Cryptographic Systems
Introduction
Cryptographic Hashes
HMAC/KHMAC
Symmetric Encrypition
Asymmetric Encryption
Digital Signatures
Public Key Infrastructure (PKI)
Introduction
- Network Traffic is protected by “Cryptographic” methods, when traversing through the Internet.
- “Cryptology” is a science of making and breaking secret codes.
- The Development and use of codes is called as “CRYPTOGRAPHY”
- Breaking of codes is called “CRYPTANALYSIS”.
- When we are working with encryption, the readable data is called “Plain-text” and the encrypted data is called “Cipher text”.
- The popular methods for making codes are:
- Transposition Cipher:- In Transposition Cipher no letters are replaced, they are rearranged.
- Substitution Cipher: - here letters are replaced.
CRYPTOGRAPHIC HASHES
- A Hash function takes binary data and produced a condensed representation called the Message -Digest.
- Hashing is based on one-way mathematical function that is relatively easy to compute but significantly hard to reverse.
- Every time data is changed/altered the hash value also changes.
- They can be used to detect duplicate data files, file version changes.
- There are two Well-known Hash Functions:
- Message-Digest 5 (MD-5)
- Secure Hash Algorithm 1 (SHA-1)
Message-Digest-5 (MD-5)
- It produces a 128-bit hash from a sequence of simple binary operations.
- It is collision resistant, which means two messages with the same hash are very unlikely to occur.
SECURE HASH ALGORITHM (SHA-1)
- It takes an input message of less than 2^64 bits and produces a 160-bit Message digest.
- This algorithm slightly slower than MD-5 but more Secure.
- Versions available: SHA-1, SHA-2 & SHA-3
Hashing Example
HMAC/KHMAC
- HMAC stands for Hash Message Authentication Code and is also known as KHMAC (Keyed-HMAC) is a type message authentication code.
- An HMAC is calculated using a specific algorithm that combines a cryptographic hash function with a secret key.
- Only Sender and Receiver knows the secret key and the output of the hash function now depends on the input data and secret key.
Key Properties
Symmetric encryption
- Same key used for both encryption and decryption
- Best known as shared-secret key algorithms.
- The usual key length is 80 – 256 bits.
- A sender and receiver must share a secret key.
- Faster Processing because they use simple mathematical operations.
- Examples include DES, 3DES, AES, IDEA, RC2/4/5/6 and Blowfish.
Block Cipher Modes
Asymmetric encryption
- Uses different keys for encryption and decryption; one is private key and another is public key.
- Also known as public key algorithms
- The usual key length is 512-4096 bits
- A sender and receiver don’t share a secret key
- Relatively slow because they are based on difficult computational algorithms.
- Key lengths greater than or equal to 1024 bits can be trusted.
- Key lengths that are shorter than 1024 bits are considered unreliable for most algorithms.
- Examples include RSA (RivestShamirAdleman), EIGamal, Elliptic Curves and DH (Diffie Hellman).
Public Key (Encrypt) + Private Key (Decrypt) = Confidentiality
- Each system generates a pair of keys
- Each system publishes its bublic key keeping its companion key private.
- If A wishes to send a message to B then it encrypts the message using B’s public key and sends to B.
- When B receives the message, it decrypts the message using its private key. No one else can decrypt the message because only B knows its private key.
Private Key (Encrypt) + Public Key (Decrypt) = Authentication
- Each user (for example: Alice and Bob) generates a pair of keys
- Each user publishes its public key keeping their companion key private.
- If Alice wishes to send a message to Bob then Alice encrypts the message using Alice’s private key and sends message to the Bob.
- When Bob receives the message, Bob decrypts the message using Alice’s Public key. Now, authentication is successful..
- Each entity in the network, including devices and users must create and maintain its own private and public keys. Key management is a problem in asymmetric encryption because it involves managing a pair of keys. Asymmetric key cryptography is vulnerable to attacks such as man-in-the-middle attacks.
Digital Signatures
- Digital Signatures provide three basic security services: Authentication, Integrity and Non-repudiation.
- Authenticates a source, proving a certain party has seen, and has signed, the data in question.
- Signing party can’t repudiate that it signed, the data.
- Guarantees that the data has not changed from the time it was signed.
Characteristics of Digital Signatures
- The Signature is authentic and not forgeable: The signature is proof that the signer and no one else signed the document.
- The Signature is not reusable: The signature is a part of the document and can’t be moved to a different document.
- The Signature is unalterable: After a document is signed, it can’t be altered.
- The Signature is can’t be repudiated: For legal purposes, the signature and the document are considered to be physical things. The signer can’t claim later that they did not sign it.
- The publisher of the software attaches a digital signature to the executable, signed with the signature key of the publisher.
The Digital Signature Process
- The sending device creates a hash of the document.
- The sending device encrypts only the hash with privacy key of signer.
- The Signature Algorithm generates a digital signature and transmit document.
- The receiving device accepts the document with digital signature and obtains Public Key.
- The receiving device verifies Signature with verification key (Senders Public key)
- Validity of Digital Signature is verified.
Digital Signature Algorithm (DSA)
- Introduced in 1994
- Provides Digital Signatures
- Signature generation is fast
- Signature verification is slow
Rivest Shamir Adleman (RSA):
- Introduced in 1977
- Used as Asymmetric Algorithm and Digital Signature
- Signature verification is fast
- Signature generation is slow
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI): A service framework (hardware, software, people, policies and procedures) needed to support large-scale public key-based technologies.
Certificate: A document, which binds together the name of the entity and its public key and has been signed by the CA.
Certificate authority (CA): The trusted third party that signs the public keys of entities in PKI-based systems.
CA Vendors and Sample Certificates
X.509v3
PKI Topologies
Registration Authorities
Submitting Certificate Requests
Authenticating
Thank you very much...!!
------------------------------------------- THE END --------------------------------------------------
