvariousapplicationsAlgorithmDescriptionCapstone26CAPSTONEisanNSAdeveloped,hardwareoriented,cryptographicDevice.
ItimplementscryptographicalgorithmthatisimplementedinCLIPPERchip.
Inaddition,theCAPSTONEchipincludesthefollowingfunctions:1.
TheDigitalSignatureAlgorithm(DSA)proposedbyNISTasaFederalInformationProcessingStandard(FIPS);2.
TheSecureHashingAlgorithm(SHA)recentlyapprovedasFIPS180;3.
AKeyExchangeAlgorithmbasedonapublickeyexchange;4.
Ageneralpurpose,randomnumbergeneratorwhichusesapurenoisesource.
Clipper27CLIPPERisanNSAdeveloped,hardwareoriented,cryptographicdevicethatimplementsasymmetricencryption/decryptionalgorithm.
Thecryptographicalgorithm(SKIPJACK)iscompletelyspecified(andclassifiedSECRET).
Thecryptographicalgorithm(calledCA)hasthefollowingcharacteristics:1.
Symmetric,80-bitkeyencryption/decryptionalgorithm;2.
SimilarinfunctiontoDES(i.
e.
,basicallya64-bitcodebooktransformationthatcanbeusedinthesamefourmodesofoperationasspecifiedforDESinFIPS81);3.
32roundsofprocessingpersingleencrypt/decryptoperation;FederalInformationProcessingStandards(FIPS)28FederalInformationProcessingStandardsPublications(FIPSPUBS)areissuedbyNISTafterapprovalbytheSecretaryofCommercepursuanttotheFederalInformationSecurityManagementAct(FISMA)of2002.
Thecomputersecurityandcrypto-algorithmsusedbyU.
SGovernmentGOSTGOSTisafamilyofalgorithmsusedbyRussianFederalStandardsusedbyRussianGovernment.
RFC4357:AdditionalCryptographicAlgorithmsforUsewithGOST28147-89,GOSTR34.
10-94,GOSTR34.
10-2001,andGOSTR34.
11-94AlgorithmsRFC5830:GOST28147-89:Encryption,Decryption,andMessageAuthenticationCode(MAC)AlgorithmsRFC6986:GOSTR34.
11-2012:HashFunctionAlgorithmRFC7091:GOSTR34.
10-2012:DigitalSignatureAlgorithm(UpdatesRFC5832:GOSTR34.
10-2001)Identity-BasedCryptographyStandard(IBCS)(describedinRFC5091)IBEisapublic-keytechnology,butonewhichvariesfromotherpublic-keytechnologiesinaslight,yetsignificantway.
Inparticular,IBEkeysarecalculatedinsteadofbeinggeneratedrandomly,whichleadstoadifferentarchitectureforasystemusingIBEthanforasystemusingotherpublic-keytechnologies.
(continued)Chapter8Cryptography179AlgorithmDescriptionIPSecurityProtocol(IPsec)TheIPSecisasetofprotocolsuiteswhichprovideconfidentialityandauthenticationservicesattheIPlayer.
RFC2411describestheoverviewofIPSecprotocol.
IPSecprotocolsuitesinclude:RFC4301:IPsecurityarchitecture.
RFC4302:IPAuthenticationHeader(AH),RFC4303:IPEncapsulatingSecurityPayload(ESP)RFC4304:ExtendedSequenceNumber(ESN)Addendum,RFC4305:CryptographicalgorithmimplementationrequirementsforESPandAH.
RFC4307:CryptographicalgorithmsusedwithIKEv2.
RFC4308:CryptosuitesforIPsec,IKE,andIKEv2.
RFC4309:TheuseofAESinCBC-MACmodewithIPsecESP.
RFC4312:TheuseoftheCamelliacipheralgorithminIPsec.
RFC4359:TheUseofRSA/SHA-1SignatureswithinEncapsulatingSecurityPayload(ESP)andAuthenticationHeader(AH).
RFC4434:DescribesAES-XCBC-PRF-128,apseudo-randomfunctionderivedfromtheAESforusewithIKE.
RFC5996:TheInternetKeyExchange(IKE)protocol,version2RFC2403:DescribesuseoftheHMACwithMD5algorithmRFC2405:DescribesuseofDES-CBCRFC2407(applicationofISAKMPtoIPsec),RFC2408(ISAKMP,aframeworkforkeymanagementandsecurityassociations),andRFC2409RFC2412:DescribesOAKLEY,akeydeterminationanddistributionprotocol.
RFC2451:DescribesuseofCipherBlockChaining(CBC)modecipheralgorithmswithESP.
RFCs2522and2523:DescriptionofPhoturis,asession-keymanagementprotocolforIPsec.
InternetSecurityAssociationandKeyManagementProtocol(ISAKMP)(DescribedinRFC2408)TheInternetSecurityAssociationandKeyManagementProtocol(ISAKMP)definestheproceduresforauthenticatingacommunicatingpeer,creationandmanagementofSecurityAssociations,keygenerationtechniques,andthreatmitigation(e.
g.
,denialofserviceandreplayattacks).
MessageDigestCipher(MDC)InventedbyPeterGutman,newZealand.
Moredetailscanbefoundinhttps://www.
cs.
auckland.
ac.
nz/~pgut001/HMAC:Keyed-HashingforMessageAuthentication(RFC2104)HMACisamechanismusedformessageauthenticationusingcryptographichashfunctionssuchasMD5,SHA-1,etc.
TheKeyed-HashMessageAuthenticationCode(HMAC)DescribedinFIPS-19829HMACisusedwithanyiterativeapprovedcryptographichashfunction,incombinationwithasharedsecretkey.
ThecryptographicstrengthofHMACdependsonthepropertiesoftheunderlyinghashfunction.
Table8-5.
(continued)(continued)Chapter8Cryptography180Disk/DriveEncryptionWiththeincreaseduseofthemobiledeviceslikelaptopsandthestorageofconfidentialdataontheirharddiskanddatacarriedonUSBandotherdrives,weneedtoprotectthedatafromtheftandmisuse.
Hence,thediskencryptionutilitieshaveemerged.
Theentireharddisk,USBdrive,andotherdrivescanbeencryptedsothatthedataonthemcannotbereadandmisusedbyunauthorizedpersons.
Now,wehavethepossibilitytoburnthedataontoportabledisksbutencryptthemsothatunauthorizedpersonswillnotbeabletomisusethem.
TheutilitiesandtoolssuchasTrueCryptandGilisoftarewidelyusedfordiskencryption,andarefoundtobeveryeffectiveindiskencryption.
TherearemanyothertoolsavailablesuchasDriveCrypt,DiskCryptor,RohosDiskEncryption,andSymantecDriveEncryption.
AlgorithmDescriptionNSA-AdvancedEncryptionStandard(AES)AdvancedEncryptionStandard(AES)withkeysizesof128and256bits,perFIPSPUB197forencryptionEllipticCurveDigitalSignatureAlgorithm(ECDSA)DescribedinFIPS186-3Usingthecurveswith256and384-bitprimemoduliSecureHashAlgorithm(SHA)Using256and384bits.
DescribedinFIPS180-3CryptographicSuitesforSecureShell(SSH).
DescribedinRFC6239.
SecureShellTransportLayerProtocolPrettyGoodPrivacy(PGP)PhilipZimmermanndevelopedthisalgorithmforemailandfilestorageapplications.
ItusesRSAforkeymanagementanddigitalsignatures,IDEAformessageencryption,andMD5forcomputinghashvalue.
MoreinformationcanbefoundinRFC1991.
SecureHypertextTransferProtocol(S-HTTP)AnextensiontoHTTPtoprovidesecureexchangeofdocumentsovertheWorldWideWeb.
SupportedalgorithmsincludeRSAandKerberosforkeyexchange,DES,IDEA,RC2,andTriple-DESforencryption.
SecureSocketsLayer(SSL)DescribedinRFC6101SSLisasecurityprotocolthatprovidescommunicationsprivacyovertheInternet.
ThisismainlydesignedforsecureHTTPandFTPconnections.
Thisprotocolallowsapplicationstocommunicatesecurelytopreventanyattackonconfidentialityanddataintegrity.
SSLalsousesMD5formessagedigestsandX.
509public-keycertificates.
Formoredetails,refertoRFC6101.
TransportLayerSecurity(TLS)TLSuses3DES,SHA,DSSandDiffie-Hellman.
TLSalsoprovidesdataprivacyanddataintegrity.
TLSwasdevelopedtoreplaceSSH.
Formoreinformation,pleaserefertoRFC5246.
TrueScript30Opensource,multi-platformcryptographysoftwarethatcanbeusedtoencryptafile,partition,orentiredisk.
X.
509ITU-TrecommendationforthePKIinfrastructureismainlyusedintheTelecommunicationindustry.
Table8-5.
(continued)Chapter8Cryptography181AttacksonCryptographyTherearevariousattackspossibleoncryptography.
Someofthecommonattacksare:RubberHoseAttack:ObtainingbyforcethesecretkeylikepasswordtothefilefromthosewhohavethemCiphertext-onlyAttack:HeretheattackerhastheciphertextandtriestogettheencryptionkeyusingtheciphertextKnown-plaintextAttack:Heretheattackerhassomeplaintext.
UsingthishetriestogettheencryptionkeyChosen-plaintextAttack:Heretheattackeruseshisownplaintext.
Hethenencryptsthemandanalysestheresultingoutput,i.
e.
,ciphertext.
AdaptiveChosen-plaintextAttack:Heretheattackerusesvariousplaintexts.
Thesubsequentplaintextwillbeusedbyhimbasedontheresultofearlieroutput.
BruteforceandFrequencyAnalysismethodsarepopularlyusedbytheattackerstobreaktheencryptionkey.
ChapterSummaryWediscussedencodingofmessagestoensurethesecrecyofthemessagebeingsent.
Wealsoexploredencryption,decryption,cryptography,cryptanalysis,andcryptology.
Wediscussedhowcryptographyhelpsinmaintainingtheconfidentialityofthemessageaswellasassurestheauthenticationofthemessage.
Weexploredvariouscryptographicalgorithmssuchassymmetrickeycryptographyandasymmetrickeycryptography.
Wealsoexploredtheproblemofkeydistributioninthecaseofsymmetrickeycryptographyandhowthiscanberesolvedusingthethirdparty.
Wethenexploredtheasymmetrickeycryptographyandunderthatlookedintothepublickeycryptographyandhowitresolvestheissueofkeydistribution.
Welookedintotheconceptsofprivatekeyandpublickey.
Wealsoelaboratedfurtherastohowthishelpsoutinensuringtheconfidentialityofthemessagesbeingsentaswellastheauthenticationofthemessages.
WebrieflytouchedupontheRSAalgorithm.
Wethenbrieflytouchedupontheapplicationsandadvantagesofthepublickeycryptography.
WealsobrieflytoucheduponPublicKeyInfrastructure,theroleofCertificateAuthority,andDigitalCertificates.
Webrieflydiscussedhashingalgorithms,someofthepopularhashingfunctions/algorithms,andtheusesofhashingfunctions/algorithms.
WealsobrieflydescribedhowDigitalSignaturesareimplementedusinghashingalgorithms.
Welistedvarioussymmetric,asymmetric,andhashingalgorithmsalongwithfurtherreferencestothem.
Welookedintothediskencryptionmechanismtoprotectthedrives/disksfrommisuseandthenconcludedthesectionwiththepossibleattacksoncryptography.