What Your Mother Didn't Tell You About PEM, DER, PKCS. Eric Norman University of Wisconsin-Madison
|
|
|
- Neil Franklin Barton
- 8 years ago
- Views:
Transcription
1 What Your Mother Didn't Tell You About PEM, DER, PKCS Eric Norman University of Wisconsin-Madison 1
2 Audience I'm nuts Some of you might want to bolt Who needs to know? Developers Support personnel diagnose problems System Administrators 2
3 Today's Class ASN.1, BER, DER Overview Usage and formats X.509 certificates PKCS7 S/MIME PKCS12 Tools OpenSSL utilities 3
4 ASN.1 Abstract Syntax Notation (version 1) Specifies type and structure Type of value (integer, boolean, character string, etc.) Structure (containment, order, options) Does not specify encoding (representation) 4
5 ASN.1 Primitive Types INTEGER BOOLEAN OCTET_STRING BIT STRING OBJECT_IDENTIFIER (OID) IA5String (ASCII) PrintableString UTF8String (UTF8) UTCTime (YYMMDDhhmmss) 5
6 ASN.1 Structure SEQUENCE (ordered collection) record, struct SEQUENCE OF (ordered; all same type) vector, array SET (unordered collection) no counterpart SET OF (unordered; all same type) no counterpart CHOICE union 6
7 ASN.1 Example Certificate ::= SEQUENCE { tbscertificate TBSCertificate, signaturealgorithm AlgorithmIdentifier, signature BIT STRING } TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialnumber CertificateSerialNumber, signature AlgorithmIdentifier, issuer Name, validity Validity, subject Name, subjectpublickeyinfo SubjectPublicKeyInfo, issueruniqueid [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3 subjectuniqueid [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3 extensions [3] Extensions OPTIONAL -- If present, version MUST be v3 -- } 7
![Name, subjectpublickeyinfo SubjectPublicKeyInfo, issueruniqueid [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3](/docs-images/43/7643250/images/page_7.jpg "subjectuniqueid [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3 extensions [3] Extensions OPTIONAL -- If present, version")
8 Encoding Rules BER: Basic Encoding Rules Lots of ways to encode DER: Distinguished Encoding Rules Subset of BER Only one way to encode Needed for digital signatures Designed for serial transmission On the wire specifications 8
9 TLV Encoding 9
10 Tags Universal Identifies type of value (look at bits) Context Specific (and others) Doesn't identify type (if IMPLICIT; read ASN.1) Optional components Choice (discriminated union) 10
11 Sample Universal Tags #define V_ASN1_UNIVERSAL #define V_ASN1_CONTEXT_SPECIFIC #define V_ASN1_CONSTRUCTED 0x00 0x80 0x20 #define V_ASN1_BOOLEAN 1 #define V_ASN1_INTEGER 2 #define V_ASN1_OCTET_STRING #define V_ASN1_OBJECT 4 6 #define V_ASN1_UTF8STRING 12 #define V_ASN1_SEQUENCE #define V_ASN1_IA5STRING #define V_ASN1_UTCTIME 23 #define V_ASN1_GENERALIZEDTIME 24 11
12 Implicit/Explicit Tags 12
13 You Do Want to Read A Layman's Guide to a Subset of ASN.1, BER, and DER by Bert Kaliski RSA Laboratories ftp://ftp.rsa.com/pub/pkcs/ps/layman.ps or consult Google 13
14 You Would Rather Not Know Sundry integer encodings INTEGERs Tags Lengths Parts of OIDs Numbering in BIT STRINGs is backwards If you think a camel is appropriate for the perl book, then what animal would you suggest for the committee that invented this stuff? 14
15 DER Gotchas DEFAULT values must be omitted BIT STRINGs can't have trailing 0 bits SETs have to be sorted 15
16 BER/DER vs. XML BER/DER XML Bandwidth Abstinent Profligate Parsing Lots of code Easy Human readable Not really Yes Editing Special tool vi, emacs, etc. Canonicalization Easy Rumored difficult Future Legacy Angle brackets Encumbered No Somewhat 16
17 X.509 Certificate (butchered ASN.1; partial truth) SEQUENCE { SEQUENCE { serial number: INTEGER (!!!) issuer: Distinguished name validity period: SEQUENCE {- -} subject: Distinguished name public key: SEQUENCE {...} extensions: SEQUENCE OF Extension } signature of issuer: BIT STRING } 17
18 ASN.1 Example (again) Certificate ::= SEQUENCE { tbscertificate TBSCertificate, signaturealgorithm AlgorithmIdentifier, signature BIT STRING } TBSCertificate ::= SEQUENCE { version [0] Version DEFAULT v1, serialnumber CertificateSerialNumber, signature AlgorithmIdentifier, issuer Name, validity Validity, subject Name, subjectpublickeyinfo SubjectPublicKeyInfo, issueruniqueid [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3 subjectuniqueid [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3 extensions [3] Extensions OPTIONAL -- If present, version MUST be v3 -- } 18
![Name, subjectpublickeyinfo SubjectPublicKeyInfo, issueruniqueid [1] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3](/docs-images/43/7643250/images/page_18.jpg "subjectuniqueid [2] IMPLICIT UniqueIdentifier OPTIONAL, -- If present, version MUST be v2 or v3 extensions [3] Extensions OPTIONAL -- If present, version")
19 Distinguished Name (truth) SEQUENCE OF { SET OF { SEQUENCE { attribute: OBJECT_IDENTIFIER value: UTF8String (or IA5-,...) } } } 19
20 X.509 V3 Extensions (truth) SEQUENCE OF { SEQUENCE { extension ID: OBJECT_IDENTIFIER critical: BOOLEAN encapsulation: OCTET_STRING } } 20
21 CrossCertificatePair SEQUENCE { [0] Certificate OPTIONAL (I'm the subject) [1] Certificate OPTIONAL (I'm the issuer) } 21
22 PEM Files Syntax -----BEGIN... keyword----- Base 64 encoding of BER/DER -----END... keyword bit clean Can be transported with electronic mail Can be transported by cutting and pasting Can contain comments Can have multiple objects in one file 22
23 PEM Example -----BEGIN CERTIFICATE----- MIICwzCCAiygAwIBAgICAzMwDQYJKoZIhvcNAQEEBQAwgbcxCzAJBgNVBAYTAlVT MRIwEAYDVQQIEwlXaXNjb25zaW4xEDAOBgNVBAcTB01hZGlzb24xKDAmBgNVBAoT H1VuaXZlcnNpdHkgb2YgV2lzY29uc2luLU1hZGlzb24xKzApBgNVBAsTIkRpdmlz aw9uig9mieluzm9ybwf0aw9uifrly2hub2xvz3kxkzapbgnvbamtilvxms0ymdaz MTIxOCBNaWRkbGV3YXJlIFRlc3RpbmcgQ0EwHhcNMDMxMjE5MDQwOTQ4WhcNMDcw NDAzMDQwOTQ4WjCBxzELMAkGA1UEBhMCVVMxEjAQBgNVBAgTCVdpc2NvbnNpbjEQ MA4GA1UEBxMHTWFkaXNvbjEoMCYGA1UEChMfVW5pdmVyc2l0eSBvZiBXaXNjb25z aw4ttwfkaxnvbjermckga1uecxmirgl2axnpb24gb2ygsw5mb3jtyxrpb24gvgvj ag5vbg9neteumbiga1ueaxmlrxjpyybob3jtyw4xjtajbgkqhkig9w0bcqewfmvq bm9ybwfuqgrvaxqud2lzyy5lzhuwxdanbgkqhkig9w0baqefaanladbiakeap/27 x8st0gpruulw5aiooausovww9/b3w4xrvrxsk3yfn2jw4k+yarqkv4rjxjb4bril PGBzx4KhVa0umcv1rQIDAQABoxAwDjAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEB BAUAA4GBAA/3rfNggPFRblZMv7UufOrxGxK9QkZAULwbpboYVCophRUM//aRuGO4 s/v/cysa91gljll8gipww7z3jkie1cv+g3ycm83ygtlu1yhb26/jbvc0jg4hl+c1 g1v32rr+e+pesbfsiyokojkbx2welm0ibllpdrrl+muhjmcwmzx END CERTIFICATE
24 PEM? CER? CRT? Just conventions; not really standards.pem: Base64 format (always?) See keywords for kind of object Can be multiple objects.der: Binary BER/DER encoding (always?) Only one per file.cer,.crt: Can be either (sometimes?) Some software figures it out (i.e. makes a good guess) 24
25 PKCS Public Key Cryptography Standards Produced by RSA Labs Specifies format of objects used during public key operations Language is ASN.1 This is not XML, folks Implemented in RSAREF and BSAFE libraries Standards from IETF PKIX working group are a superset and generally compatible 25
26 PKCS1 RSA Keypair Private-Key: (512 bit) modulus: 00:cc:03:09:93:46:3b:67:5e:07:c0:7e:d4:19:b9: 4d:24:8b:d1:53:77:47:e5:cb:b5:ec:21:ca:26:7e: 22:26:bb:42:6b:3a:e7:3b:af:6b:74:29:dc:22:c0: 8f:c1:b6:39:d4:72:d4:59:1e:96:2c:65:e4:64:9a: 7f:80:8b:e8:1d publicexponent: (0x10001) privateexponent: 30:e9:09:82:a5:73:d8:74:52:a7:73:c0:a5:ea:26: f4:7c:10:d3:51:e5:8a:d2:2b:eb:50:ae:86:4b:f7: 24:11:93:2e:ee:f6:6e:45:77:bf:ca:4d:5b:6f:f6: ff:f2:bd:3d:7b:b5:39:c5:c9:5f:9c:18:28:8a:29: 32:7d:9e:81 prime1: 00:f3:61:a0:15:1b:36:13:3e:1a:89:c2:cf:c8:66: b9:45:3c:47:34:55:c6:7d:01:c8:f1:cf:4f:14:a4: e0:d9:a7 prime2: 00:d6:96:dd:78:7e:63:de:a4:8f:5e:45:ea:38:c2: 10:4a:e1:47:79:9a:1b:0b:85:c4:2f:82:7c:a8:f5: 1a:e0:9b exponent1: 00:c6:5d:50:63:43:7d:6c:6b:96:a7:a7:7f:40:df: f0:ab:2c:79:00:7f:d4:ba:38:45:36:48:f8:34:64: 39:db:4b exponent2: 00:c2:05:f6:89:93:fd:c8:b9:11:c8:33:7e:eb:82: cc:28:68:38:b0:02:5e:a1:b4:79:06:5b:fd:4a:e7: 13:3e:31 coefficient: 00:a5:72:28:27:b7:54:a5:9d:1d:20:15:5b:42:ad: a6:76:a0:a6:0b:48:4d:b2:4c:0a:f7:83:78:c8:b5: 36:55:aa Needs password based encryption 26
27 PKCS1 Private Key (PEM Format?) -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,1304AC2997AE5F62 WQjqC3A+NaqjemXh1YPcvrrrKT9ED45Mctq3Yw+N23p3M5vKz2aIk9Ji7EmCTR8v hwtoxjpbodmharr6ws841gn6smcnbtbqy1aov2c+zvvblhhelhfa+sbqroars0yr rfw/ekal+no4qbkeh6uf7jtof1oza9a+ck8hfnwxsyiif04zlnnszt3f4350ysac a2m41ztdtu380pa7xu8ipe4vsajwh27rbpoc9eljdszygpttsqyddln+//txehtu ID4sVWhnp7wsvuOX1iQr++rRWzKgc463QiXngGocKswRjkSIaXN1n2EN7yaHQpGV ql5+k1nqou70zbcvmr7jh2ammqaap6ikskpe0w2wxfse1u180lqqit8mlwmvwalk kzrx9plu+in/nwcazjxa17dyimlfwcphkof6c+v+ec5xzwsua7uutw== -----END RSA PRIVATE KEY----- Someone cheated! 27
28 PKCS8 Private Key -----BEGIN ENCRYPTED PRIVATE KEY----- MIIBgTAbBgkqhkiG9w0BBQMwDgQIqNYWMQBs/VYCAggABIIBYN01SzxggpPDD/TN Z/SF10LL3WRLuqyexqNYccNCr6L8dZ675I/GVxm8OafP9UyltpflyxL3nOuwaE0N G4v3DcORHtGkZVmI0vdwMStosf94AlygeGgMVBgkwyhF+Z14hM11NMrjamqCE4bf +GP0ThzPKyTMPR/X05EClOPXMGRrW7W/6uyivYgjAHiwp8NmlJoRibVyeSAnaQSf ii4ghpyzwd7i2ozfpevqyzrujpu1lubyydlckrbha6qgh+zn081wntlfqot6sryd NTnocVJ86ImCe1+aFng2JQj2WUcKySn0QFdnCcYyIvFLSvpBsXjOK+R/L5qv4dnZ O1bXQb2K0fOCYwuwakJwzt0zqAuaFYn8RUrfkmULWEC6GRcxLrwGL88efNd1On3W lwwqypv6cqah0wuo6ywtuc1fmfjrvf3z92pglh3mn6zw8q6ppgcerkhlt8aajaqb F2adQOE= -----END ENCRYPTED PRIVATE KEY
29 S/MIME IETF Standard for secure electronic mail Digital signatures Need canonical form of message to be signed Encryption Other information for recipient Certificates for verification Sender's public encryption key (certificate) Sender's cryptographic algorithms 29
30 S/MIME (Signed) From: Eric Norman MIME-version: 1.0 Content-type: multipart/signed; protocol="application/pkcs7-signature"; boundary=appl ; micalg=sha1 --Appl Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii; format=flowed Message text --Appl Content-Transfer-Encoding: base64 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGQzCCAsMw ggisoamcaqicagmzma0gcsqgsib3dqebbauamig3mqswcqydvqqgewjvuzesmbaga1uecbmjv2lz... snip... iclcyxuobn5st+ttmbm1s6q+6waaaaaaaa== --Appl
31 PKCS7 Add cryptographic enhancements to data Signatures Encryption Standard does have a type to both sign and encrypt, but it's not used Nesting is used to do both Usually: sign first, then encrypt result Suffers from Davis attack no matter what IETF's cryptographic message syntax (CMS) is superset Designed for one pass processing 31
32 PKCS7 (Signed) 32
33 PKCS7 (Signed) Three parts; all are optional Certificates Content Signature (with signer information) Include all three: opaque signing Omit content: detached signature Only certificates: certs only Used for set/list/chain of certificates File extension =.p7c (or.p7b) 33
34 S/MIME PKCS7 is not just for electronic mail S/MIME is standard for inclusion of PKCS7 objects as MIME attachments Content-type Multipart/Signed Application/PKCS7-Signature Application/PKCS7-MIME Content-transfer-encoding: base64 is not the same thing as PEM format (no -----) 34
35 Detached Signature Most common for S/MIME mail messages Content is readable Content-type = Multipart/Signed Part 1 = Text/Plain, Text/HTML, etc. Part 2 = Application/PKCS7-Signature File extension (part 2) =.p7s Detached content is often mangled by MTAs (like mailing list software) 35
36 Opaque Signature Content is not readable (all base64) Content type = Application/PKCS7-MIME (Just one part) File extension =.p7m Generally not mangled in transit 36
37 S/MIME (Signed) From: Eric Norman MIME-version: 1.0 Content-type: multipart/signed; protocol="application/pkcs7-signature"; boundary=appl ; micalg=sha1 --Appl Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii; format=flowed Message text --Appl Content-Transfer-Encoding: base64 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGQzCCAsMw ggisoamcaqicagmzma0gcsqgsib3dqebbauamig3mqswcqydvqqgewjvuzesmbaga1uecbmjv2lz... snip... iclcyxuobn5st+ttmbm1s6q+6waaaaaaaa== --Appl
38 PKCS7 (Encrypted) 38
39 S/MIME (Encrypted or Opaque Signature) To: Eric Norman MIME-version: 1.0 Content-type: application/pkcs7-mime; name=smime.p7m Content-transfer-encoding: base64 Content-disposition: attachment; filename=smime.p7m MIAGCSqGSIb3DQEHA6CAMIACAQAxggEZMIIBFQIBADCBvjCBtzELMAkGA1UEBhMCVVMxEjAQBgNV BAgTCVdpc2NvbnNpbjEQMA4GA1UEBxMHTWFkaXNvbjEoMCYGA1UEChMfVW5pdmVyc2l0eSBvZiBX axnjb25zaw4ttwfkaxnvbjermckga1uecxmirgl2axnpb24gb2ygsw5mb3jtyxrpb24gvgvjag5v... snip... xap/mxft3fp8abeqlsw8rhnavbz8b3jne34qlltv7uxr+9c1vccbddeyke10hjvttqvo67fmcl7u ze5bsbfjjayjwpypihalynmufdxedvthkkawrrzpb0qqav9kxrwkrmn2yogh5blrrq1twuohcaqi pjao+ffihbiaaaaaaaaaaaaa 39
40 PKCS12 Purpose is transport or backup Transport = export, copy file, import Bundle contains: Private key encrypted with password Associated certificate Other certificates (chain through trust achor) Private key must be extractable for export File extension =.p12 or.pfx Always binary (no PEM) 40
41 File Extensions Base64.pem: base64 (see keyword) Base64 (usually, but might be binary).cer,.crt: certificate.csr: certificate signing request (PKCS10).crl: certificate revocation list Binary.p7s: PKCS7 signature (detached).p7m: PKCS7 (encrypted or opaque signature).p7c,.p7b: PKCS7 certificates only.p12,.pfx: PKCS12 export/import bundle 41
42 OpenSSL Certificate Store Memory Load with...file <filename.pem> Multiple certificates; PEM format Directory (UNIX, not LDAP) Load with...path <directory name> One certificate per file; PEM format Indexed by hash of subject DN; e.g. 1AD4BB3E.0 is symbolic link to PEM file Rarely useful (maybe with stunnel) Create with tools/c_rehash 42
43 OpenSSL Utilities openssl <utility> <arguments>... Argument order is never important Will prompt for passwords when appropriate -passin is for scripts openssl -help to list utilities openssl <utility> -help for specific usage There's also man pages Just openssl gives you a shell Don't have to type openssl in front of everything 43
44 OpenSSL Utilities (Common Arguments) -in <filename> Standard input if omitted -inform DER or PEM (default) -out <filename> Standard output if omitted -outform DER or PEM (default) No overwrite warning -noout -text Human readable listing 44
45 Useful OpenSSL Utilities enc to decode base64 asn1parse to examine BER/DER x509 to examine certificates dgst to get fingerprints smime to disassemble mail messages pkcs7 to extract certificates from.p7s,.p7c pkcs12 to assemble/disassemble.p12 s_client to fetch server certificates 45
46 Just Looking dumpasn1 (Peter Gutmann) BER/DER (binary) format only Translates more OIDs Shows encapsulations asn1parse (OpenSSL utility) PEM format (default; -inform DER for binary) Translates some OIDs No encapsulations 46
47 4 Fundamental Operations Sign Sender uses own private key Verify Recipient uses public key of sender Does SSL server know its private key? Encrypt Sender uses public key of recipient Decrypt Recipient uses own private key 47
48 Verification: Murphy Speaks No trust anchor Check 3 boxes (Netscape/Mozilla) Missing intermediate CA certificate Sender should provide Recipient can provide Mangled detached content Mailing lists are notorious Unknown extension (rare) User can't do hash algorithm 48
49 Murphy on Decryption Don't have private key Key is identified by issuer and serial Same key, different certificates doesn't help Different machines (use PKCS12) Key change (don't delete old key or certificate) Vendor didn't read standards How does sender know which public key to use? Recipient can't do symmetric cipher Can sender recover cleartext? 49
50 The End 50
Prepared By: P0209337 Lichen. P0209259 Xulu
Local Certificate Authority Prepared By: P0209337 Lichen P0209259 Xulu 1 2 Abstract Today, security of information is most important in the Internet; for example, electronic commerce and electronic government
Prof. Sead Muftic Feng Zhang. Lecture 10: Secure E-mail Systems
Prof. Sead Muftic Feng Zhang Lecture 10: Secure E-mail Systems Lecture 10 : Secure E mail Systems Subjects / Topics : 1. Secure E mail systems 2. Secure, Trusted, Authorized and Reliable E Mail System
Package PKI. July 28, 2015
Version 0.1-3 Package PKI July 28, 2015 Title Public Key Infrastucture for R Based on the X.509 Standard Author Maintainer Depends R (>= 2.9.0),
4.1: Securing Applications Remote Login: Secure Shell (SSH) E-Mail: PEM/PGP. Chapter 5: Security Concepts for Networks
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Secure Applications Network Authentication Service: Kerberos 4.1:
Package PKI. February 20, 2013
Package PKI February 20, 2013 Version 0.1-1 Title Public Key Infrastucture for R based on the X.509 standard Author Maintainer Depends R (>=
Category: Standards Track June 1999
Network Working Group P. Hoffman, Editor Request for Comments: 2634 Internet Mail Consortium Category: Standards Track June 1999 Status of this Memo Enhanced Security Services for S/MIME This document
public key version 0.2
version 0.2 Typeset in L A TEX from SGML source using the DocBuilder-0.9.8.4 Document System. Contents 1 User s Guide 1 1.1 Introduction.......................................... 1 1.1.1 Purpose........................................
mod_ssl Cryptographic Techniques
mod_ssl Overview Reference The nice thing about standards is that there are so many to choose from. And if you really don t like all the standards you just have to wait another year until the one arises
Lecture 10: 1. Secure E mail E systems. Systems. Page 1
1 2 Prof. Sead Matei Ciobanu Morogan Abdul Ghafoor Abbasi Lecture 10: Secure E-mailE Lecture 10 : Secure E mail E Subjects / opics : 1. Secure E mail E systems 2. Secure, rusted, Authorized and eliable
E-Mail security. Mag. iur. Dr. techn. Michael Sonntag
Mag. iur. Dr. techn. Michael Sonntag E-Mail security E-Mail: sonntag@fim.uni-linz.ac.at http://www.fim.uni-linz.ac.at/staff/sonntag.htm Institute for Information Processing and Microprocessor Technology
DATEVe:secure MAIL V1.1. ISIS-MTT-Assessment Report
DATEVe:secure MAIL V1.1 DATEV eg ISIS-MTT-Assessment Report Version 1.1 Date 08. July 2004 Hans-Joachim Knobloch, Fritz Bauspiess Secorvo Security Consulting GmbH Albert-Nestler-Straße 9 D-76131 Karlsruhe
Grid Computing - X.509
Grid Computing - X.509 Sylva Girtelschmid October 20, 2009 Public Key Infrastructure - PKI PKI Digital Certificates IT infrastructure that provides means for private and secure data exchange By using cryptographic
Specifying the content and formal specifications of document formats for QES
NATIONAL SECURITY AUTHORITY Version 1.0 Specifying the content and formal specifications of document formats for QES 24 July 2007 No.: 3198/2007/IBEP-013 NSA Page 1/14 This English version of the Slovak
All your private keys are belong to us
All your private keys are belong to us 1 All your private keys are belong to us Extracting RSA private keys and certificates from process memory Tobias Klein tk@trapkit.de Version 1.0, 2006/02/05. All
Electronic Mail Security
email 1 Electronic Mail Security Slide 1 Characteristics File transfer, except... sender, receiver may not be present at the same time diversity(charactersets, headers,...) not a transparent channel (8
OpenSSL (lab notes) Definition: OpenSSL is an open-source library containing cryptographic tools.
Network security MSc IDL (GLIA) and MSc HIT / Isima Academic year 2012-2013 OpenSSL (lab notes) Definition: OpenSSL is an open-source library containing cryptographic tools. 1. OpenSSL usage Exercice 1.1
Security Issues of the Digital Certificates within Public Key Infrastructures
16 Security Issues of the Digital Certificates within Public Key Infrastructures Cristian TOMA Economic Informatics Department, Academy of Economic Studies, Bucharest, Romania cristian.toma@ie.ase.ro The
How to make Secure Email Easier to use Simson L. Garfinkel (MIT/Harvard) Jeffrey I. Schiller (MIT) Erik Nordlander (MIT) David Margrave (Amazon) Robert C. Miller (MIT) Financial Services Technology Consortium
Electronic Mail Security
Electronic Mail Security Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Electronic mail security. MHS (Message Handling System)
Electronic mail security Diana Berbecaru < diana.berbecaru @ polito.it> Politecnico di Torino Dip. Automatica e Informatica MHS (Message Handling System) MS MS MUA MUA (Message Transfer ) MS (Message Store)
NISTIR 7676 Maintaining and Using Key History on Personal Identity Verification (PIV) Cards
NISTIR 7676 Maintaining and Using Key History on Personal Identity Verification (PIV) Cards David A. Cooper NISTIR 7676 Maintaining and Using Key History on Personal Identity Verification (PIV) Cards David
Information Systems Security Management
Information Systems Security Management Gerald Quirchmayr, Edgar Weippl, Oliver Jorns Fakultät für Wirtschaftswissenschaften und Informatik Liebiggasse 4/3-4, 1010 Wien Tel. +43-1-4277-38431 Fax +43-1-4277-38449
User Guide Supplement. S/MIME Support Package for BlackBerry Smartphones BlackBerry Pearl 8100 Series
User Guide Supplement S/MIME Support Package for BlackBerry Smartphones BlackBerry Pearl 8100 Series SWD-292878-0324093908-001 Contents Certificates...3 Certificate basics...3 Certificate status...5 Certificate
Biometrics, Tokens, & Public Key Certificates
Biometrics, Tokens, & Public Key Certificates The Merging of Technologies TOKENEER Workstations WS CA WS WS Certificate Authority (CA) L. Reinert S. Luther Information Systems Security Organization Biometrics,
SBClient SSL. Ehab AbuShmais
SBClient SSL Ehab AbuShmais Agenda SSL Background U2 SSL Support SBClient SSL 2 What Is SSL SSL (Secure Sockets Layer) Provides a secured channel between two communication endpoints Addresses all three
Federal S/MIME V3 Client Profile
NIST Special Publication 800-49 Federal S/MIME V3 Client Profile C. Michael Chernick C O M P U T E R S E C U R I T Y November 2002 NIST Special Publication 800-49 Federal S/MIME V3 Client Profile Recommendations
Encrypted Connections
EMu Documentation Encrypted Connections Document Version 1 EMu Version 4.0.03 www.kesoftware.com 2010 KE Software. All rights reserved. Contents SECTION 1 Encrypted Connections 1 How it works 2 Requirements
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 11: Email security: PGP and S/MIME Ion Petre Department of IT, Åbo Akademi University February 14, 2012 1 Email
GNUTLS. a Transport Layer Security Library This is a Draft document Applies to GnuTLS 1.0.13. by Nikos Mavroyanopoulos
GNUTLS a Transport Layer Security Library This is a Draft document Applies to GnuTLS 1.0.13 by Nikos Mavroyanopoulos ii Copyright c 2001,2002,2003 Nikos Mavroyanopoulos Permission is granted to copy, distribute
Email, SNMP, Securing the Web: SSL
Email, SNMP, Securing the Web: SSL 4 January 2015 Lecture 12 4 Jan 2015 SE 428: Advanced Computer Networks 1 Topics for Today Email (SMTP, POP) Network Management (SNMP) ASN.1 Secure Sockets Layer 4 Jan
Cryptography and Network Security Chapter 15
Cryptography and Network Security Chapter 15 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 15 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North
Chapter 6 Electronic Mail Security
Cryptography and Network Security Chapter 6 Electronic Mail Security Lectured by Nguyễn Đức Thái Outline Pretty Good Privacy S/MIME 2 Electronic Mail Security In virtually all distributed environments,
1.2 Using the GPG Gen key Command
Creating Your Personal Key Pair GPG uses public key cryptography for encrypting and signing messages. Public key cryptography involves your public key which is distributed to the public and is used to
A PKI case study: Implementing the Server-based Certificate Validation Protocol
54 ISBN: 978-960-474-048-2 A PKI case study: Implementing the Server-based Certificate Validation Protocol MARIUS MARIAN University of Craiova Department of Automation ROMANIA marius.marian@cs.ucv.ro EUGEN
MTAT.07.017 Applied Cryptography
MTAT.07.017 Applied Cryptography Public Key Infrastructure (PKI) Public Key Certificates (X.509) University of Tartu Spring 2015 1 / 42 The hardest problem Key Management How to obtain the key of the other
Symmetric and Public-key Crypto Due April 14 2015, 11:59PM
CMSC 414 (Spring 2015) 1 Symmetric and Public-key Crypto Due April 14 2015, 11:59PM Updated April 11: see Piazza for a list of errata. Sections 1 4 are Copyright c 2006-2011 Wenliang Du, Syracuse University.
SolarWinds Technical Reference
SolarWinds Technical Reference Using SSL Certificates in Web Help Desk Introduction... 1 How WHD Uses SSL... 1 Setting WHD to use HTTPS... 1 Enabling HTTPS and Initializing the Java Keystore... 1 Keys
Alternate Representations of the Public Key Cryptography Standards (PKCS) Using S-Expressions, S-PKCS
Alternate Representations of the Public Key Cryptography Standards (PKCS Using S-Expressions, S-PKCS Matthew D. Wood Carl M. Ellison Intel Security Technology Lab Alternate Representations of the Public
Displaying SSL Certificate and Key Pair Information
CHAPTER 6 Displaying SSL Certificate and Key Pair Information This chapter describes the show commands available for displaying SSL-related information, such as certificate signing request (CSR) parameter
WebApp S/MIME Manual. Release 7.2.1. Zarafa BV
WebApp S/MIME Manual Release 7.2.1 Zarafa BV January 06, 2016 Contents 1 Introduction 2 2 Installation 3 2.1 RPM based distributions............................................. 3 2.2 DEB based distributions.............................................
Djigzo S/MIME setup guide
Author: Martijn Brinkers Table of Contents...1 Introduction...3 Quick setup...4 Create a CA...4 Fill in the form:...5 Add certificates for internal users...5 Add certificates for external recipients...7
Design and Implementation of LDAP Component Matching for Flexible and Secure Certificate Access in PKI
Design and Implementation of LDAP Matching for Flexible and Secure Certificate Access in PKI Sang Seok Lim IBM Watson Research Center P.O. Box 218 Yorktown Heights, NY 10598 slim@us.ibm.com Jong Hyuk Choi
Displaying SSL Certificate and Key Pair Information
CHAPTER6 Displaying SSL Certificate and Key Pair Information This chapter describes how to use the available show commands to display SSL-related information, such as the certificate and key pair files
INTERNATIONAL TELECOMMUNICATION UNION
INTERNATIONAL TELECOMMUNICATION UNION ITU-T X.690 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (07/2002) SERIES X: DATA NETWORKS AND OPEN SYSTEM COMMUNICATIONS OSI networking and system aspects Abstract
Network Security Essentials Chapter 7
Network Security Essentials Chapter 7 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 7 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear,
Electronic Mail Security. Email Security. email is one of the most widely used and regarded network services currently message contents are not secure
Electronic Mail Security CSCI 454/554 Email Security email is one of the most widely used and regarded network services currently message contents are not secure may be inspected either in transit or by
Online signature API. Terms used in this document. The API in brief. Version 0.20, 2015-04-08
Online signature API Version 0.20, 2015-04-08 Terms used in this document Onnistuu.fi, the website https://www.onnistuu.fi/ Client, online page or other system using the API provided by Onnistuu.fi. End
Number of relevant issues
Electronic signature Lecture 8 Number of relevant issues cryptography itself algorithms for signing documents key management generating keys, distribution, key revocation security policy certificates may
Network Working Group. Category: Informational Internet Mail Consortium B. Ramsdell Worldtalk J. Weinstein Netscape March 1998
Network Working Group Request for Comments: 2312 Category: Informational S. Dusse RSA Data Security P. Hoffman Internet Mail Consortium B. Ramsdell Worldtalk J. Weinstein Netscape March 1998 Status of
A Security Flaw in the X.509 Standard Santosh Chokhani CygnaCom Solutions, Inc. Abstract
A Security Flaw in the X509 Standard Santosh Chokhani CygnaCom Solutions, Inc Abstract The CCITT X509 standard for public key certificates is used to for public key management, including distributing them
International Journal of Computer Trends and Technology- March to April Issue 2011
EMAIL SECURITY PROTOCOL Sunny gill 1, Gaurav Rupnar 1, Vaibhav Ramteke 1,PROF. Dipti Patil 2, Vijay M.Wadhai 3 1 Computer Engineering Department, MIT College of Engineering,Pune 2 Assistant Professor,
Email Electronic Mail
Email Electronic Mail Electronic mail paradigm Most heavily used application on any network Electronic version of paper-based office memo Quick, low-overhead written communication Dates back to time-sharing
(n)code Solutions CA A DIVISION OF GUJARAT NARMADA VALLEY FERTILIZERS COMPANY LIMITED P ROCEDURE F OR D OWNLOADING
(n)code Solutions CA A DIVISION OF GUJARAT NARMADA VALLEY FERTILIZERS COMPANY LIMITED P ROCEDURE F OR D OWNLOADING a SSL Certificate for Communigate Pro Server V ERSION 1.0 Page 1 of 7 STEP 01 : Assigning
OpenADR 2.0 Security. Jim Zuber, CTO QualityLogic, Inc.
OpenADR 2.0 Security Jim Zuber, CTO QualityLogic, Inc. Security Overview Client and server x.509v3 certificates TLS 1.2 with SHA256 ECC or RSA cipher suites TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA256
A Noval Approach for S/MIME
Volume 1, Issue 7, December 2013 International Journal of Advance Research in Computer Science and Management Studies Research Paper Available online at: www.ijarcsms.com A Noval Approach for S/MIME K.Suganya
X.509 Certificate Generator User Manual
X.509 Certificate Generator User Manual Introduction X.509 Certificate Generator is a tool that allows you to generate digital certificates in PFX format, on Microsoft Certificate Store or directly on
Understanding digital certificates
Understanding digital certificates Mick O Brien and George R S Weir Department of Computer and Information Sciences, University of Strathclyde Glasgow G1 1XH mickobrien137@hotmail.co.uk, george.weir@cis.strath.ac.uk
Detailed Specifications
1 of 6 Appendix Detailed Specifications 1. Standards The following standards are used in the document under the following abbreviations: - BASE32, BASE64, BASE64-URL: Network Working Group: Request for
Certificate technology on Pulse Secure Access
Certificate technology on Pulse Secure Access How-to Guide Published Date July 2015 Contents Introduction: 3 Creating a Certificate signing request (CSR): 3 Import Intermediate CAs: 5 Using Trusted Client
The Direct Project. Implementation Guide for Direct Project Trust Bundle Distribution. Version 1.0 14 March 2013
The Direct Project Implementation Guide for Direct Project Trust Bundle Distribution Version 1.0 14 March 2013 Version 1.0, 14 March 2013 Page 1 of 14 Contents Change Control... 3 Status of this Guide...
Certificate technology on Junos Pulse Secure Access
Certificate technology on Junos Pulse Secure Access How-to Introduction:... 1 Creating a Certificate signing request (CSR):... 1 Import Intermediate CAs: 3 Using Trusted Client CA on Juno Pulse Secure
AS DNB banka. DNB Link specification (B2B functional description)
AS DNB banka DNB Link specification (B2B functional description) DNB_Link_FS_EN_1_EXTSYS_1_L_2013 Table of contents 1. PURPOSE OF THE SYSTEM... 4 2. BUSINESS PROCESSES... 4 2.1. Payment for goods and services...
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Digital Signature User Guide for Acrobat 9.0 and Adobe Reader 9.0
bc PDF Creation Date: November 17, 2008 Digital Signature User Guide for Acrobat 9.0 and Adobe Reader 9.0 Acrobat and Adobe Reader Version 9.0 2008 Adobe Systems Incorporated. All rights reserved. Digital
(n)code Solutions CA A DIVISION OF GUJARAT NARMADA VALLEY FERTILIZERS COMPANY LIMITED P ROCEDURE F OR D OWNLOADING
(n)code Solutions CA A DIVISION OF GUJARAT NARMADA VALLEY FERTILIZERS COMPANY LIMITED P ROCEDURE F OR D OWNLOADING a Class IIIc SSL Certificate using BEA Weblogic V ERSION 1.0 Page 1 of 8 Procedure for
Vulnerabilities of the usage of digital signature
Vulnerabilities of the usage of digital signature The efforts made concerning the use of the digital signature represent a significant step in the information technology. These efforts do not or just to
SSL Certificates HOWTO
Franck Martin Revision History Revision v0.1 2001 11 18 Revised by: fm A first hand approach on how to manage a certificate authority (CA), and issue or sign certificates to be used for secure web, secure
Visa/MasterCard Secure Electronic Transactions (SET) Scope of SET Protocols
Visa/MasterCard Secure Electronic Transactions (SET) Specification of the Official method of achieving network payment via Credit Cards Announced in February 1996 Supported by Visa, MasterCard, GTE, IBM,
Bank link technical specifications. Information for programmers
Bank link technical specifications Information for programmers 2015 01 08 1 Content Content...2 Rules of services...3 Queries...3 Queries from the merchant to the bank...4 Queries from the bank to the
Network Security - Secure upper layer protocols - Background. Email Security. Question from last lecture: What s a birthday attack? Dr.
Network Security - Secure upper layer protocols - Dr. John Keeney 3BA33 Question from last lecture: What s a birthday attack? might think a m-bit hash is secure but by Birthday Paradox is not the chance
Ciphermail for BlackBerry Reference Guide
CIPHERMAIL EMAIL ENCRYPTION Ciphermail for BlackBerry Reference Guide June 19, 2014, Rev: 8975 Copyright 2010-2014, ciphermail.com. CONTENTS CONTENTS Contents 1 Introduction 3 2 BlackBerry add-on 3 2.1
PGP from: Cryptography and Network Security
PGP from: Cryptography and Network Security Fifth Edition by William Stallings Lecture slides by Lawrie Brown (*) (*) adjusted by Fabrizio d'amore Electronic Mail Security Despite the refusal of VADM Poindexter
Generating and Installing SSL Certificates on the Cisco ISA500
Application Note Generating and Installing SSL Certificates on the Cisco ISA500 This application note describes how to generate and install SSL certificates on the Cisco ISA500 security appliance. It includes
Key Management and Distribution
Key Management and Distribution Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu udio/video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
BEA Weblogic Guide to Installing Root Certificates, Generating CSR and Installing SSL Certificate
BEA Weblogic Guide to Installing Root Certificates, Generating CSR and Installing SSL Certificate Copyright. All rights reserved. Trustis Limited Building 273 New Greenham Park Greenham Common Thatcham
Entrust Certificate Services. Java Code Signing. User Guide. Date of Issue: December 2014. Document issue: 2.0
Entrust Certificate Services Java Code Signing User Guide Date of Issue: December 2014 Document issue: 2.0 Copyright 2009-2014 Entrust. All rights reserved. Entrust is a trademark or a registered trademark
Configuring SSL Termination
CHAPTER 4 This chapter describes the steps required to configure a CSS as a virtual SSL server for SSL termination. It contains the following major sections: Overview of SSL Termination Creating an SSL
PKI and OpenSSL part 1 X.509 from the user s and the client software s point of view
PKI and OpenSSL part 1 X.509 from the user s and the client software s point of view Version 0.5 Richard Levitte, mailto:levittelp.se November 18, 2003 A serie of lectures PKI and OpenSSL part 1: codex.509
Encrypting and signing e-mail
Encrypting and signing e-mail V1.0 Developed by Gunnar Kreitz at CSC, KTH. V2.0 Developed by Pehr Söderman at ICT, KTH (Pehrs@kth.se) V3.0 Includes experiences from the 2009 course V3.1 Adaptation for
Replacing vcenter Server 4.0 Certificates VMware vsphere 4.0
Technical Note Replacing vcenter Server 4.0 Certificates VMware vsphere 4.0 Certificates are automatically generated when you install vcenter Server and ESX/ESXi. These default certificates are not signed
Creation and Management of Certificates
Security OpenSSL Creation and Management of Certificates Roberta Daidone roberta.daidone@iet.unipi.it What are we going to do? Setup of a Certification Authority Creation of a self-signed root certificate
Secure Socket Layer. Introduction Overview of SSL What SSL is Useful For
Secure Socket Layer Secure Socket Layer Introduction Overview of SSL What SSL is Useful For Introduction Secure Socket Layer (SSL) Industry-standard method for protecting web communications. - Data encryption
TechNote 0006: Digital Signatures in PDF/A-1
TechNote 0006: Digital Signatures in PDF/A-1 Digital signatures are primarily used to check the integrity of the signed part of the document. They also can be used to authenticate the signer s identity
Managing the SSL Certificate for the ESRS HTTPS Listener Service Technical Notes P/N 300-011-843 REV A01 January 14, 2011
Managing the SSL Certificate for the ESRS HTTPS Listener Service Technical Notes P/N 300-011-843 REV A01 January 14, 2011 This document contains information on these topics: Introduction... 2 Terminology...
How To Encrypt Data With Encryption
USING ENCRYPTION TO PROTECT SENSITIVE INFORMATION Commonwealth Office of Technology Security Month Seminars Alternate Title? Boy, am I surprised. The Entrust guy who has mentioned PKI during every Security
Aloaha Sign! (English Version)
Aloaha Sign! (English Version) Aloaha Sign! (English Version) All rights reserved. No parts of this work may be reproduced in any form or by any means - graphic, electronic, or mechanical, including photocopying,
webmethods Certificate Toolkit
Title Page webmethods Certificate Toolkit User s Guide Version 7.1.1 January 2008 webmethods Copyright & Document ID This document applies to webmethods Certificate Toolkit Version 7.1.1 and to all subsequent
ASA 8.x Manually Install 3rd Party Vendor Certificates for use with WebVPN Configuration Example
ASA 8.x Manually Install 3rd Party Vendor Certificates for use with WebVPN Configuration Example Document ID: 98596 Contents Introduction Prerequisites Requirements Components Used Conventions Configure
Avoid the SSLippery Slope of Default SSL
Copyright 2014 Splunk Inc. Avoid the SSLippery Slope of Default SSL Duane Waddle, IT Specialist, UltraMegaCorp George Starcher, Security Engineer, Peak Hosting SSL Refresher Provides bulk encryption of
Standards and Products. Computer Security. Kerberos. Kerberos
3 4 Standards and Products Computer Security Standards and Products Public Key Infrastructure (PKI) IPsec SSL/TLS Electronic Mail Security: PEM, S/MIME, and PGP March 24, 2004 2004, Bryan J. Higgs 1 2
SSL Configuration on Weblogic Oracle FLEXCUBE Universal Banking Release 12.0.87.01.0 [August] [2014]
![SSL Configuration on Weblogic Oracle FLEXCUBE Universal Banking Release 12.0.87.01.0 [August] [2014]](/thumbs/34/16904074.jpg "SSL Configuration on Weblogic Oracle FLEXCUBE Universal Banking Release 12.0.87.01.0 [August] [2014]")
SSL Configuration on Weblogic Oracle FLEXCUBE Universal Banking Release 12.0.87.01.0 [August] [2014] Table of Contents 1. CONFIGURING SSL ON ORACLE WEBLOGIC... 1-1 1.1 INTRODUCTION... 1-1 1.2 SETTING UP
public_key Copyright 2008-2015 Ericsson AB, All Rights Reserved public_key 1.0.1 September 22, 2015
public_key Copyright 2008-2015 Ericsson AB, All Rights Reserved public_key 1.0.1 September 22, 2015 Copyright 2008-2015 Ericsson AB, All Rights Reserved Licensed under the Apache License, Version 2.0 (the
Cryptography and Security
Cunsheng DING Version 3 Lecture 17: Electronic Mail Security Outline of this Lecture 1. Email security issues. 2. Detailed introduction of PGP. Page 1 Version 3 About Electronic Mail 1. In virtually all
Domino and Internet. Security. IBM Collaboration Solutions. Ask the Experts 12/16/2014
Domino and Internet Ask the Experts 12/16/2014 Security IBM Collaboration Solutions Agenda Overview of internet encryption technology Domino's implementation of encryption Demonstration of enabling an
The basic groups of components are described below. Fig X- 1 shows the relationship between components on a network.
Elements of Email Email Components There are a number of software components used to produce, send and transfer email. These components can be broken down as clients or servers, although some components
You re FREE Guide SSL. (Secure Sockets Layer) webvisions www.webvisions.com +65 6868 1168 sales@webvisions.com
SSL You re FREE Guide to (Secure Sockets Layer) What is a Digital Certificate? SSL Certificates, also known as public key certificates or Digital Certificates, are essential to secure Internet browsing.
BERserk Vulnerability
Intel Security: Advanced Threat Research BERserk Vulnerability Part 2: Certificate Forgery in Mozilla NSS October 6, 2014 Contents DigestInfo ASN.1 Decoding Vulnerabilities in Mozilla NSS... 2 Forging
Configuring Digital Certificates
CHAPTER 36 This chapter describes how to configure digital certificates and includes the following sections: Information About Digital Certificates, page 36-1 Licensing Requirements for Digital Certificates,
Everything is Terrible
Everything is Terrible A deep dive into provisioning and code signing Hello and welcome to Everything is Terrible. This is a deep dive talk into the processes behind provisioning and code signing on Apple