Securing . (with extra benefits) Helen George Jeremy George Nexus Resources, Inc. 1

Transcription

1 Securing (with extra benefits) Helen George Jeremy George 2009 Nexus Resources, Inc. 1

2 Access Transmission Storage Nexus Resources, Inc. 2

3 Access Transmission Storage Nexus Resources, Inc. 3

4 Roadmap 1 Software choices 2 during transmission 3 and files in storage 4 Encryption Nexus Resources, Inc. 4

5 Some choices for Microsoft Outlook 2007 (uses 3DES by default) MacOS X PGP.com VPN Nexus Resources, Inc. 5

6 VPNs are a special case VPNs are to -> as PGP/Mime is to -> Nexus Resources, Inc. 6

7 Some choices for storage Bitlocker by Microsoft Filevault by Apple Dm-crypt for Linux TrueCrypt is quasi open source PGP.com Nexus Resources, Inc. 7

8 What software to use? I use PGP.com s products because I trust them, because they solve both transmission and storage problems and because they are reasonably transparent when installed correctly. A perpetual license is $99 for a single user stand-alone version. Nexus Resources, Inc. 8

9 Transmission Nexus Resources, Inc. 9

10 Some examples Nexus Resources, Inc. 10

11 Some examples Nexus Resources, Inc. 11

12 Some examples Nexus Resources, Inc. 12

13 Some examples Nexus Resources, Inc. 13

14 The Notifier Nexus Resources, Inc. 14

15 Storage Nexus Resources, Inc. 15

16 Some examples Nexus Resources, Inc. 16

17 Some examples Nexus Resources, Inc. 17

18 Some examples Nexus Resources, Inc. 18

19 Some examples Nexus Resources, Inc. 19

20 Secure Outlook data file Nexus Resources, Inc. 20

21 Looks like this Nexus Resources, Inc. 21

22 A caution A virtual disk is a file that can be deleted. Nexus Resources, Inc. 22

23 Encryption Nexus Resources, Inc. 23

24 Yikes MEGO! Most of the complexity of encryption is hidden from you. The user s primary tasks are to choose a good passphrase, protect it carefully and actually use the encryption. Nexus Resources, Inc. 24

25 Clear Text To: Subject: test\r\n Date: Thu, 6 Aug :20: \r\n Content-Type: text/plain;\r\n charset="us-ascii"\r\n Content-Transfer-Encoding: 7bit\r\n Now is the time for all good men to come to the aid of their country. The quick brown fox jumped over the lazy dog.\r\n. Nexus Resources, Inc. 25

26 Cypher Text To: "'Jeremy George'" Subject: [PGP] test\r\n Date: Thu, 6 Aug :44: \r\n Content-Type: multipart/encrypted;\r\n protocol="application/pgp-encrypted"\r\n -----BEGIN PGP MESSAGE-----\r\n Version: PGP Desktop (Build 500)\r\n qanqr1dbwewdvukt44zvt2ybb/4kb+tr+qebwr0u57ezkdace8/jdrku05cdpvfj\r\n KY4Gu3oM/Idfiq3QODXT2rpKDAyX52SFJDChDk9Gk/LB77XIEsTUcDvcsF4S5fGu\r\n Kt3ggo9DsjB9cDJTeGXsRmty+f3Q+05fn2i7JT4659Rg07ZIoM9x/xUJ5WEEv0Lu\r\n mt7ztfkj9jimq+en3tsv8rrum/v2hiurzrkqvr7gl9fa5yjooeukugpzyxbph75i\r\n fkj9jimq+en3tsv8rrum/v2hiurzrkqvr7gl9fa5yjooeukugpzyxbph75i Nexus Resources, Inc. 26

27 Received Text * PGP Signed: 08/12/09 at 14:25:50, Decrypted Now is the time for all good men to come to the aid of their country. The quick brown fox jumped over the lazy dog. * Jeremy George <jeremy@georgeco.us> * 0x7769BCAD Nexus Resources, Inc. 27

28 Public key/private key Nexus Resources, Inc. 28

29 Public key/private key The public key is distributed widely. It is used to encrypt messages that only you can decrypt with your private key. The public key is also used to decrypt messages encrypted with your private key. Nexus Resources, Inc. 29

30 Public key/private key The private key is not distributed. It is used to decrypt messages encrypted with your public key. The private key is also used to encrypt messages that can only be decrypted with your public key. Nexus Resources, Inc. 30

31 Encrypt with a recipient s public key Clear text Nexus Resources, Inc. 31

32 Encrypt with a recipient s public key Cypher text Nexus Resources, Inc. 32

33 Decrypt with a recipient s private key Cypher text Nexus Resources, Inc. 33

34 Decrypt with a recipient s private key Clear text Nexus Resources, Inc. 34

35 Encrypt with my private key Clear text Nexus Resources, Inc. 35

36 Encrypt with my private key Cypher text Nexus Resources, Inc. 36

37 Decrypt with my public key Cypher text Nexus Resources, Inc. 37

38 Decrypt with my public key Clear text Nexus Resources, Inc. 38

39 What does a PGP key look like? -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP Desktop (Build 500) mqenbep6nfqbcac9ozachz/vompntknpdesf8u/ptd4q2s3goena4od6jid+n7r7uqnqp4jh46tj9ha4u8agnlrgrwwslyk 3Ybk4ioSzLk2/BhbfU0Fl264MajF3u8DD1h5ddioCL8F2wwdocItCfiJN9ZfXiqi4DZX03lujpE4Rv11KPqtUcZ54h6IWwe8BZGmsrUebllnt6i0qC cinb/0ceqpmx/znsbvp5gw1gleoy8/sgwadtxn1f3e+t9pxb8qi88qtbqgiu5bsiepwdzf8llqs5etlthkgal8a2smpu6uixrbfar9vcdtvh gngm49dfb2oh4cewfckvuzne/n43//x/gel0rrxabebaag0ikplcmvtesbhzw9yz2ugpgplcmvteubnzw9yz2vjby51cz6jaw0eeaec AFcFAkp6nFQwFIAAAAAAIAAHcHJlZmVycmVkLWVtYWlsLWVuY29kaW5nQHBncC5jb21wZ3BtaW1lBwsJCAcDAgoCGQEFGwMAAA ADFgIBBR4BAAAABBUICQoACgkQNxIrbHdpvK3WlQf+P2OyrQYon7OfWJ3fMF4S3kMBRRHUyQ2aEjsotbXLFN51JQJiHNfsJj7bosiHQ D7Wi0qgDrupeYXi6ZUrgOJ7JmCIJ9z5ZWLTjUD4I5nEXiAdoJnyncr+RD2xVTGuk0TuMn2M/M2/zCeKK3HV4jVMHEUY41VgyvAJNs9L e8bhamt1wnwa/xkc5mqinuoheoxp8b624d8wlispodmsbyhfb0x2sak27a+w3nzzy2dsrmyr+r1z2vl3p/qaajcy3zpdgcktm6uorld N4xyaVQmtWkxRiW+M+FATWIUSf6Fe/PvXeHDZJDsZjTUHhIaxnsUQTPm7842IoxO2GlREMm9p67kBDQRKepxUAQgAwRa99TXObV cyzsjsdpzap06rrwg8rooaghw7by1wxa1kzwfynmgyuvikrycuyp2fugkawtoyfquaq381stcca1rsobjf9fzj9qv1u3shts20tz+nl8sqi e0belrwmqa4skgfblivnlzv7tfedwak4ag9rbfw0hnwdbdhdyi87vl/bymvgpu9oubxiu8zohdrnw1kirdrihrsj35b0p2403v14ipchjdu OlKV2N8BTCLWlIJ7FfKNWHSyMkwH3EA7BDwkNtNvs/seXQC3knM5ZZ3uHxjPg/cXO3GhR1RiY2NHnjxc9JuULoKWmYWjmgOX0M N0Cw87CrOu7nx3rM5HGwARAQABiQJBBBgBAgErBQJKepxVBRsMAAAAwF0gBBkBCAAGBQJKepxUAAoJEFVCreOGVU9mM6YH/0l Oa9gu1IClAW6oMReEuVTgWh8EGiCj14ZiN5Xo4Rs0y56nCFK+u1xbsqX0Yj/Lr+mcrLeE0iLUW2H51ZE3gl5hVdJPbr3hkz/Ym633tbkTSG Gz/YVHcM0URi2BQ7ExCDMecIGREqDL1rBpVrwJIEU/fe/8LhkusU04Ke/8mFtwjowXhayZL4Yvv8dDCvQngyJ6ZZXjhrkdgusOTtPMlPa 9Aajgp1V4nXTCF4mLINqWpcfT9h92jebP0xANHXpQ9UaDLzLlb1o9JFGnLqUm26wvnnFSuqwdyps/4gNvmPV4QlPQL/Zz9Wx6LryAm3d tazaye/btzhrxf8wb8cmilq4acgkqnxirbhdpvk0wsqgamzoccl/hblrwoa3sjfzwfcjf5hgwjmwumt+mwv8tjpw7gjmxnhr75xvloq uphutpqjjhzzdrg0dbiipb9marljbycyfg0wcd/lb9qbxmunmwycodlf0y7esux5hd9yz1wbrvvbm/dv4gm5tcpuyva1m/ctqwa++v4jqw 4+PkvyfsxoiQDNAuynE507FAAtfTGpkY1kxMjFoV8FyodLL92OuI+RAFOuqFU+w215PttbK71ldAwK8EZFYO1neaPhuNCpmtK26qNT5rI S3UPxiouWI+R7G30E2/2SniuUkzu4WZ3CMXvRmuWSKXcQw24aJX6PfMqNOBPbGy4EWN6F/mjw== =u/1o -----END PGP PUBLIC KEY BLOCK----- Nexus Resources, Inc. 39

40 Where do I get keys? You use software that asks you to enter a passphrase for your private key. It then transforms that passphrase mathematically into some number of bits (today it s typically 2048 [2**11]). Your public key is in turn mathematically created from your private key and related to it. But, they are two different keys. Nexus Resources, Inc. 40

41 Why isn t encryption used everywhere? 1. It isn t free. 2. It takes effort. 3. You need to build a web of trust. 4. For many people there is no motive. You should be able to answer the question: Why bother? Nexus Resources, Inc. 41

42 Web of trust? A limitation of public key/private key encryption is the difficulty of verified key exchange. How can I be sure that the key I ve just been sent is actually your public key? There are ways. Trusted key servers. Key exchange parties. Public key/private key encryption works best in well-defined groups. Nexus Resources, Inc. 42

43 What is a good passphrase? One that is difficult to guess, but easy to remember. So, Xym4O0ll^%GWbp@$ would be difficult to guess, but a nightmare to remember. Jeremy would be easy for me to remember, but trivial to guess. Nexus Resources, Inc. 43

44 What is a good passphrase? One technique is to use the first letter of song titles. Raindrops Keep Falling on my Head, They Keep Falling becomes RKFomH,69TKF. Pretty hard to guess, but still reasonably easier to remember. Lots of other possibilites. Nexus Resources, Inc. 44

45 Another caution Kevin Mitnick s The Art of Deception describes the best way to gain access to confidential information be charming. A kind heart is the weakest security link. Nexus Resources, Inc. 45

46 TANSTAAFL Helen George Jeremy George 203 / Nexus Resources, Inc. 46