Computer and Network Security. Outline
|
|
|
- Neil Chambers
- 8 years ago
- Views:
Transcription
1 Computer and Network Security Lecture 10 Certificates and Revocation Outline Key Distribution Certification Authorities Certificate revocation 1
2 Key Distribution K A, K B E KA ( K AB, E KB (KAB) ) K A AB K B Key Distribution ib ti Center (KDC) K A E KB (K AB) K B KDC knows user secret keys What if Alice and Bob have no (mutually) trusted KDC and / or have no online KDC Public Key Infrastructure How to determine the correct public key of a given entity Binding between IDENTITY and PUBLIC KEY Possible attacks Name spoofing: Eve associates Alice s name with Eve s public key Key spoofing: Eve associates Alice s key with Eve s name Key spoofing: Eve associates Alice s key with Eve s name DoS: Eve associates Alice s name with a nonsensical (bogus) key What happens in each case? 2
3 Diffie Hellman Diffie Hellman (1976) proposed the public file concept universally accessible no unauthorized modification poor idea not scalable! Popek Kline Popek Kline (1979) proposed trusted third parties (TTPs) TTPs know public keys of the entities and distribute them on demand basis on line protocol (a disadvantage) 3
4 Kohnfelder Kohnfelder (BS Thesis, MIT, 1978) proposed certificates t as yet another public key distribution method Explicit binding between the public key and its owner/name Issued (digitally signed) by the Certificate Authority (CA) Issuance is done off line Certificates Cert A = Sign skt (Alice, pk A ) Certificate t Authority (CA) Cert A pk A Alice, pk A, Cert A User are issued certificates Offline CA does not know user secret key It only certifies (binds) identities and public keys 4
5 Certificates Procedure Alice registers at local CA Alice receives her certificate: {σ, pk A, ID A, issuance_time, expiration_time,...} σ = Sign pkt {pk A, ID A, issuance_time, expiration_time,...} Alice sends her certificate to Bob Bob verifies CA s signature on the certificate t pk T hard coded in software (browser) Bob uses pk A for encryption and/or verifying signatures with Alice Station to station protocol Authenticated PK based key exchange p, g, sk A, pk A, Cert A p, g, sk B, pk B, Cert B 1. pick v random 2. y A = g v mod p y A Cert B, σ B, y B 1. pick w random 2. y B = g w mod p 3. σ B = Sign skb (y A, y B ) 4. K AB = y Aw mod p 1. Verify pkt (Cert B ) 2. Verify pkb (σ B ) 3. σ A = Sign skb (y A, y B ) 4. K AB = y Aw mod p Cert A, σ A 1. Verify pkt (Cert A ) 2. Verify pka (σ A ) 5
6 Who issues certificates? Certification Authority e.g. GlobalSign, lsi VeriSign, Thawte, etc. look into your browser... Trustworthy (at least to its users/clients) Off line operation (usually) Has a well known long term certificate Very secure: physically and electronically How does it work? 1/2 A public/private key pair is generated by user User requests certificate via local application (e.g., web browser) Good idea to prove knowledge of private key as part of the certificate request. Why? Public key and name usually part of a PK certificate Private keys only used for small amount of data (signing, encryption of session keys) Symmetric keys (e.g., RC5, AES) used for bulk data encryption 6
7 How does it work? 2/2 CA checks that requesting user is who he claims to be (in the certificate request) CA s own certificate is signed by a higher level Root CA s certificate is self signed and his identity/name is well known Spain CA (X) Madrid CA (Y) UPM CA (W) ALICE (A) Cert Y =Sign skx (Y, pk Y, ) Cert X =Sign skx (X, pk X, ) Cert W =Sign sky (W, pk W, ) Cert A =Sign skw (A, pk A, ) Who needs (Alice s) certificate Any party wishing to Send encrypted messages to Alice Verify signature issued by Alice A verifier must Know the public key(s) of the CA(s) Trust all CA(s) involved Verify signature and validity Validity Expiration date > Signing date Revocation checking = FAIL 7
8 Certificate verification To be covered Certificate applications Secure channels in TLS / SSL for web servers Signed and/or encrypted (PGP,S/MIME) Authentication (e.g., SSH with RSA) Code signing Encrypting files (EFS in Windows/2000) IPSec: encryption/authentication at the network layer 8
9 Components of a certification system Issue certificates Store of certificates Publish certificates (LDAP, HTTP) Pre installation of root certificates in a trusted environment Support by OS platforms, applications and services Helpdesk (information, lost + compromised private keys) Advertising revoked certificates Storage guidelines for private keys Security of CA Must minimize risk of CA private key being compromised Best to have an off line CA Requests may come in electronically but not processed in real time Microsoft recommends using CA hierarchy where root CA is off line and signing CA are on line Tamper resistant hardware Distributed CA using threshold crypto 9
10 Key Lengths Strong encryption has been adopted since the relaxation of US export laws 512 bit RSA and 56 bit DES are not safe Root CA should have an (RSA) key length of 2048 bits 3 to 5 years lifetime A personal (RSA) certificate should have key length of 1536 bits Security requirements are constantly increasing! Certificate hierarchy pk self signed root CA cross certificates pk self signed root CA CA1 pk signed by root CA2 pk signed by root and CA5 CA5 pk signed by root CA6 pk signed by root CA3 pk signed by CA1 CA4 pk signed by CA2 CA7 pk signed by CA5 CA8 pk signed by CA6 10
11 Revocation Certificate have expiration date What if Bob s CA goes berserk? Bob forgets his private key? Someone steals Bob s private key? Bob looses his private key? Bob willingly discloses his private key? Eve can decrypt/sign while Bob s certificate is still valid... Bob reports key loss to CA (or CA finds out somehow) CA issues a Certificate Revocation List (CRL) Distributed ib in public announcements Published in public databases When verifying Bob s signature or encrypting a message for Bob, Alice first checks if Bob s certificate is still valid! Generally, certificate = capability Certificate revocation needs to occur when certificate t holder key compromise/loss CA key compromise early end of contract Certificate Revocation Lists (CRLs) hold the list of certificates that are not yet naturally expired dbut revoked kd Reissued periodically (even if no activity!) More on revocation later 11
12 Requirement for revocation Timeliness Must check most recent revocation status Efficiency Computation Bandwidth and storage Availability Security Types of Revocation Implicit Each certificate is periodically re issued Alice has a fresh certificate Alice not revoked No need to distribute/publish revocation info Explicit Only revoked certificatesare are periodically announced Alice s certificate not listed among the revoked onse Alice not revoked Need to distribute/publish revocation info 12
13 Revocation Methods CRL Certificate Revocation List CRL DP, indirect CRL, dynamic CRL DP, delta CRL, windowed CRL, etc. CRT and other Authenticated Data Structures OCSP On line Certificate Status Protocol CRS Certificate Revocation System CRL Off line mechanism CRL = list of revoked certificates (e.g., SNs) signed by a revocation authority (RA) RA not always CA that issued the revoked certificates Periodically issued: daily, weekly, monthly, etc. Pros Simple Don t need secure channels for CRL distribution Cons Timeliness: window of vulnerability CRLs can be huge 13
14 Revocation facts Jan 29 and 30, 2001, VeriSign, Inc. issued two certificates for Authenticode Signing to an individual fraudulently claiming to be an employee ofmicrosoftcorporation Corporation. Any code signed by these certificates appears to be legitimately signed by Microsoft. Users who try to run code signed with these certificates will generally be presented with a warning dialog, but who wouldn't trust a valid certificate issued by VeriSign, and claimed to be for Microsoft? Certificates were very soon placed in a CRL, but: code that checks signatures for ActiveX controls, Office Macros, and so on, didn't do any CRL processing According to Microsoft since the certificates don't include a CRL Distribution Point (DP), it's impossible to find and use the CRL! OCSP On line Certificate Status Protocol (RFC 2560) June 1999 In place of or, as a supplement to, checking CRLs Obtain instantaneous status of a certificate OCSP may be used in sensitive, volatile settings, e.g., stock trades, electronic funds transfer, military 14
15 OCSP Players certificate request Cert B transaction request + Cert B transaction response is Cert B revoked? OCPS responder OCPS response (Yes / No) The CA Who signs OCPS responses? Has to be online Trusted OCPS responder Authorized by the CA Has a special certificate that says Responder can sign OCPS responses for Certificates issued by CA 15
16 Security Considerations On line method DoS vulnerability flood of queries + generating signatures! unsigned responses = false responses pre computing responses offers some protection against DoS, but pre computing responses allows replay attacks (since no nonce included) but OCSP signing key can be kept off line Certificate Revocation System (CRS) proposed by Micali (1996) aimes to improve CRL communication costs / size basic idea: signing a message for every certificate stating its status use of off line/on line signature scheme to reduce update cost 16
17 CRS: Creation of a certificate Two new parameters in Cert: Y MAX and N Y MAX =H MAX (Y 0 ) N=H(N 0 ) Y 0, N 0 unique per certificate securely stored at the CA H() public one way function CRS: creation of a certificate Two new parameters in PKC: Y MAX and N Y MAX =H MAX (Y 0 ) N=H(N 0 ) [ Y 0, N 0 ] per PKC secrets stored by CA H() public one way function 34 17
18 How CRS works daily update for Cert B U B 1. MAX = at the issuance date, i=0 U B request for Cert B if Cert B is valid U B = Y 365 i = H 365 i (Y 0 ) else U B = N 0 Cert B = Y MAX, N, issuing date, if H(U B )=N Cert B is not valid elseif H i (U B )=Y MAX Cert B is valid Example, MAX = 3 Cert B = Y 3, N Pre computed signatures: Y 1 = H(Y 0 ) Y 2 = H(Y 1 ) = H(H(Y 0 )) Y 3 = H(Y 2 ) = H(H(Y 1 )) = H(H(H(Y 0 ))) Day 1 U B = Y 1 Alice (max i= 2) Is H(U B ) = N? Is H 2 (U B ) = Y 3? Day 2 U B = Y 2 Alice (max i= 1) Is H(U B ) = N? Is H(U B ) = Y 3? Secret = Y 0, N 0 Since H one way Pre computed signatures: Y 1 = H(Y 0 ) Y 2 = H(Y 1 ) = H(H(Y 0 )) Y 3 = H(Y 2 ) = H(H(Y 1 )) = H(H(H(Y 0 ))) Revocation token: N = H(N 0 ) Nobody can guess N 0 Nobody can guess Y j from Y 1,,Y j 1 18
19 Security consideration All signatures pre computed Directory is not trusted CA must upload updates (every day) 19
Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.
![Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.](/thumbs/29/13269044.jpg "Lecture 13. Public Key Distribution (certification) PK-based Needham-Schroeder TTP. 3. [N a, A] PKb 6. [N a, N b ] PKa. 7.")
Lecture 13 Public Key Distribution (certification) 1 PK-based Needham-Schroeder TTP 1. A, B 4. B, A 2. {PKb, B}SKT B}SKs 5. {PK a, A} SKT SKs A 3. [N a, A] PKb 6. [N a, N b ] PKa 7. [N b ] PKb B Here,
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
How To Make A Trustless Certificate Authority Secure
Network Security: Public Key Infrastructure Guevara Noubir Northeastern University noubir@ccs.neu.edu Network Security Slides adapted from Radia Perlman s slides Key Distribution - Secret Keys What if
Introduction to Cryptography
Introduction to Cryptography Part 3: real world applications Jean-Sébastien Coron January 2007 Public-key encryption BOB ALICE Insecure M E C C D channel M Alice s public-key Alice s private-key Authentication
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
Brocade Engineering. PKI Tutorial. Jim Kleinsteiber. February 6, 2002. Page 1
PKI Tutorial Jim Kleinsteiber February 6, 2002 Page 1 Outline Public Key Cryptography Refresher Course Public / Private Key Pair Public-Key Is it really yours? Digital Certificate Certificate Authority
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate
Introduction to Network Security Key Management and Distribution
Introduction to Network Security Key Management and Distribution Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology cetinkayae@mst.edu http://web.mst.edu/~cetinkayae/teaching/cpe5420fall2015
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
7 Key Management and PKIs
CA4005: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Key Management and PKIs 7.1 Key Management Key Management For any use of cryptography, keys must be handled correctly. Symmetric keys must be kept secret.
Chapter 4. Authentication Applications. COSC 490 Network Security Annie Lu 1
Chapter 4 Authentication Applications COSC 490 Network Security Annie Lu 1 OUTLINE Kerberos X.509 Authentication Service COSC 490 Network Security Annie Lu 2 Authentication Applications authentication
Authentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:
Module 7 Security CS655! 7-1!
Module 7 Security CS655! 7-1! Issues Separation of! Security policies! Precise definition of which entities in the system can take what actions! Security mechanism! Means of enforcing that policy! Distributed
Authenticity of Public Keys
SSL/TLS EJ Jung 10/18/10 Authenticity of Public Keys Bob s key? private key Bob public key Problem: How does know that the public key she received is really Bob s public key? Distribution of Public Keys!
Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 15.1
Chapter 15 Key Management Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 15.1 Symmetric-key Distribution Symmetric-key cryptography is more efficient than asymmetric-key
Cryptography and Network Security Chapter 14. Key Distribution. Key Management and Distribution. Key Distribution Task 4/19/2010
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
SSL Protect your users, start with yourself
SSL Protect your users, start with yourself Kulsysmn 14 december 2006 Philip Brusten Overview Introduction Cryptographic algorithms Secure Socket Layer Certificate signing service
2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application
CS 392/681 - Computer Security
CS 392/681 - Computer Security Module 3 Key Exchange Algorithms Nasir Memon Polytechnic University Course Issues HW 3 assigned. Any lab or course issues? Midterm in three weeks. 8/30/04 Module 3 - Key
Authentication Applications
Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures will consider Kerberos a private-key authentication service
Websense Content Gateway HTTPS Configuration
Websense Content Gateway HTTPS Configuration web security data security email security Support Webinars 2010 Websense, Inc. All rights reserved. Webinar Presenter Title: Sr. Tech Support Specialist Cisco
Key Management and Distribution
Key Management and Distribution Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu udio/video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Cryptography and Network Security Chapter 14
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
CSE543 - Introduction to Computer and Network Security. Module: Public Key Infrastructure
CSE543 - Introduction to Computer and Network Security Module: Public Key Infrastructure Professor Trent Jaeger 1 Meeting Someone New Anywhere in the Internet 2 What is a certificate? A certificate makes
Authentication Applications
Authentication Applications CSCI 454/554 Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures Kerberos a symmetric-key
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution.
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution. 1 Opening quote. 2 The topics of cryptographic key management
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features in this chapter apply to IPv4 and IPv6 unless otherwise noted. Secure
Public Key Infrastructure
UT DALLAS Erik Jonsson School of Engineering & Computer Science Public Key Infrastructure Murat Kantarcioglu What is PKI How to ensure the authenticity of public keys How can Alice be sure that Bob s purported
Lecture VII : Public Key Infrastructure (PKI)
Lecture VII : Public Key Infrastructure (PKI) Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Computer Science Department, National Chiao Tung University 2 Problems with Public
Part III-a. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part III-a Contents Part III-a Public-Key Infrastructure (PKI) Definition of a PKI and PKI components PKI Trust Models Digital Certificate, X.509 Certificate Management and Life Cycle Public Key Infrastructure
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th November 2014 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
SSL/TLS: The Ugly Truth
SSL/TLS: The Ugly Truth Examining the flaws in SSL/TLS protocols, and the use of certificate authorities. Adrian Hayter CNS Hut 3 Team adrian.hayter@cnsuk.co.uk Contents Introduction to SSL/TLS Cryptography
Asymmetric cryptosystems fundamental problem: authentication of public keys
Network security Part 2: protocols and systems (a) Authentication of public keys Università degli Studi di Brescia Dipartimento di Ingegneria dell Informazione 2014/2015 Asymmetric cryptosystems fundamental
Authentication. Computer Security. Authentication of People. High Quality Key. process of reliably verifying identity verification techniques
Computer Security process of reliably verifying identity verification techniques what you know (eg., passwords, crypto key) what you have (eg., keycards, embedded crypto) what you are (eg., biometric information)
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 9: Authentication protocols, digital signatures Ion Petre Department of IT, Åbo Akademi University 1 Overview of
1.264 Lecture 29. Secure Sockets Layer (SSL) Security summary. Next class: Exercise due after class
1.264 Lecture 29 Secure Sockets Layer (SSL) Security summary Next class: Exercise due after class 1 Case study Write protocol that Andrews and BBI use B->A: A->B: B->A: A->B: List 3 attacks that C can
Web Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010. Fedict 2010. All rights reserved
Web Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010 Fedict 2010. All rights reserved What is Entity Authentication? Entity authentication is the process whereby one party
Security Digital Certificate Manager
IBM i Security Digital Certificate Manager 7.1 IBM i Security Digital Certificate Manager 7.1 Note Before using this information and the product it supports, be sure to read the information in Notices,
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
Certificates. Noah Zani, Tim Strasser, Andrés Baumeler
Certificates Noah Zani, Tim Strasser, Andrés Baumeler Overview Motivation Introduction Public Key Infrastructure (PKI) Economic Aspects Motivation Need for secure, trusted communication Growing certificate
Security Digital Certificate Manager
System i Security Digital Certificate Manager Version 5 Release 4 System i Security Digital Certificate Manager Version 5 Release 4 Note Before using this information and the product it supports, be sure
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.
Foundations for secure e-commerce (bmevihim219) Dr. Levente Buttyán associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.hu
Overview of CSS SSL. SSL Cryptography Overview CHAPTER
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers
What is an SSL Certificate?
Security is of the utmost importance when doing business on the Web. Your customers want to know that their information is protected when crossing data lines. A Thawte SSL Web Server Certificate or SuperCert
Web Security. Mahalingam Ramkumar
Web Security Mahalingam Ramkumar Issues Phishing Spreading misinformation Cookies! Authentication Domain name DNS Security Transport layer security Dynamic HTML Java applets, ActiveX, JavaScript Exploiting
Elements of Applied Cryptography. Key Distribution. Trusted third party: KDC, KTC Diffie-Helmann protocol The man-in-the-middle attack
Elements of Applied Cryptography Key Distribution Trusted third party: KDC, KTC Diffie-Helmann protocol The man-in-the-middle attack Point-to-point key establishment Alice Bob Each pair of users must share
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
PKI: Public Key Infrastructure
PKI: Public Key Infrastructure What is it, and why should I care? Conference on Higher Education Computing in Kansas June 3, 2004 Wes Hubert Information Services The University of Kansas Why? PKI adoption
ITL BULLETIN FOR JULY 2012. Preparing for and Responding to Certification Authority Compromise and Fraudulent Certificate Issuance
ITL BULLETIN FOR JULY 2012 Preparing for and Responding to Certification Authority Compromise and Fraudulent Certificate Issuance Paul Turner, Venafi William Polk, Computer Security Division, Information
SEZ SEZ Online Manual Digital Signature Certficate [DSC] V Version 1.2
![SEZ SEZ Online Manual Digital Signature Certficate [DSC] V Version 1.2](/thumbs/32/15683057.jpg "SEZ SEZ Online Manual Digital Signature Certficate [DSC] V Version 1.2")
SEZ SEZ Online Manual Digital Signature Certficate [DSC] V Version 1.2 Table of Contents 1 Introduction...2 2 Procurement of DSC...3 3 Installation of DSC...4 4 Procedure for entering the DSC details of
Network Security: Public Key Infrastructure
Network Security: Public Key Infrastructure Guevara Noubir Northeastern University noubir@ccs.neu.edu CSG254: Network Security Slides adapted from Radia Perlman s slides Key Distribution - Secret Keys
Authentication Application
Authentication Application KERBEROS In an open distributed environment servers to be able to restrict access to authorized users to be able to authenticate requests for service a workstation cannot be
Microsoft vs. Red Hat. A Comparison of PKI Vendors
Microsoft vs. A Comparison of PKI Vendors 1 Outline Definitions Issue #1: RedHat vs. Microsoft CA Issue #2: Cross Flows Issue #3: Core PKI Recommendation 2 Definitions User or Enrollment Officer - The
Securing your Online Data Transfer with SSL
Securing your Online Data Transfer with SSL A GUIDE TO UNDERSTANDING SSL CERTIFICATES, how they operate and their application 1. Overview 2. What is SSL? 3. How to tell if a Website is Secure 4. What does
Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
Q: Why security protocols?
Security Protocols Q: Why security protocols? Alice Bob A: To allow reliable communication over an untrusted channel (eg. Internet) 2 Security Protocols are out there Confidentiality Authentication Example:
Dr. Cunsheng DING HKUST, Hong Kong. Security Protocols. Security Protocols. Cunsheng Ding, HKUST COMP685C
Cunsheng Ding, HKUST Lecture 06: Public-Key Infrastructure Main Topics of this Lecture 1. Digital certificate 2. Certificate authority (CA) 3. Public key infrastructure (PKI) Page 1 Part I: Digital Certificates
Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1
Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 Public Key Cryptography symmetric key crypto v requires sender, receiver know shared secret
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
Secure Socket Layer (SSL) and Transport Layer Security (TLS)
Secure Socket Layer (SSL) and Transport Layer Security (TLS) Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available
Key Management (Distribution and Certification) (1)
Key Management (Distribution and Certification) (1) Remaining problem of the public key approach: How to ensure that the public key received is really the one of the sender? Illustration of the problem
Securing your Online Data Transfer with SSL A GUIDE TO UNDERSTANDING SSL CERTIFICATES, how they operate and their application INDEX 1. Overview 2. What is SSL? 3. How to tell if a Website is Secure 4.
Configuring Digital Certificates
CHAPTER 36 This chapter describes how to configure digital certificates and includes the following sections: Information About Digital Certificates, page 36-1 Licensing Requirements for Digital Certificates,
HKUST CA. Certification Practice Statement
HKUST CA Certification Practice Statement IN SUPPORT OF HKUST CA CERTIFICATION SERVICES Version : 2.1 Date : 12 November 2003 Prepared by : Information Technology Services Center Hong Kong University of
Number of relevant issues
Electronic signature Lecture 8 Number of relevant issues cryptography itself algorithms for signing documents key management generating keys, distribution, key revocation security policy certificates may
How To Understand And Understand The Security Of A Key Infrastructure
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography Objectives Define digital certificates List the various types of digital certificates and how they are used
CSC/ECE 574 Computer and Network Security. What Is PKI. Certification Authorities (CA)
Computer Science CSC/ECE 574 Computer and Network Security Topic 7.2 Public Key Infrastructure (PKI) CSC/ECE 574 Dr. Peng Ning 1 What Is PKI Informally, the infrastructure supporting the use of public
Lecture 10 - Authentication
Lecture 10 - Authentication CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Kerberos: What to know 1) Alice T rent : {Alice + Bob
Lecture 10 - Authentication
CSE497b Introduction to Computer and Network Security - Spring 2007 - Professor Jaeger Lecture 10 - Authentication CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/
What is network security?
Network security Network Security Srinidhi Varadarajan Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application
User Guide Supplement. S/MIME Support Package for BlackBerry Smartphones BlackBerry Pearl 8100 Series
User Guide Supplement S/MIME Support Package for BlackBerry Smartphones BlackBerry Pearl 8100 Series SWD-292878-0324093908-001 Contents Certificates...3 Certificate basics...3 Certificate status...5 Certificate
DIMACS Security & Cryptography Crash Course, Day 2 Public Key Infrastructure (PKI)
DIMACS Security & Cryptography Crash Course, Day 2 Public Key Infrastructure (PKI) Prof. Amir Herzberg Computer Science Department, Bar Ilan University http://amir.herzberg.name Amir Herzberg, 2003. Permission
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Public Key Cryptogrophy 1 Roadmap Introduction RSA Diffie-Hellman Key Exchange Public key and
DNS security: poisoning, attacks and mitigation
DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain
Network Security #10. Overview. Encryption Authentication Message integrity Key distribution & Certificates Secure Socket Layer (SSL) IPsec
Network Security #10 Parts modified from Computer Networking: A Top Down Approach Featuring the Internet, 2nd edition. Jim Kurose, Keith Ross, Addison-Wesley, 2002. 1 Overview Encryption Authentication
Djigzo S/MIME setup guide
Author: Martijn Brinkers Table of Contents...1 Introduction...3 Quick setup...4 Create a CA...4 Fill in the form:...5 Add certificates for internal users...5 Add certificates for external recipients...7
Certify your Software Integrity with thawte Code Signing Certificates
Certify your Software Integrity with thawte Code Signing Certificates Sign your code and active content for secure online distribution... 1. Overview 2. Why a thawte Code Signing Certificate? 3. Who needs
NIST ITL July 2012 CA Compromise
NIST ITL July 2012 CA Compromise Prepared for: Intelligent People paul.turner@venafi.com 1 NIST ITL Bulletin on CA Compromise http://csrc.nist.gov/publications/nistbul/july-2012_itl-bulletin.pdf These
Take-home points. Distributed Systems Security II. Remember digital signatures. Today: Auth protocols 15-440
Distributed Systems Security II 5-440 Take-home points What does using public-key for our authentication buy us? Compare kerberos (needham-schroeder) and SSL with a certificate authority Metrics: Scaling,
The DoD Public Key Infrastructure And Public Key-Enabling Frequently Asked Questions
The DoD Public Key Infrastructure And Public Key-Enabling Frequently Asked Questions May 3, 2004 TABLE OF CONTENTS GENERAL PKI QUESTIONS... 1 1. What is PKI?...1 2. What functionality is provided by a
Certificates and network security
Certificates and network security Tuomas Aura CSE-C3400 Information security Aalto University, autumn 2014 Outline X.509 certificates and PKI Network security basics: threats and goals Secure socket layer
Chapter 7: Network security
Chapter 7: Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application layer: secure e-mail transport
Evaluation of Certificate Revocation in Microsoft Information Rights Management v1.0
Evaluation of Certificate Revocation in Microsoft Information Rights Management v1.0 Hong Zhou hzho021@ec.auckland.ac.nz for CompSci725SC, University of Auckland. 20 October 2006 Abstract Certificate revocation
Mobile OTPK Technology for Online Digital Signatures. Dec 15, 2015
Mobile OTPK Technology for Online Digital Signatures Dec 15, 2015 Presentation Agenda The presentation will cover Background Traditional PKI What are the issued faced? Alternative technology Introduction
Internet Programming. Security
Internet Programming Security Introduction Security Issues in Internet Applications A distributed application can run inside a LAN Only a few users have access to the application Network infrastructures
SECURITY IN NETWORKS
SECURITY IN NETWORKS GOALS Understand principles of network security: Cryptography and its many uses beyond confidentiality Authentication Message integrity Security in practice: Security in application,
CS 6262 - Network Security: Public Key Infrastructure
CS 6262 - Network Security: Public Key Infrastructure Professor Patrick Traynor Fall 2011 Meeting Someone New 2 What is a certificate? A certificate makes an association between a user identity/job/ attribute
CS549: Cryptography and Network Security
CS549: Cryptography and Network Security by Xiang-Yang Li Department of Computer Science, IIT Cryptography and Network Security 1 Notice This lecture note (Cryptography and Network Security) is prepared
Key Management. CSC 490 Special Topics Computer and Network Security. Dr. Xiao Qin. Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.
CSC 490 Special Topics Computer and Network Security Key Management Dr. Xiao Qin Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.edu Slide 09-1 Overview Key exchange Session vs. interchange
Securing Your Software for the Mobile Application Market
WHITE PAPER: SECURING YOUR SOFTWARE FOR THE MOBILE APPLICATION MARKET White Paper Securing Your Software for the Mobile Application Market The Latest Code Signing Technology Securing Your Software for
DEPARTMENT OF DEFENSE ONLINE CERTIFICATE STATUS PROTOCOL RESPONDER INTEROPERABILITY MASTER TEST PLAN VERSION 1.0
DEFENSE INFORMATION SYSTEMS AGENCY JOINT INTEROPERABILITY TEST COMMAND FORT HUACHUCA, ARIZONA DEPARTMENT OF DEFENSE ONLINE CERTIFICATE STATUS PROTOCOL RESPONDER INTEROPERABILITY MASTER TEST PLAN VERSION
Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide
![Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide](/thumbs/24/4351346.jpg "Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide")
Network Security [2] Public Key Encryption Also used in message authentication & key distribution Based on mathematical algorithms, not only on operations over bit patterns (as conventional) => much overhead
Extended SSL Certificates
Introduction Widespread usage of internet has led to the growth of awareness amongst users, who now associate green address bar with security. Though people are able to recognize the green bar, there is
Chapter 7 Managing Users, Authentication, and Certificates
Chapter 7 Managing Users, Authentication, and Certificates This chapter contains the following sections: Adding Authentication Domains, Groups, and Users Managing Certificates Adding Authentication Domains,
Internet Key Exchange (IKE) EJ Jung
Internet Key Exchange (IKE) EJ Jung Secure Key Establishment Goal: generate and agree on a session key using some public initial information What properties are needed? Authentication (know identity of
SBClient SSL. Ehab AbuShmais
SBClient SSL Ehab AbuShmais Agenda SSL Background U2 SSL Support SBClient SSL 2 What Is SSL SSL (Secure Sockets Layer) Provides a secured channel between two communication endpoints Addresses all three
BUSINESS GUIDE SECURING YOUR SOFTWARE FOR THE MOBILE APPLICATION MARKET THE LATEST CODE SIGNING TECHNOLOGY
SECURING YOUR SOFTWARE FOR THE MOBILE APPLICATION MARKET THE LATEST CODE SIGNING TECHNOLOGY Now from CONTENTS 1 THE CHALLENGE 1 A BRIEF REVIEW OF CODE SIGNING 2 THE SOLUTION 2 HOW THE CODE SIGNING PORTAL