Cryptography. Concepts and Business Considerations. Rich Diedrich IBM Lab Services

Transcription

1 Cryptography Concepts and Business Considerations Rich Diedrich IBM Lab Services

2 Cryptography History and Concepts

3 Cryptography is the study and practice of techniques to keep messages and data secure A D B E C F X A Y B Z C

4 Symmetric key algorithms require that both the sender and receiver know the same key Encrypt Decrypt

5 Symmetric key algorithms are most commonly implemented as block ciphers or stream ciphers K E Y P L A I N Block Cipher K E Y P L A I N Stream Cipher K E Y S T R E A M C I P H E R C I P H E R

6 Asymmetric key algorithms use different, but related, keys for the sender and the receiver Encrypt Decrypt

7 Secure hash algorithms generate a fixed length value from variable length data in a way that cannot be reversed Hash

8 There a variety of cryptographic algorithms in current use Abbreviation Full Name Notes DES Data Encryption Standard Designed for hardware FIPS PUB 46 in bit key version broken AES Advanced Encryption Standard Designed for software FIPS PUB 197 in , 192, 256 bit keys RSA Rivest Shamir Adleman Published 1978 Asymmetric Key Algorithm SHA-1 Secure Hash Algorithm FIPS PUB in bit hash SHA-2 Secure Hash Algorithm FIPS PUB in , 256, 384, 512 bit hash SHA-256 is SHA-2 with 256 bit hash

9 Random numbers are critical for secure cryptography Initialization Vector

10 Cryptographic protocols describe in detail how one or more cryptographic algorithms are used for a particular purpose TLS (SSL) Client ClientHello - Protocol versions - Random number - Ciphers TLS (SSL) Server ServerHello - Protocol version - Random number - Cipher ClientKeyExchange - Encrypted PreMasterSecret ChangeCipherSpec Data Certificate ChangeCipherSpec Data

11 Certificates and trusted Certificate Authorities (CAs) are used to manage public keys and defend against man-in-the-middle attacks

12 Cryptography Business Considerations

13 Cryptography is used for securing data during transmission and at rest Transmitted Data Standard Protocols Minimal Application Impacts Data at Rest Standard Algorithms More Application Impacts

14 Cryptography is just one piece of a secure solution Cryptography Application Design Key Management Physical Security

15 Implementing cryptography in an application properly usually requires application changes Transparent Encryption Layer

16 It is critical that the actual requirements of a cryptographic solution be understood Comments What data do we actually need to store? If the actual data is not needed, do not keep it What applications need access to the actual data? Think in terms of how the data should be used What applications need access to masked data? Some applications only need masked data like the last 4 digits of a credit card Do we need to decrypt the value or just check it? Passwords and related information should not be retrievable Do we need to search on the encrypted data? This presents challenges for non-exact matches and performance What standards do we have to meet? PCI DSS, HIPAA, other? What are our key change requirements? Changing keys used by millions of records can be a problem if not included in the design How will we manage access to the keys? Encryption allows many secrets to be protected by one secret, how will that be managed

17 The security of encrypted data depends on proper key management Key Type Notes Master Key Combination of parts entered by more than one person Stored securely Loss will result in loss of all encrypted data Data Key Often generated, stored, and used without external access Encrypted under master key when stored Access required to encrypt or decrypt data Loss will result in loss of data encrypted with specific key Key Encryption Key Used for transferring keys If compromised, can compromise other keys

18 The security of encrypted data is only as good as the weakest link

19 Cryptography PCI Implementation

20 The first step in designing a solution is understanding the requirements System to handle Payment Card Industry (PCI) data IBM i Minimize PCI audit scope "Appliance" Interfaces Existing applications Out of PCI scope Stored procedure interface Web site Accept credit cards Stored procedure interface Point of sale (POS) device Accept credit cards Acquiring bank Authorize credit cards

21 The development process included the critical parties from the very beginning High level design session Customer Lab Services PCI expert Design reviewed by PCI expert Focus on PCI scope Design modified early

22 The design of a Payment Card Industry (PCI) solution includes many considerations beyond cryptography Web Application (Java) IBM i Existing Application IBM i PCI Partition POS Device Acquiring Bank Interface (Java)

23 The solution included several critical design points PCI data is never on production system Accessed by token PCI data input from web and POS device No interface to retrieve PCI data PCI data is encrypted Access to PCI partition is limited Limited users Dual authentication

24 Thank You Any Questions?