Introduction to Network Security Key Management and Distribution
|
|
|
- Albert Booth
- 8 years ago
- Views:
Transcription
1 Introduction to Network Security Key Management and Distribution Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology 28 September 2015 rev Egemen K. Çetinkaya
2 Key Management and Distribution Outline Symmetric key distribution Public key distribution X.509 certificates PKI 28 September 2015 MST CPE 5420 Key Management and Distribution 2
3 Key Management and Distribution Symmetric Key Distribution Symmetric key distribution using symmetric key encryption using asymmetric encryption Public key distribution X.509 certificates PKI 28 September 2015 MST CPE 5420 Key Management and Distribution 3
4 Key Management and Distribution Overview Delivery of a key to two parties Frequent key changes are desirable to limit amount of data compromised if attacker learns key For symmetric encryption to work two parties exchange share the same key key must be protected from access by others 28 September 2015 MST CPE 5420 Key Management and Distribution 4
5 Symmetric Key Distribution Methods Key exchange between the sender and receiver sender and receiver physically exchange the key sender and receiver use a recent (old) key to decrypt and exchange the new key Key distribution via third party third party selects key and physically deliver to end systems third party delivers the key via encrypted links Scale is an issue how would you distribute many keys physically? Third party against the very basic principle of security 28 September 2015 MST CPE 5420 Key Management and Distribution 5
6 Symmetric Key Distribution Scale How many keys are needed in n node comm.? Egemen K. Çetinkaya 28 September 2015 MST CPE 5420 Key Management and Distribution 6
7 Symmetric Key Distribution Scale Egemen K. Çetinkaya Number of keys needed: n (n 1)/2 28 September 2015 MST CPE 5420 Key Management and Distribution 7
8 Symmetric Key Distribution Key Hierarchy Egemen K. Çetinkaya Hierarchy reduces number of keys exchanged 28 September 2015 MST CPE 5420 Key Management and Distribution 8
9 Symmetric Key Distribution Centralized Scenario Egemen K. Çetinkaya Key exchange involves distribution and authentication 28 September 2015 MST CPE 5420 Key Management and Distribution 9
10 Symmetric Key Distribution Centralized Scenario Steps Step 1: initiator requests session key using initiator id, responder id, nonce nonce: random number that prevents masquerading Step 2: KDC responds session key encrypted using initiator's master key Step 3: initiator forwards session key to responder encrypted using responder s master key Step 4: responder sends a nonce validating session key using a different nonce Step 5: initiator responds to nonce validating identity completes authentication between initiator and responder 28 September 2015 MST CPE 5420 Key Management and Distribution 10
11 Hierarchical Key Distribution Overview What are the issues using one KDC? Egemen K. Çetinkaya 28 September 2015 MST CPE 5420 Key Management and Distribution 11
12 Hierarchical Key Distribution Architecture Using one KDC does not scale Uses local KDC for local domain communication If two entities in different domains desire shared key corresponding local KDCs communicate through global KDC Scheme minimizes effort in master key distribution most master keys shared by local KDC and its local entities limits range of faulty or subverted KDC to its local area only Hierarchical can be extended to three or more layers 28 September 2015 MST CPE 5420 Key Management and Distribution 12
13 Symmetric Key Distribution Decentralized Scenario Key exchange does not involve KDC Session key exchanged between initiator & responder This eliminates concern about KDC trustworthiness Not practical for larger networks 28 September 2015 MST CPE 5420 Key Management and Distribution 13
14 Symmetric Key Distribution Decentralized Scenario Steps Step 1: initiator requests session key from responder using initiator id, nonce nonce: random number that prevents masquerading Step 2: responder responds session key encrypted using master key (between two parties) responder also send a second nonce Step 3: initiator responds to nonce validating identity completes authentication between initiator and responder 28 September 2015 MST CPE 5420 Key Management and Distribution 14
15 Key Usage Lifetime and Control Session key lifetime has tradeoffs more frequent the session keys, more secure communication more frequent session keys delays start of communication exchange overhead of key exchange reduces network capacity Connection-oriented protocols key length time during session Connectionless protocols key length time for a fixed period of time Keys should be controlled/separated master and session keys should be separate 28 September 2015 MST CPE 5420 Key Management and Distribution 15
16 Key Management and Distribution Symmetric Key Distribution Symmetric key distribution using symmetric key encryption using asymmetric encryption Public key distribution X.509 certificates PKI 28 September 2015 MST CPE 5420 Key Management and Distribution 16
17 Symmetric Key Distribution Using Public-key Encryption Step 1: initiator requests session key from responder using initiator id and public-key Step 2: responder responds session key encrypted using public-key only A can decrypt using A s private-key What is the security risk? 28 September 2015 MST CPE 5420 Key Management and Distribution 17
18 Symmetric Key Distribution Man-in-the-Middle Attack Egemen K. Çetinkaya D can eavesdrop & capture session key, alternative? 28 September 2015 MST CPE 5420 Key Management and Distribution 18
19 Symmetric Key Distribution Using Public-key Encryption Key exchange does not involve KDC Session key exchanged between initiator & responder Uses two separate public-keys 28 September 2015 MST CPE 5420 Key Management and Distribution 19
20 Symmetric Key Distribution Using Public-key Encryption Step 1: initiator requests session key from responder using initiator id, nonce A encrypted with B s public key Step 2: responder responds two nonce: nonce A and nonce B encrypted using A s public-key Step 3: initiator responds to nonce B encrypted using B s public-key this step confirms A is intended initiator from B s perspective Step 4: initiator sends session key encrypted with A s private key and B s public-key 28 September 2015 MST CPE 5420 Key Management and Distribution 20
21 Key Management and Distribution Public Key Distribution Symmetric key distribution Public key distribution X.509 certificates PKI 28 September 2015 MST CPE 5420 Key Management and Distribution 21
22 Public-Key Distribution Methods Egemen K. Çetinkaya What are the methods for public-key distribution? 28 September 2015 MST CPE 5420 Key Management and Distribution 22
23 Public-Key Distribution Methods Public announcement Publicly available directory Public-key authority Public-key certificates 28 September 2015 MST CPE 5420 Key Management and Distribution 23
24 Public-Key Distribution Public Announcement Users broadcast their public-key Disadvantage? 28 September 2015 MST CPE 5420 Key Management and Distribution 24
25 Public-Key Distribution Public Announcement Users broadcast their public-key User forgery anyone can claim to be A and encrypt/decrypt messages use of network resources for broadcasting 28 September 2015 MST CPE 5420 Key Management and Distribution 25
26 Public-Key Distribution Publicly Available Directory Authority maintains directory with {name, public-key} Participants register, replace, access directory Disadvantage? 28 September 2015 MST CPE 5420 Key Management and Distribution 26
27 Public-Key Distribution Publicly Available Directory Authority maintains directory with {name, public-key} Participants register, replace, access directory Single point of attack 28 September 2015 MST CPE 5420 Key Management and Distribution 27
28 Public-Key Distribution Public-key Authority Authority distributes public-keys using encrypted messages Public-keys can be cached in end-users memory Disadvantage? 28 September 2015 MST CPE 5420 Key Management and Distribution 28
29 Public-Key Distribution Public-key Authority Authority distributes public-keys using encrypted messages Public-keys can be cached in end-users memory Single point of attack and 7 steps 28 September 2015 MST CPE 5420 Key Management and Distribution 29
30 Public-Key Distribution Public-key Certificates Public-key authority could be bottleneck in system users contact authority for a public key for every other user Authority is vulnerable to tampering Certificates can be used to exchange keys without contacting a public-key authority without sacrificing security A certificate consists of: a public key an identifier of the key owner the whole block signed by a trusted third party 28 September 2015 MST CPE 5420 Key Management and Distribution 30
31 Public-Key Distribution Certificate Authority The trusted third party is a certificate authority trusted by the user community a government agency or a financial institution A user presents public key to obtain a certificate The user can then publish the certificate anyone can obtain the certificate and verify its validity Requirements: any participant can read a certificate any participant can verify that the certificate is authentic only certificate authority can create and update certificates any participant can verify the currency of the certificate 28 September 2015 MST CPE 5420 Key Management and Distribution 31
32 Public-Key Certificates Obtaining Certificates Users supply public-key to obtain certificate Application must be in person or some secure way Certification includes timestamp, id, public-key encrypted using private key of the authority 28 September 2015 MST CPE 5420 Key Management and Distribution 32
33 Public-Key Certificates Exchanging Certificates Initiator A sends the certificate to responder B Responder B decrypts the message using private-key of the authority Users have id, timestamp, and public-key Timestamp prevents replay attack timestamp serves as an expiration date 28 September 2015 MST CPE 5420 Key Management and Distribution 33
34 Key Management and Distribution X.509 Certificates Symmetric key distribution Public key distribution X.509 certificates PKI 28 September 2015 MST CPE 5420 Key Management and Distribution 34
35 X.509 Certificates Overview Recommendation International Standard ITU-T X.509 ISO/IEC Defines a framework for: public-key certificates attribute certificates These frameworks used by applications: Public Key Infrastructures (PKI) Privilege Management Infrastructures (PMI) Defines a framework that defines directory services directory is, in effect, a server or distributed set of servers that maintains a database of information about users 28 September 2015 MST CPE 5420 Key Management and Distribution 35
36 X.509 Certificates History Latest version is V3 28 September 2015 MST CPE 5420 Key Management and Distribution 36
37 X.509 Certificates Usage X.509 defines framework for authentication services based on public-key cryptography and digital signatures does not dictate a specific algorithm but recommends RSA does not dictate a specific hash algorithm Each certificate contains the public key of a user key signed with private key of trusted certification authority Used in S/MIME, IPsec, SSL/TLS protocols 28 September 2015 MST CPE 5420 Key Management and Distribution 37
38 X.509 Certificates Generation of Public-key Certificate Egemen K. Çetinkaya 28 September 2015 MST CPE 5420 Key Management and Distribution 38
39 X.509 Certificates Certificate Creation Public-key certificates associated with each user User certificates created by Certification Authority, CA Placed in the directory by the CA or by the user Directory server itself is not responsible for creation of public keys certificate creation Directory provides certificates to users 28 September 2015 MST CPE 5420 Key Management and Distribution 39
40 X.509 Certificates Certificate Fields 1 CA<<A>> = CA {V, SN, AI, CA, UCA, A, UA, Ap, T A } Version Serial Number Algorithm ID Issuer Validity not before not after 28 September 2015 MST CPE 5420 Key Management and Distribution 40
41 Subject Subject Public Key Info public key algorithm subject public key X.509 Certificates Certificate Fields 2 Issuer Unique Identifier (optional) Subject Unique Identifier (optional) Extensions (optional)... Certificate Signature Algorithm Certificate Signature 28 September 2015 MST CPE 5420 Key Management and Distribution 41
42 X.509 Certificates Formats 28 September 2015 MST CPE 5420 Key Management and Distribution 42
43 X.509 Certificates Obtaining Certificate User certificates have the following characteristics: any user can verify the user public key that was certified with access to the public key of the CA only CA can modify certificate without this being detected Certificates are unforgeable they can be placed in a directory without protection Many CAs serving a fraction of users Chaining possible: suppose X 1 <<A>>, X 2 <<B>> CAs X 1 and X 2 exchanged their public keys; then X 1 <<X 2 >> X 1 <<X 2 >> X 2 <<B>> 28 September 2015 MST CPE 5420 Key Management and Distribution 43
44 X.509 Certificates Hierarchy Example A can obtain B s public key via the following path: X<<W>> W<<V>> V<<Y>> Y<<Z>> Z<<B>> 28 September 2015 MST CPE 5420 Key Management and Distribution 44
45 X.509 Certificates Certificate Revocation Each certificate includes a period of validity typically a new certificate is issued before old one expires Certificate revocation reasons: the user s private key is assumed to be compromised the user is no longer certified by this CA the CA s certificate is assumed to be compromised Each CA maintains a list of revoked certificates these lists should be posted on the directory 28 September 2015 MST CPE 5420 Key Management and Distribution 45
46 X.509 Certificates Certificate Revocation List Users maintain local cache of certificates and CRL 28 September 2015 MST CPE 5420 Key Management and Distribution 46
47 Certificates Practical Aspects Client browsers include a set of CA certificates Customers of a CA are server administrators e.g. financial institutions Important CAs Symantec bought Verisign Comodo SSL Go Daddy GlobalSign What are the issues in this model? [ref: Symantec.com] 28 September 2015 MST CPE 5420 Key Management and Distribution 47
48 Example scenario: Certificates Practical Aspects players: realbank, fakebank, user, CA fakebank applies CA obtains a certificate claiming to be realbank fakebank sends user asking credentials (phishing) Google fraudulent certificates for more cases Certification of CAs Certificate Authority Security Council (CASC) Common Computing Security Standards Forum (CCSF) CA/Browser Forum 28 September 2015 MST CPE 5420 Key Management and Distribution 48
49 Key Management and Distribution PKI Symmetric key distribution Public key distribution X.509 certificates PKI 28 September 2015 MST CPE 5420 Key Management and Distribution 49
50 Public-key Infrastructure Overview Public-key infrastructure (PKI): set of hardware, software, people, policies, and procedures create, manage, store, distribute, and revoke certificates based on asymmetric cryptography PKI aims to: secure, convenient, and efficient acquisition of public keys PKI based on X.509 is called PKIX by IETF; more on PKIX key five elements: end entity, CA, RA: registration authority CRL issuer, repository 28 September 2015 MST CPE 5420 Key Management and Distribution 50
51 PKIX Architecture PKI mgmt. functions: reg, ini, cer, kpr, kpu, rr, cc 28 September 2015 MST CPE 5420 Key Management and Distribution 51
52 References and Further Reading [S2014] William Stallings, Cryptography and Network Security: Principles and Practice, 6th edition, Prentice Hall, [KPS2002] Charlie Kaufman, Radia Perlman, and Mike Speciner, Network Security: Private Communication in a Public World, 2nd edition, Prentice Hall, RFC 5280, RFC 3647 NIST SP part 1: part 2: part 3: ITU-T X.509 unpublished version: 28 September 2015 MST CPE 5420 Key Management and Distribution 52
53 End of Foils 28 September 2015 MST CPE 5420 Key Management and Distribution 53
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution.
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution. 1 Opening quote. 2 The topics of cryptographic key management
Cryptography and Network Security Chapter 14
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
Cryptography and Network Security Chapter 14. Key Distribution. Key Management and Distribution. Key Distribution Task 4/19/2010
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 15.1
Chapter 15 Key Management Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 15.1 Symmetric-key Distribution Symmetric-key cryptography is more efficient than asymmetric-key
Key Management and Distribution
Key Management and Distribution Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu udio/video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Chapter 9 Key Management 9.1 Distribution of Public Keys 9.1.1 Public Announcement of Public Keys 9.1.2 Publicly Available Directory
There are actually two distinct aspects to the use of public-key encryption in this regard: The distribution of public keys. The use of public-key encryption to distribute secret keys. 9.1 Distribution
Key Management and Distribution
and Distribution CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 23 January 2011 CSS322Y10S2L12, Steve/Courses/CSS322/Lectures/key.tex,
Certificates. Noah Zani, Tim Strasser, Andrés Baumeler
Certificates Noah Zani, Tim Strasser, Andrés Baumeler Overview Motivation Introduction Public Key Infrastructure (PKI) Economic Aspects Motivation Need for secure, trusted communication Growing certificate
Authentication Application
Authentication Application KERBEROS In an open distributed environment servers to be able to restrict access to authorized users to be able to authenticate requests for service a workstation cannot be
Chapter 14. Key management and Distribution. Symmetric Key Distribution Using Symmetric Encryption
Chapter 14. Key management and Distribution Symmetric Key Distribution Using Symmetric Encryption For symmetric encryption to work, the two parties to an exchange must share the same key, and that key
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate
Chapter 4. Authentication Applications. COSC 490 Network Security Annie Lu 1
Chapter 4 Authentication Applications COSC 490 Network Security Annie Lu 1 OUTLINE Kerberos X.509 Authentication Service COSC 490 Network Security Annie Lu 2 Authentication Applications authentication
Authentication Applications
Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures will consider Kerberos a private-key authentication service
Brocade Engineering. PKI Tutorial. Jim Kleinsteiber. February 6, 2002. Page 1
PKI Tutorial Jim Kleinsteiber February 6, 2002 Page 1 Outline Public Key Cryptography Refresher Course Public / Private Key Pair Public-Key Is it really yours? Digital Certificate Certificate Authority
How To Make A Trustless Certificate Authority Secure
Network Security: Public Key Infrastructure Guevara Noubir Northeastern University noubir@ccs.neu.edu Network Security Slides adapted from Radia Perlman s slides Key Distribution - Secret Keys What if
Purpose of PKI PUBLIC KEY INFRASTRUCTURE (PKI) Terminology in PKIs. Chain of Certificates
Purpose of PKI PUBLIC KEY INFRASTRUCTURE (PKI) Purpose, Methods, Revocation, PKIX To distribute public keys securely Requires - Certificates and Certification Authorities - Method for retrieving certificates
SSL/TLS: The Ugly Truth
SSL/TLS: The Ugly Truth Examining the flaws in SSL/TLS protocols, and the use of certificate authorities. Adrian Hayter CNS Hut 3 Team adrian.hayter@cnsuk.co.uk Contents Introduction to SSL/TLS Cryptography
Authentication Applications
Authentication Applications CSCI 454/554 Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures Kerberos a symmetric-key
Part III-a. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part III-a Contents Part III-a Public-Key Infrastructure (PKI) Definition of a PKI and PKI components PKI Trust Models Digital Certificate, X.509 Certificate Management and Life Cycle Public Key Infrastructure
Savitribai Phule Pune University
Savitribai Phule Pune University Centre for Information and Network Security Course: Introduction to Cyber Security / Information Security Module : Pre-requisites in Information and Network Security Chapter
Overview of CSS SSL. SSL Cryptography Overview CHAPTER
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers
CS 392/681 - Computer Security
CS 392/681 - Computer Security Module 3 Key Exchange Algorithms Nasir Memon Polytechnic University Course Issues HW 3 assigned. Any lab or course issues? Midterm in three weeks. 8/30/04 Module 3 - Key
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features in this chapter apply to IPv4 and IPv6 unless otherwise noted. Secure
Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.
![Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.](/thumbs/29/13269044.jpg "Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.")
Lecture 13 Public Key Distribution (certification) 1 PK-based Needham-Schroeder TTP 1. A, B 4. B, A 2. {PKb, B}SKT B}SKs 5. {PK a, A} SKT SKs A 3. [N a, A] PKb 6. [N a, N b ] PKa 7. [N b ] PKb B Here,
CS 356 Lecture 28 Internet Authentication. Spring 2013
CS 356 Lecture 28 Internet Authentication Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th November 2014 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
CS549: Cryptography and Network Security
CS549: Cryptography and Network Security by Xiang-Yang Li Department of Computer Science, IIT Cryptography and Network Security 1 Notice This lecture note (Cryptography and Network Security) is prepared
Number of relevant issues
Electronic signature Lecture 8 Number of relevant issues cryptography itself algorithms for signing documents key management generating keys, distribution, key revocation security policy certificates may
How To Understand And Understand The Security Of A Key Infrastructure
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography Objectives Define digital certificates List the various types of digital certificates and how they are used
Computer and Network Security. Outline
Computer and Network Security Lecture 10 Certificates and Revocation Outline Key Distribution Certification Authorities Certificate revocation 1 Key Distribution K A, K B E KA ( K AB, E KB (KAB) ) K A
Asymmetric cryptosystems fundamental problem: authentication of public keys
Network security Part 2: protocols and systems (a) Authentication of public keys Università degli Studi di Brescia Dipartimento di Ingegneria dell Informazione 2014/2015 Asymmetric cryptosystems fundamental
Public Key Applications & Usage A Brief Insight
Public Key Applications & Usage A Brief Insight Scenario :: Identification, Authentication & Non- Repudiation :: Confidentiality :: Authenticity, requirements and e-business Integrity for electronic transaction
Authentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:
7 Key Management and PKIs
CA4005: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Key Management and PKIs 7.1 Key Management Key Management For any use of cryptography, keys must be handled correctly. Symmetric keys must be kept secret.
Security Digital Certificate Manager
System i Security Digital Certificate Manager Version 5 Release 4 System i Security Digital Certificate Manager Version 5 Release 4 Note Before using this information and the product it supports, be sure
Module 7 Security CS655! 7-1!
Module 7 Security CS655! 7-1! Issues Separation of! Security policies! Precise definition of which entities in the system can take what actions! Security mechanism! Means of enforcing that policy! Distributed
2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application
Message authentication and. digital signatures
Message authentication and " Message authentication digital signatures verify that the message is from the right sender, and not modified (incl message sequence) " Digital signatures in addition, non!repudiation
Entrust Managed Services PKI. Getting started with digital certificates and Entrust Managed Services PKI. Document issue: 1.0
Entrust Managed Services PKI Getting started with digital certificates and Entrust Managed Services PKI Document issue: 1.0 Date of issue: May 2009 Copyright 2009 Entrust. All rights reserved. Entrust
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
SFWR ENG 4C03 - Computer Networks & Computer Security
KEY MANAGEMENT SFWR ENG 4C03 - Computer Networks & Computer Security Researcher: Jayesh Patel Student No. 9909040 Revised: April 4, 2005 Introduction Key management deals with the secure generation, distribution,
Dr. Cunsheng DING HKUST, Hong Kong. Security Protocols. Security Protocols. Cunsheng Ding, HKUST COMP685C
Cunsheng Ding, HKUST Lecture 06: Public-Key Infrastructure Main Topics of this Lecture 1. Digital certificate 2. Certificate authority (CA) 3. Public key infrastructure (PKI) Page 1 Part I: Digital Certificates
Security Digital Certificate Manager
IBM i Security Digital Certificate Manager 7.1 IBM i Security Digital Certificate Manager 7.1 Note Before using this information and the product it supports, be sure to read the information in Notices,
associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.
Foundations for secure e-commerce (bmevihim219) Dr. Levente Buttyán associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.hu
National Certification Authority Framework in Sri Lanka
National Certification Authority Framework in Sri Lanka By Rohana Palliyaguru Manager Operations & Principal Information Security Engineer What is digital Signature? According to UNCITRAL Text 25. Digital
Key Management. CSC 490 Special Topics Computer and Network Security. Dr. Xiao Qin. Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.
CSC 490 Special Topics Computer and Network Security Key Management Dr. Xiao Qin Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.edu Slide 09-1 Overview Key exchange Session vs. interchange
Network Security: Public Key Infrastructure
Network Security: Public Key Infrastructure Guevara Noubir Northeastern University noubir@ccs.neu.edu CSG254: Network Security Slides adapted from Radia Perlman s slides Key Distribution - Secret Keys
Public-Key Infrastructure
Public-Key Infrastructure Technology and Concepts Abstract This paper is intended to help explain general PKI technology and concepts. For the sake of orientation, it also touches on policies and standards
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
Securing End-to-End Internet communications using DANE protocol
Securing End-to-End Internet communications using DANE protocol Today, the Internet is used by nearly.5 billion people to communicate, provide/get information. When the communication involves sensitive
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
The DoD Public Key Infrastructure And Public Key-Enabling Frequently Asked Questions
The DoD Public Key Infrastructure And Public Key-Enabling Frequently Asked Questions May 3, 2004 TABLE OF CONTENTS GENERAL PKI QUESTIONS... 1 1. What is PKI?...1 2. What functionality is provided by a
Authenticity of Public Keys
SSL/TLS EJ Jung 10/18/10 Authenticity of Public Keys Bob s key? private key Bob public key Problem: How does know that the public key she received is really Bob s public key? Distribution of Public Keys!
SBClient SSL. Ehab AbuShmais
SBClient SSL Ehab AbuShmais Agenda SSL Background U2 SSL Support SBClient SSL 2 What Is SSL SSL (Secure Sockets Layer) Provides a secured channel between two communication endpoints Addresses all three
Configuring Digital Certificates
CHAPTER 36 This chapter describes how to configure digital certificates and includes the following sections: Information About Digital Certificates, page 36-1 Licensing Requirements for Digital Certificates,
Kerberos. Public domain image of Heracles and Cerberus. From an Attic bilingual amphora, 530 520 BC. From Italy (?).
Kerberos Public domain image of Heracles and Cerberus. From an Attic bilingual amphora, 530 520 BC. From Italy (?). 1 Kerberos Kerberos is an authentication protocol and a software suite implementing this
CSC/ECE 574 Computer and Network Security. What Is PKI. Certification Authorities (CA)
Computer Science CSC/ECE 574 Computer and Network Security Topic 7.2 Public Key Infrastructure (PKI) CSC/ECE 574 Dr. Peng Ning 1 What Is PKI Informally, the infrastructure supporting the use of public
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
Content Teaching Academy at James Madison University
Content Teaching Academy at James Madison University 1 2 The Battle Field: Computers, LANs & Internetworks 3 Definitions Computer Security - generic name for the collection of tools designed to protect
Standards and Products. Computer Security. Kerberos. Kerberos
3 4 Standards and Products Computer Security Standards and Products Public Key Infrastructure (PKI) IPsec SSL/TLS Electronic Mail Security: PEM, S/MIME, and PGP March 24, 2004 2004, Bryan J. Higgs 1 2
Web Security: Encryption & Authentication
Web Security: Encryption & Authentication Arnon Rungsawang fenganr@ku.ac.th Massive Information & Knowledge Engineering Department of Computer Engineering Faculty of Engineering Kasetsart University, Bangkok,
White Paper. Enhancing Website Security with Algorithm Agility
ENHANCING WEBSITE SECURITY WITH ALGORITHM AGILITY White Paper Enhancing Website Security with Algorithm Agility Enhancing Website Security with Algorithm Agility Contents Introduction 3 Encryption Today
Public Key Infrastructure
UT DALLAS Erik Jonsson School of Engineering & Computer Science Public Key Infrastructure Murat Kantarcioglu What is PKI How to ensure the authenticity of public keys How can Alice be sure that Bob s purported
Ciphermail S/MIME Setup Guide
CIPHERMAIL EMAIL ENCRYPTION Ciphermail S/MIME Setup Guide September 23, 2014, Rev: 6882 Copyright 2008-2014, ciphermail.com. CONTENTS CONTENTS Contents 1 Introduction 3 2 S/MIME 3 2.1 PKI...................................
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Introduction to Cryptography
Introduction to Cryptography Part 3: real world applications Jean-Sébastien Coron January 2007 Public-key encryption BOB ALICE Insecure M E C C D channel M Alice s public-key Alice s private-key Authentication
CERTIFICATION PRACTICE STATEMENT UPDATE
CERTIFICATION PRACTICE STATEMENT UPDATE Reference: IZENPE-CPS UPDATE Version no: v 5.03 Date: 10th March 2015 IZENPE 2015 This document is the property of Izenpe. It may only be reproduced in its entirety.
Cryptography and network security CNET4523
1. Name of Course 2. Course Code 3. Name(s) of academic staff 4. Rationale for the inclusion of the course/module in the programme Cryptography and network security CNET4523 Major The Great use of local
How To Protect Your Data From Being Hacked On A Network (Kerberos) On A Pc Or Mac Or Ipad (Ipad) On An Ipad Or Ipa (Networking) On Your Computer Or Ipam (Network
Introduction to Network Security, Authentication Applications Information: is defined as knowledge obtained from investigation, Study or Instruction, Intelligence, news, facts, data, a Signature or Character
ITL BULLETIN FOR JULY 2012. Preparing for and Responding to Certification Authority Compromise and Fraudulent Certificate Issuance
ITL BULLETIN FOR JULY 2012 Preparing for and Responding to Certification Authority Compromise and Fraudulent Certificate Issuance Paul Turner, Venafi William Polk, Computer Security Division, Information
Grid Computing - X.509
Grid Computing - X.509 Sylva Girtelschmid October 20, 2009 Public Key Infrastructure - PKI PKI Digital Certificates IT infrastructure that provides means for private and secure data exchange By using cryptographic
encryption keys, signing keys are not archived, reducing exposure to unauthorized access to the private key.
The way the world does business is changing, and corporate security must change accordingly. For instance, e-mail now carries not only memos and notes, but also contracts and sensitive financial information.
Public Key Infrastructure for a Higher Education Environment
Public Key Infrastructure for a Higher Education Environment Eric Madden and Michael Jeffers 12/13/2001 ECE 646 Agenda Architectural Design Hierarchy Certificate Authority Key Management Applications/Hardware
Securing Service Access with Digital Certificates
Securing Service Access with Digital Certificates Jovana Palibrk, AMRES NA3 T2, Tbilisi, December 2013. Agenda Theory Cryptographic Protocols and Techniques Public Key Infrastructure TERENA Certificate
UNDERSTANDING PKI: CONCEPTS, STANDARDS, AND DEPLOYMENT CONSIDERATIONS, 2ND EDITION
UNDERSTANDING PKI: CONCEPTS, STANDARDS, AND DEPLOYMENT CONSIDERATIONS, 2ND EDITION Foreword. Preface. About the Authors. I. CONCEPTS. 1. Introduction. 2. Public-Key Cryptography. Symmetric versus Asymmetric
Lecture VII : Public Key Infrastructure (PKI)
Lecture VII : Public Key Infrastructure (PKI) Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Computer Science Department, National Chiao Tung University 2 Problems with Public
Microsoft Trusted Root Certificate: Program Requirements
Microsoft Trusted Root Certificate: Program Requirements 1. Introduction The Microsoft Root Certificate Program supports the distribution of root certificates, enabling customers to trust Windows products.
X.509 Certificate Revisited
X.509 Certificate Revisited Tohari Ahmad Informatics Department, Faculty of Information Technology - FTIF, ITS Surabaya Email: tohari@its-sby.edu Abstract A digital certificate is used for identifying
Should You Trust the Padlock? Web Security and the HTTPS Value Chain. Keeping Current 20 November 2013 Ken Calvert
Should You Trust the Padlock? Web Security and the HTTPS Value Chain Keeping Current 20 November 2013 Ken Calvert Outline 1. What are we afraid of? 2. Countermeasures: Securing the Web 3. Public-key Crypto
CHAPTER 5 ACO BASED MOBILE AGENT FOR SECURED KEY MANAGEMENT
112 CHAPTER 5 ACO BASED MOBILE AGENT FOR SECURED KEY MANAGEMENT 5.1 Related Work Security in ad hoc network becomes a critical issue for the past few decades. Attacks will be avoided by authenticating
Secure Client Applications
Secure Client Applications Networking Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 26 June 2014 Common/Reports/secure-client-apps.tex, r900 1/26 Acronyms
Final Exam. IT 4823 Information Security Administration. Rescheduling Final Exams. Kerberos. Idea. Ticket
IT 4823 Information Security Administration Public Key Encryption Revisited April 5 Notice: This session is being recorded. Lecture slides prepared by Dr Lawrie Brown for Computer Security: Principles
Certificate Management. PAN-OS Administrator s Guide. Version 7.0
Certificate Management PAN-OS Administrator s Guide Version 7.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
Web Payment Security. A discussion of methods providing secure communication on the Internet. Zhao Huang Shahid Kahn
Web Payment Security A discussion of methods providing secure communication on the Internet Group Members: Peter Heighton Zhao Huang Shahid Kahn 1. Introduction Within this report the methods taken to
NIST ITL July 2012 CA Compromise
NIST ITL July 2012 CA Compromise Prepared for: Intelligent People paul.turner@venafi.com 1 NIST ITL Bulletin on CA Compromise http://csrc.nist.gov/publications/nistbul/july-2012_itl-bulletin.pdf These
Managing SSL certificates in the ServerView Suite
Overview - English FUJITSU Software ServerView Suite Managing SSL certificates in the ServerView Suite Secure server management using SSL and PKI Edition September 2015 Comments Suggestions Corrections
A PKI case study: Implementing the Server-based Certificate Validation Protocol
54 ISBN: 978-960-474-048-2 A PKI case study: Implementing the Server-based Certificate Validation Protocol MARIUS MARIAN University of Craiova Department of Automation ROMANIA marius.marian@cs.ucv.ro EUGEN
Introduction to Network Security Security Overview
Introduction to Network Security Security Overview Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology cetinkayae@mst.edu http://web.mst.edu/~cetinkayae/teaching/cpe5420fall2015
RECOMMENDATIONS for the PROCESSING of EXTENDED VALIDATION SSL CERTIFICATES January 2, 2014 Version 2.0
Forum RECOMMENDATIONS for the PROCESSING of EXTENDED VALIDATION SSL CERTIFICATES January 2, 2014 Version 2.0 Copyright 2007-2014, The CA / Browser Forum, all rights reserved. Verbatim copying and distribution
Certificate Management in Ad Hoc Networks
Certificate Management in Ad Hoc Networks Matei Ciobanu Morogan, Sead Muftic Department of Computer Science, Royal Institute of Technology [matei, sead] @ dsv.su.se Abstract Various types of certificates
The Role of Digital Certificates in Contemporary Government Systems: the Case of UAE Identity Authority
The Role of Digital Certificates in Contemporary Government Systems: the Case of UAE Identity Authority Dr. Ali M. Al-Khouri Emirates Identity Authority, Abu Dhabi, United Arab Emirates Abstract Digital
TELSTRA RSS CA Subscriber Agreement (SA)
TELSTRA RSS CA Subscriber Agreement (SA) Last Revision Date: December 16, 2009 Version: Published By: Telstra Corporation Ltd Copyright 2009 by Telstra Corporation All rights reserved. No part of this
WIRELESS PUBLIC KEY INFRASTRUCTURE FOR MOBILE PHONES
WIRELESS PUBLIC KEY INFRASTRUCTURE FOR MOBILE PHONES Balachandra Muniyal 1 Krishna Prakash 2 Shashank Sharma 3 1 Dept. of Information and Communication Technology, Manipal Institute of Technology, Manipal
Expert Reference Series of White Papers. Fundamentals of the PKI Infrastructure
Expert Reference Series of White Papers Fundamentals of the PKI Infrastructure 1-800-COURSES www.globalknowledge.com Fundamentals of the PKI Infrastructure Boris Gigovic, Global Knowledge Instructor, CEI,
DIMACS Security & Cryptography Crash Course, Day 2 Public Key Infrastructure (PKI)
DIMACS Security & Cryptography Crash Course, Day 2 Public Key Infrastructure (PKI) Prof. Amir Herzberg Computer Science Department, Bar Ilan University http://amir.herzberg.name Amir Herzberg, 2003. Permission
Neutralus Certification Practices Statement
Neutralus Certification Practices Statement Version 2.8 April, 2013 INDEX INDEX...1 1.0 INTRODUCTION...3 1.1 Overview...3 1.2 Policy Identification...3 1.3 Community & Applicability...3 1.4 Contact Details...3
Apple Corporate Email Certificates Certificate Policy and Certification Practice Statement. Apple Inc.
Apple Inc. Certificate Policy and Certification Practice Statement Version 2.0 Effective Date: April 10, 2015 Table of Contents 1. Introduction... 4 1.1. Trademarks... 4 1.2. Table of acronyms... 4 1.3.
Kerberos-Based Authentication for OpenStack Cloud Infrastructure as a Service
Kerberos-Based Authentication for OpenStack Cloud Infrastructure as a Service Sazzad Masud and Ram Krishnan University of Texas at San Antonio Sazzad.Masud@gmail.com, Ram.Krishnan@utsa.edu Abstract Cloud