Proposed Documents for JOSE: JSON Web Signature (JWS) JSON Web Encryp6on (JWE) JSON Web Key (JWK)
|
|
|
- Roland Ferguson
- 8 years ago
- Views:
Transcription
1 Proposed Documents for JOSE: JSON Web Signature (JWS) JSON Web Encryp6on (JWE) JSON Web Key (JWK) Mike Jones Standards Architect IETF 82 November 14, 2011
2 Mo6va6on Clear need for industry- standard JSON- based: Security Token format Signature format Encryp6on format Public Key format Specs wrisen and in use filling these needs: JSON Web Token (JWT) JSON Web Signature (JWS) JSON Web Encryp6on (JWE) JSON Web Key (JWK)
3 Design Philosophy Make simple things simple Make complex things possible
4 Design Goals Easy to use in all modern web development environments Compact, URL- safe representa6on
5 Background (1) In October 2010, there were numerous proposed JSON- based token and crypto formats: JSON Simple Sign and JSON Simple Encrypt Canvas Applica6ons Signatures JSON Tokens Clear that agreement would beser serve all Mike Jones surveyed features, design decisions Proposed consensus feature set based on discussions including Google, Facebook, AOL, NRI, and independent contributors Extensive review, discussions at IIW, Nov 2010 Consensus JWT published December 2010
6 Background (2) JavaScript Message Security Format (JSMS) published in March 2011 by Eric Rescorla & Joe Hildebrand JSON- based signing and encryp6on format JWS published in March 2011 (split off from JWT) OAuth JWT Bearer Token Profile published March 2011 At IETF 80 (March 2011), JSMS and JWS authors agreed to work together on unified specs JWK published in April 2011 JWE published in September 2011 Encryp6on features from JSMS using JWS- based syntax
7 Background (3) JWT, JWS, JWE, JWK updated October 2011 Incorpora6ng feedback from WOES/JOSE members JWT, etc. specs already in use Google, others Deployments planned by numerous par6es OpenID Connect uses JWT, JWS, JWE, JWK At least 7 independent implementa6ons
8 JSON Web Signature (JWS) jones- json- web- signature Sign arbitrary content using compact JSON- based representa6on Includes both true digital signatures and HMACs Representa6on contains three parts: Header Payload Signature Parts base64url encoded and concatenated, separated by period (. ) characters URL- safe representa6on
9 JWS Header Example JWS Header: {"typ":"jwt", "alg":"hs256"} Specifies use of HMAC SHA- 256 algorithm Also contains op6onal content type parameter Base64url encoded JWS Header: eyj0exaioijkv1qila0kicjhbgcioijiuzi1nij9
10 JWS Payload Example JWS Payload (before base64url encoding): {"iss":"joe", "exp": , " JWS Payload base64url encoding): eyjpc3mioijqb2uila0kicjlehaiojezmda4mtkzodasdqo gimh0dha6ly9legftcgxllmnvbs9pc19yb290ijp0cnvlfq
11 JWS Signing Input Signature covers both Header and Payload Signing input concatena6on of encoded Header and Payload, separated by period Enables direct signing of output representa6on Example signing input: eyj0exaioijkv1qila0kicjhbgcioijiuzi1nij9.eyjpc3 MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0d HA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ
12 JWS Signature Example base64url encoded HMAC SHA- 256 value: dbjftjez4cvp mb92k27uhbuju1p1r_ww1gfwfoejxk
13 JWS Header Parameters "alg" Signature Algorithm (REQUIRED) "jku" JSON Web Key URL "x5u" X.509 Public Key URL "x5t" X.509 Cer6ficate Thumbprint "kid" Key Iden6fier "typ" Type for signed content
14 JWS Algorithm Iden6fiers Compact algorithm ("alg") iden6fiers: "HS256" HMAC SHA- 256 "RS256" RSA SHA- 256 "ES256" ECDSA with " P- 256 curve and SHA- 256 Other hash sizes also defined: 384, 512 Other algorithms, iden6fiers MAY be used
15 JSON Web Encryp6on (JWE) jones- json- web- encryp6on Encrypt arbitrary content using compact JSON- based representa6on Representa6on contains three parts: Header Encrypted Key Ciphertext Parts base64url encoded and concatenated, separated by period (. ) characters URL- safe representa6on
16 JWE Header Example JWS Header: {"alg":"rsa1_5", "enc":"a256gcm", "iv":" 79_Pv6- fg", "x5t":"7noopq- hj1_hcnvwh6ieyi2w9q0"} RSA- PKCS1_1.5 used to encrypt JWE Encrypted Key AES GCM used to encrypt Plaintext Ini6aliza6on Vector value specified X.509 Cer6ficate Thumbprint specified Header base64url encoded just like JWS
17 JWE Header Parameters "alg" Encryp6on Algorithm for JWE Encrypted Key (REQUIRED) "enc" Encryp6on Algorithm for Plaintext (REQUIRED) "iv" Ini6aliza6on Vector "epk" Ephemeral Public Key "zip" Compression algorithm "jku" JSON Web Key URL "x5u" X.509 Public Key URL "x5t" X.509 Cer6ficate Thumbprint "kid" Key Iden6fier "typ" Type for encrypted content
18 JWE Key Encryp6on Alg Iden6fiers Algorithm ("alg") iden6fiers: "RSA1_5" RSA using RSA- PKCS1-1.5 padding "RSA-OAEP" RSA using Op6mal Asymmetric Encryp6on Padding (OAEP) "ECDH-ES" Ellip6c Curve Diffie- Hellman Ephemeral Sta6c "A128KW","A256KW" AES Key Wrap with 128, 256 bit keys "A128GCM","A256GCM" AES Galois/Counter Mode (GCM) with 128, 256 bit keys Other algorithms, iden6fiers MAY be used "
19 JWE Plaintext Encryp6on Alg Iden6fiers Algorithm ("enc") iden6fiers: "A128CBC","A256CBC" AES Cipher Block Chaining (CBC) mode with 128, 256 bit keys "A128GCM","A256GCM" " AES Galois/Counter Mode (GCM) with 128, 256 bit keys Other algorithms, iden6fiers MAY be used
20 JSON Web Key (JWK) jones- json- web- key JSON representa6on of public keys Representa7on of private keys out of scope
21 JWK Example {"keyvalues": [ {"algorithm":"ec", "curve":"p-256", "x":"mkbctnickusdii11yss3526idz8aito7tu6kpaqv7d4", "y":"4etl6srw2yilurn5vfvvhuhp7x8pxltmwwlbbm4ifym", "use":"encryption", "keyid":"1"}, {"algorithm":"rsa", "modulus": "0vx7ag(omitted)Cur-kEgU8awapJzKnqDKgw", "exponent":"aqab", "keyid":" "} ] }
22 Refactoring for JOSE JOSE charter specifies four deliverables: Signing Encryp6on Public Key Representa6on Algorithms Profile If accepted by WG, would refactor JWS, JWE, JWK to move algorithms into separate doc
23 Open Issues Do we also want pure JSON representa6ons? Not base64url encoded so not URL- safe Would be usable in HTTP bodies, etc. Do we need addi6onal header parameters? Public keys by value (rather than by reference) X.509 certs by value (rather than by reference) Do we specify representa6on combining encryp6on and integrity opera6ons? Would be more compact than nested opera6ons Would likely result in four- part representa6on
24 Related Work W3C Web Cryptography Working Group hsp:// Specifying JavaScript APIs for cryptography JOSE specs should underlie this WG s APIs
25 Next Steps Decide whether to accept JWS, JWE, JWK as JOSE working group documents Determine coordina6on strategy with W3C Web Cryptography WG Refactor current documents per JOSE charter Submit IETF - 00 dra@s
OAuth2 Ready or not? Dominick Baier h.p://leastprivilege.com @leastprivilege
OAuth2 Ready or not? Dominick Baier h.p://leastprivilege.com Dominick Baier Security consultant at thinktecture Focus on security in distributed applica9ons iden9ty management access control Windows/.NET
National Security Agency Perspective on Key Management
National Security Agency Perspective on Key Management IEEE Key Management Summit 5 May 2010 Petrina Gillman Information Assurance (IA) Infrastructure Development & Operations Technical Director National
Security Protocols/Standards
Security Protocols/Standards Security Protocols/Standards Security Protocols/Standards How do we actually communicate securely across a hostile network? Provide integrity, confidentiality, authenticity
RSA BSAFE. Crypto-C Micro Edition for MFP SW Platform (psos) Security Policy. Version 3.0.0.1, 3.0.0.2 October 22, 2012
RSA BSAFE Crypto-C Micro Edition for MFP SW Platform (psos) Security Policy Version 3.0.0.1, 3.0.0.2 October 22, 2012 Strong encryption technology for C/C++ developers Contact Information See our Web sites
W3C Web Crypto APIs. Status of current specifications and future plans. Virginie GALINDO chair of Web Crypto WG
W3C Web Crypto APIs Status of current specifications and future plans Virginie GALINDO chair of Web Crypto WG Web Crypto APIs use cases Web Crypto APIs allow web apps to build their own security model,
UM0586 User manual. STM32 Cryptographic Library. Introduction
User manual STM32 Cryptographic Library Introduction This manual describes the API of the STM32 cryptographic library (STM32-CRYP-LIB) that supports the following cryptographic algorithms: AES-128, AES-192,
Cryptography and Network Security Sicurezza delle reti e dei sistemi informatici SSL/TSL
Cryptography and Network Security Sicurezza delle reti e dei sistemi informatici SSL/TSL Security architecture and protocol stack Applicat. (SHTTP) SSL/TLS TCP IPSEC IP Secure applications: PGP, SHTTP,
XML Encryption Syntax and Processing. Duan,Limiao 07,12,2006
XML Encryption Syntax and Processing Duan,Limiao 07,12,2006 Agenda Introduction Encryption Overview and Examples - An XML Element - XML Element Content (Elements) - XML Element Content (Character Data)
OpenADR 2.0 Security. Jim Zuber, CTO QualityLogic, Inc.
OpenADR 2.0 Security Jim Zuber, CTO QualityLogic, Inc. Security Overview Client and server x.509v3 certificates TLS 1.2 with SHA256 ECC or RSA cipher suites TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA256
CRYPTOGRAPHY AS A SERVICE
CRYPTOGRAPHY AS A SERVICE Peter Robinson RSA, The Security Division of EMC Session ID: ADS R01 Session Classification: Advanced Introduction Deploying cryptographic keys to end points such as smart phones,
Cryptography and Network Security Chapter 15
Cryptography and Network Security Chapter 15 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 15 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North
Overview of Cryptographic Tools for Data Security. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the
Software Defined Perimeter
So#ware Defined Perimeter Software Defined Perimeter A new approach to access control Junaid Islam, Co Chair Before we start, two ideas we believe strongly Complexity is the primary reason security systems
Detailed Specifications
1 of 6 Appendix Detailed Specifications 1. Standards The following standards are used in the document under the following abbreviations: - BASE32, BASE64, BASE64-URL: Network Working Group: Request for
Communication Security for Applications
Communication Security for Applications Antonio Carzaniga Faculty of Informatics University of Lugano March 10, 2008 c 2008 Antonio Carzaniga 1 Intro to distributed computing: -server computing Transport-layer
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
Multifactor authentication. Deployment guide
Multifactor authentication Deployment guide Document History Version Date Author Comments 1.3 Oct 2015 Jaime Pérez Update for final settings in production. 1.2 Jul 2015 Hildegunn Vada Removed URLs for
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies Dave Corbett Technical Product Manager Implementing Forward Secrecy 1 Agenda Part 1: Introduction Why is Forward Secrecy important?
Secure Socket Layer. Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings.
Secure Socket Layer Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings. Abstraction: Crypto building blocks NS HS13 2 Abstraction: The secure channel 1., run a key-exchange
Authentication applications Kerberos X.509 Authentication services E mail security IP security Web security
UNIT 4 SECURITY PRACTICE Authentication applications Kerberos X.509 Authentication services E mail security IP security Web security Slides Courtesy of William Stallings, Cryptography & Network Security,
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
SMPTE Standards Transition Issues for NIST/FIPS Requirements v1.1
SMPTE Standards Transition Issues for NIST/FIPS Requirements v1.1 Contents 2010.8.23 DRM inside, Taehyun Kim ETRI, Kisoon Yoon 1 Introduction NIST (National Institute of Standards and Technology) published
Usable Crypto: Introducing minilock. Nadim Kobeissi HOPE X, NYC, 2014
Usable Crypto: Introducing minilock Nadim Kobeissi HOPE X, NYC, 2014 2012 Browsers are an environment that is hostile to cryptography Malleability of the JavaScript runtime. The lack of low-level (system-level)
Secure Socket Layer (SSL) and Transport Layer Security (TLS)
Secure Socket Layer (SSL) and Transport Layer Security (TLS) Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available
Package PKI. July 28, 2015
Version 0.1-3 Package PKI July 28, 2015 Title Public Key Infrastucture for R Based on the X.509 Standard Author Maintainer Depends R (>= 2.9.0),
Secure Socket Layer (TLS) Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings.
Secure Socket Layer (TLS) Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings. Crypto building blocks AS HS13 2 Abstraction: The secure channel 1., run a key-exchange protocol
How To Understand And Understand The Ssl Protocol (Www.Slapl) And Its Security Features (Protocol)
WEB Security: Secure Socket Layer Cunsheng Ding HKUST, Hong Kong, CHINA C. Ding - COMP581 - L22 1 Outline of this Lecture Brief Information on SSL and TLS Secure Socket Layer (SSL) Transport Layer Security
A low-cost Alternative for OAEP
A low-cost Alternative for OAEP Peter Schartner University of Klagenfurt Computer Science System Security peter.schartner@aau.at Technical Report TR-syssec-11-02 Abstract When encryption messages by use
Diameter End-to-End Security: Keyed Message Digests, Digital Signatures, and Encryption
Diameter End-to-End Security: Keyed Message Digests, Digital Signatures, and Encryption draft-korhonen-dime-e2e-security-01 Jouni Korhonen, Hannes Tschofenig Dime WG, IETF#85 Overview Background Requirements
Table of Contents. Bibliografische Informationen http://d-nb.info/996514864. digitalisiert durch
1 Introduction to Cryptography and Data Security 1 1.1 Overview of Cryptology (and This Book) 2 1.2 Symmetric Cryptography 4 1.2.1 Basics 4 1.2.2 Simple Symmetric Encryption: The Substitution Cipher...
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Symmetric and Public-key Crypto Due April 14 2015, 11:59PM
CMSC 414 (Spring 2015) 1 Symmetric and Public-key Crypto Due April 14 2015, 11:59PM Updated April 11: see Piazza for a list of errata. Sections 1 4 are Copyright c 2006-2011 Wenliang Du, Syracuse University.
Information Security
SE 4472 / ECE 9064 Information Security Week 11: Transport Layer Security (TLS): Putting it all together Fall 2015 Prof. Aleksander Essex Security at the Transport Layer Where we started in this course:
FIPS 140-2 Non- Proprietary Security Policy. McAfee SIEM Cryptographic Module, Version 1.0
FIPS 40-2 Non- Proprietary Security Policy McAfee SIEM Cryptographic Module, Version.0 Document Version.4 December 2, 203 Document Version.4 McAfee Page of 6 Prepared For: Prepared By: McAfee, Inc. 282
AWS Key Management Service Cryptographic Details
AWS Key Management Service Cryptographic Details Matthew Campagna May 2015 Contents Contents 2 Abstract 3 Introduction 3 Design Goals 4 Background 5 Cryptographic Primitives 5 Basic Concepts 7 Customer
Cisco VPN Internal Service Module for Cisco ISR G2
Data Sheet Cisco VPN Internal Service Module for Cisco ISR G2 Compact Versatile High-Performance VPN Module The Cisco VPN Internal Service Module (VPN ISM) is a module for the Cisco Integrated Services
Designing Hash functions. Reviewing... Message Authentication Codes. and message authentication codes. We have seen how to authenticate messages:
Designing Hash functions and message authentication codes Reviewing... We have seen how to authenticate messages: Using symmetric encryption, in an heuristic fashion Using public-key encryption in interactive
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 20 Public-Key Cryptography and Message Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Public-Key Cryptography
Secure Sockets Layer
SSL/TLS provides endpoint authentication and communications privacy over the Internet using cryptography. For web browsing, email, faxing, other data transmission. In typical use, only the server is authenticated
Justin Richer January 2014. Portions 2013 The MITRE Corporation
Justin Richer January 2014 Portions 2013 The MITRE Corporation } Fundamentals of OAuth 2 } Fundamentals of OpenID Connect } How web APIs use OAuth 2 } How to do identity federation with OIDC } Overview
Communication Systems SSL
Communication Systems SSL Computer Science Organization I. Data and voice communication in IP networks II. Security issues in networking III. Digital telephony networks and voice over IP 2 Network Security
Waspmote Encryption Libraries. Programming guide
Waspmote Encryption Libraries Programming guide Index Document version: v4.3-01/2015 Libelium Comunicaciones Distribuidas S.L. INDEX 1. General Concepts... 4 2. Integrity... 7 2.1. Waspmote Libraries...7
Online signature API. Terms used in this document. The API in brief. Version 0.20, 2015-04-08
Online signature API Version 0.20, 2015-04-08 Terms used in this document Onnistuu.fi, the website https://www.onnistuu.fi/ Client, online page or other system using the API provided by Onnistuu.fi. End
z/os Cryptographic Services - ICSF Best Practices
z/os Cryptographic Services - ICSF Best Practices Steven R. Hart, CISSP IBM Thursday, August 7, 2014: 8:30 AM-9:30 AM Session Number 15775 Insert Custom Session QR if Desired. Topics Cryptography Basics
AWS Encryption SDK. Developer Guide
AWS Encryption SDK Developer Guide AWS Encryption SDK: Developer Guide Copyright 2016 Amazon Web Services, Inc. and/or its affiliates. All rights reserved. Amazon's trademarks and trade dress may not be
Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
NIST Special Publication 800-131A Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths Elaine Barker and Allen Roginsky Computer Security Division Information
Chapter 8. Network Security
Chapter 8 Network Security Cryptography Introduction to Cryptography Substitution Ciphers Transposition Ciphers One-Time Pads Two Fundamental Cryptographic Principles Need for Security Some people who
Internet Engineering Task Force (IETF) Request for Comments: 7568. Category: Standards Track ISSN: 2070-1721 A. Langley Google June 2015
Internet Engineering Task Force (IETF) Request for Comments: 7568 Updates: 5246 Category: Standards Track ISSN: 2070-1721 R. Barnes M. Thomson Mozilla A. Pironti INRIA A. Langley Google June 2015 Deprecating
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
TLS Specification for Storage Systems
TLS Specification for Storage Systems ABSTRACT: This document specifies the requirements and guidance for use of the Transport Layer Security (TLS) protocol in conjunction with data storage technologies.
Lecture 9 - Network Security TDTS41-2006 (ht1)
Lecture 9 - Network Security TDTS41-2006 (ht1) Prof. Dr. Christoph Schuba Linköpings University/IDA Schuba@IDA.LiU.SE Reading: Office hours: [Hal05] 10.1-10.2.3; 10.2.5-10.7.1; 10.8.1 9-10am on Oct. 4+5,
SPC5-CRYP-LIB. SPC5 Software Cryptography Library. Description. Features. SHA-512 Random engine based on DRBG-AES-128
SPC5 Software Cryptography Library Data brief SHA-512 Random engine based on DRBG-AES-128 RSA signature functions with PKCS#1v1.5 ECC (Elliptic Curve Cryptography): Key generation Scalar multiplication
CS3235 - Computer Security Third topic: Crypto Support Sys
Systems used with cryptography CS3235 - Computer Security Third topic: Crypto Support Systems National University of Singapore School of Computing (Some slides drawn from Lawrie Brown s, with permission)
Differences Between SSLv2, SSLv3, and TLS
Differences Between SSLv2, SSLv3, and TLS Loren Weith: 0600978 July 3, 2006 SSLv2, SSLv3, and TLS (1.0) all provide for a secure channel between clients and servers: if looked at in terms of the OSI reference
Cryptographic Hash Functions Message Authentication Digital Signatures
Cryptographic Hash Functions Message Authentication Digital Signatures Abstract We will discuss Cryptographic hash functions Message authentication codes HMAC and CBC-MAC Digital signatures 2 Encryption/Decryption
Bit Chat: A Peer-to-Peer Instant Messenger
Bit Chat: A Peer-to-Peer Instant Messenger Shreyas Zare shreyas@technitium.com https://technitium.com December 20, 2015 Abstract. Bit Chat is a peer-to-peer instant messaging concept, allowing one-to-one
Chapter 25 Compression and Encryption Services
Chapter 25 Compression and Encryption Services Introduction... 25-2 Data Compression... 25-2 Data Encryption... 25-5 Symmetrical Encryption... 25-5 Asymmetrical (Public Key) Encryption... 25-7 Network
NEW HORIZON COLLEGE OF ENGINEERING, BANGALORE CLOUD COMPUTING ASSIGNMENT-1. 1. Explain any six benefits of Software as Service in Cloud computing?
NEW HORIZON COLLEGE OF ENGINEERING, BANGALORE CLOUD COMPUTING ASSIGNMENT-1 1. Explain any six benefits of Software as Service in Cloud computing? 2. List the different cloud applications available in the
Communication Systems 16 th lecture. Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009
16 th lecture Chair of Communication Systems Department of Applied Sciences University of Freiburg 2009 1 25 Organization Welcome to the New Year! Reminder: Structure of Communication Systems lectures
Microsoft Windows Server 2008 R2 Cryptographic Primitives Library (bcryptprimitives.dll) Security Policy Document
Microsoft Windows Cryptographic Primitives Library (bcryptprimitives.dll) Security Policy Document Microsoft Windows Server 2008 R2 Cryptographic Primitives Library (bcryptprimitives.dll) Security Policy
Telephone Related Queries (TeRQ) IETF 85 (Atlanta)
Telephone Related Queries (TeRQ) IETF 85 (Atlanta) Telephones and the Internet Our long- term goal: migrate telephone rou?ng and directory services to the Internet ENUM: Deviated significantly from its
IT Networks & Security CERT Luncheon Series: Cryptography
IT Networks & Security CERT Luncheon Series: Cryptography Presented by Addam Schroll, IT Security & Privacy Analyst 1 Outline History Terms & Definitions Symmetric and Asymmetric Algorithms Hashing PKI
Network Security Essentials Chapter 7
Network Security Essentials Chapter 7 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 7 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear,
Safeguarding Data Using Encryption. Matthew Scholl & Andrew Regenscheid Computer Security Division, ITL, NIST
Safeguarding Data Using Encryption Matthew Scholl & Andrew Regenscheid Computer Security Division, ITL, NIST What is Cryptography? Cryptography: The discipline that embodies principles, means, and methods
PGP from: Cryptography and Network Security
PGP from: Cryptography and Network Security Fifth Edition by William Stallings Lecture slides by Lawrie Brown (*) (*) adjusted by Fabrizio d'amore Electronic Mail Security Despite the refusal of VADM Poindexter
Identifying and Exploiting Padding Oracles. Brian Holyfield Gotham Digital Science
Identifying and Exploiting Padding Oracles Brian Holyfield Gotham Digital Science Session ID: ASEC-403 Session Classification: Intermediate What is a Padding Oracle? We re a SQL Server Shop, we don t use
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy 21 June 2010 Table of Contents Introduction Module Specification Ports and Interfaces Approved Algorithms Test Environment Roles
Real-Time Communication Security: SSL/TLS. Guevara Noubir noubir@ccs.neu.edu CSU610
Real-Time Communication Security: SSL/TLS Guevara Noubir noubir@ccs.neu.edu CSU610 1 Some Issues with Real-time Communication Session key establishment Perfect Forward Secrecy Diffie-Hellman based PFS
Performance Investigations. Hannes Tschofenig, Manuel Pégourié-Gonnard 25 th March 2015
Performance Investigations Hannes Tschofenig, Manuel Pégourié-Gonnard 25 th March 2015 1 Motivation In we tried to provide guidance for the use of DTLS (TLS) when used in
SSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
Copyright: WhosOnLocation Limited
How SSO Works in WhosOnLocation About Single Sign-on By default, your administrators and users are authenticated and logged in using WhosOnLocation s user authentication. You can however bypass this and
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography Is n A tremendous tool n The basis for many security mechanisms Is not n The solution to all security problems n Reliable unless implemented properly n Reliable
Axway API Gateway. Version 7.4.1
O A U T H U S E R G U I D E Axway API Gateway Version 7.4.1 3 February 2016 Copyright 2016 Axway All rights reserved. This documentation describes the following Axway software: Axway API Gateway 7.4.1
Practical Invalid Curve Attacks on TLS-ECDH
Practical Invalid Curve Attacks on TLS-ECDH Tibor Jager, Jörg Schwenk, Juraj Somorovsky Horst Görtz Institute for IT Security Ruhr University Bochum @jurajsomorovsky 1 1 About Me and Our Institute Security
AD Image Encryption. Format Version 1.2
AD Image Encryption Format Version 1.2 17 May 2010 Table of Contents Introduction... 3 Overview... 3 Image Formats... 4 Keys... 4 Credentials... 4 Certificates... 4 Image Key encryption... 5 Appendix A
Chapter 6 Electronic Mail Security
Cryptography and Network Security Chapter 6 Electronic Mail Security Lectured by Nguyễn Đức Thái Outline Pretty Good Privacy S/MIME 2 Electronic Mail Security In virtually all distributed environments,
Einführung in SSL mit Wireshark
Einführung in SSL mit Wireshark Chemnitzer Linux-Tage 16. März 2014 Martin Kaiser What? SSL/TLS is the most widely used security protocol on the Internet there's lots of parameters, options, extensions
CS 393 Network Security. Nasir Memon Polytechnic University Module 11 Secure Email
CS 393 Network Security Nasir Memon Polytechnic University Module 11 Secure Email Course Logistics HW 5 due Thursday Graded exams returned and discussed. Read Chapter 5 of text 4/2/02 Module 11 - Secure
SSL and TLS. An Overview of A Secure Communications Protocol. Simon Horman aka Horms. horms@valinux.co.jp horms@verge.net.au horms@debian.
SSL and TLS An Overview of A Secure Communications Protocol Simon Horman aka Horms horms@valinux.co.jp horms@verge.net.au horms@debian.org Presented at the Security Mini-Conf at Linux.Conf.Au Canberra,
Outline. Transport Layer Security (TLS) Security Protocols (bmevihim132)
Security Protocols (bmevihim132) Dr. Levente Buttyán associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.hu Outline - architecture
Cryptography and Network Security Chapter 12
Cryptography and Network Security Chapter 12 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 12 Message Authentication Codes At cats' green on the Sunday he
Stone Knives and Bear Skins: Why does the Internet still run on pre-historic cryptography?
Stone Knives and Bear Skins: Why does the Internet still run on pre-historic cryptography? Eric Rescorla ekr@rtfm.com Indocrypt 2011 Indocrypt 2011 Eric Rescorla 1 Overview Our cryptographic protocols
Security. Learning Objectives. This module will help you...
Security 5-1 Learning Objectives This module will help you... Understand the security infrastructure supported by JXTA Understand JXTA's use of TLS for end-to-end security 5-2 Highlights Desired security
A Perfect CRIME? TIME Will Tell. Tal Be ery, Web research TL
A Perfect CRIME? TIME Will Tell Tal Be ery, Web research TL Agenda BEAST + Modes of operation CRIME + Gzip compression + Compression + encryption leak data TIME + Timing + compression leak data Attacking
Salesforce1 Mobile Security Guide
Salesforce1 Mobile Security Guide Version 1, 1 @salesforcedocs Last updated: December 8, 2015 Copyright 2000 2015 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of salesforce.com,
Key & Data Storage on Mobile Devices
Key & Data Storage on Mobile Devices Advanced Computer Networks 2015/2016 Johannes Feichtner johannes.feichtner@iaik.tugraz.at Outline Why is this topic so delicate? Keys & Key Management High-Level Cryptography
Efficient Framework for Deploying Information in Cloud Virtual Datacenters with Cryptography Algorithms
Efficient Framework for Deploying Information in Cloud Virtual Datacenters with Cryptography Algorithms Radhika G #1, K.V.V. Satyanarayana *2, Tejaswi A #3 1,2,3 Dept of CSE, K L University, Vaddeswaram-522502,
CS 356 Lecture 27 Internet Security Protocols. Spring 2013
CS 356 Lecture 27 Internet Security Protocols Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Message Authentication Codes
2 MAC Message Authentication Codes : and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l08, Steve/Courses/2013/s2/css322/lectures/mac.tex,
I N F O R M A T I O N S E C U R I T Y
NIST Special Publication 800-78-2 DRAFT Cryptographic Algorithms and Key Sizes for Personal Identity Verification W. Timothy Polk Donna F. Dodson William. E. Burr I N F O R M A T I O N S E C U R I T Y
OOo Digital Signatures. Malte Timmermann Technical Architect Sun Microsystems GmbH
OOo Digital Signatures Malte Timmermann Technical Architect Sun Microsystems GmbH About the Speaker Technical Architect in OpenOffice.org/StarOffice development OOo/StarOffice developer since 1991/94 Main
JVA-122. Secure Java Web Development
JVA-122. Secure Java Web Development Version 7.0 This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard
Implementing 2-Legged OAuth in Javascript (and CloudTest)
Implementing 2-Legged OAuth in Javascript (and CloudTest) Introduction If you re reading this you are probably looking for information on how to implement 2-Legged OAuth in Javascript. I recently had to
PGP - Pretty Good Privacy
I should be able to whisper something in your ear, even if your ear is 1000 miles away, and the government disagrees with that. -- Philip Zimmermann PGP - Pretty Good Privacy - services - message format
Automatic Recognition, Processing and Attacking of Single Sign-On Protocols with Burp Suite
Automatic Recognition, Processing and Attacking of Single Sign-On Protocols with Burp Suite Vladislav Mladenov, Tim Guenther, Christian Mainka, Horst-Görtz Institut für IT-Sicherheit, Ruhr-Universität
An Introduction to Cryptography as Applied to the Smart Grid
An Introduction to Cryptography as Applied to the Smart Grid Jacques Benoit, Cooper Power Systems Western Power Delivery Automation Conference Spokane, Washington March 2011 Agenda > Introduction > Symmetric
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
Northrop Grumman M5 Network Security SCS Linux Kernel Cryptographic Services. FIPS Security Policy Version 2.42. www.northropgrumman.
Northrop Grumman M5 Network Security SCS Linux Kernel Cryptographic Services FIPS Security Policy Version 2.42 www.northropgrumman.com/m5/ SCS Linux Kernel Cryptographic Services Security Policy Version
Kaseya US Sales, LLC Virtual System Administrator Cryptographic Module Software Version: 1.0
Kaseya US Sales, LLC Virtual System Administrator Cryptographic Module Software Version: 1.0 FIPS 140-2 Non-Proprietary Security Policy FIPS Security Level: 1 Document Version: 1.0 Prepared for: Prepared
Authentication requirement Authentication function MAC Hash function Security of
UNIT 3 AUTHENTICATION Authentication requirement Authentication function MAC Hash function Security of hash function and MAC SHA HMAC CMAC Digital signature and authentication protocols DSS Slides Courtesy