Public Key Infrastructure PKI. Michael Maass and Blase Ur
|
|
|
- Vernon Thornton
- 8 years ago
- Views:
Transcription
1 Public Key Infrastructure PKI Michael Maass and Blase Ur 1
2 Outline Intro to cryptography Intro to PKI / Davis reading Current issues Gaw reading PKI in the enterprise Discussion 2
3 Introduction to Encryption We want to send a secret message Plaintext Ciphertext A key is the secret BlaseMichael leahcimesalb BlaseMichael CmbtfNjdibfm 3
4 Types of Keys... Instructions on how to modify the plaintext How many letters to shift (Caesar cipher) A->C, B->Z, C->J, D->H (Substitution cipher) Random bit (1 or 0) for every bit of the original (One Time Pad) 4
5 Other symmetric systems Stream ciphers Block ciphers e.g. DES / AES, Twofish 5
6 Disadvantages of Symmetric Enc. The key is shared secret Codebooks 6
7 Asymmetric Encryption Public Key Encryption Whitfield Diffie and Martin Hellman (Discrete logarithm is hard) Ellis, Cocks, Williamson
8 RSA Rivest, Shamir, Adelman Public Key- known to everyone Private Key- known only to the person who can decrypt the message 8
9 Sending Rich my CC# Amazon's public key is widely known. E(Message, Rich's Public Key) Encrypted message D(Encrypted message, Rich's Private Key) Message 9
10 Rich's Signature Message- I said this F(Message, Rich's Private Key) Signature V(Message, Signature, Rich's Public Key) I believe them 10
11 How do we Know Rich's Key How do we know Rich's public key? Ask him? Man In The Middle 11
12 Introduction to PKIs What is a PKI? What do PKIs get right? What do PKIs get wrong?
13 What is a PKI? PKI = Public Key Infrastructure PKIs bind an identity to a public key PKIs come in many forms: Certificate Authority Based Most familiar Web of Trust Based PGP's model More we won't talk about... PKIs enable encryption and sender authentication for , authentication of servers to browsers, authentication of users to applications, etc. Security and Usability, Chapter 16 Making the Impossible Easy: Usable PKI (D. Balfanz, G. Durfee, and D.K. Smetters)
14 Certificate Authority Model A Certificate Authority (CA) sits at the top of a trust hierarchy CAs issue digital certificates that contain identity information about the subject, expiration and revocation information, and the subject's public key CAs sign digital certificates they issue. If you trust a CA, you trust any certificate they sign that hasn't expired or been revoked CAs can be internal to a business, government, or organization or they can be they can be large forprofit multi-national corporations
15 What do PKIs get right? PKIs require less trust than approaches based on symmetric keys PKIs have low availability demands PKIs are highly reliable PKIs are high performance
16 What do PKIs get wrong? PKIs are complicated and loosely defined enough that users don't understand them Users don't understand public key cryptography and therefore the need for PKIs Users don't understand what certificates are for Users don't understand what role PKIs play in what they want to accomplish PKIs establish a root of trust that, when compromised, erase the security of any system in which the PKI is required to link identities to public keys PKIs suffer from a number of compliance defects
17 Compliance Defects in PKIs It is difficult to authenticate subjects that cannot be issued certificates face-to-face. This reduces trust in the attestation provided by a CA that allows remote registration Authenticating the public key for a root CA is onerous. Not authenticating the key can allow an attacker to replace it, causing an application to accept forged certificates There are scaling issues in distributing certificate revocation lists quickly and securely The users private key must typically be cached in memory to ensure usability, which opens the key up to attack Quality properties for passwords and other controls defending a user's private keys cannot be enforced D. Davis. Compliance Defects in Public-Key Cryptography. USENIX Security 1996.
18 Secrecy, Flagging, and Paranoia: Adoption Criteria in Encrypted Shirley Gaw, Edward W. Felten, Patricia Fernandez-Kelly CHI 2006 Interviews with 9 employees of ActivistCorp Practices for encrypting 18
19 Secrecy, Flagging, and Paranoia... Social stigma, not just usability, limits adoption Used for financial and direct action planning Woodward- didn't trust plugins. Manually encrypted Abe- financial data 19
20 Secrecy, Flagging, and Paranoia... You felt a bit like a secret agent Fear of attackers was less important than ease of use. It if was easier to encrypt everything. [Abe] would (Referencing PGP rep) It was too over-the-top and definitely too complicated. It was like a movie 20
21 Secrecy, Flagging, and Paranoia... Jenny emphasizes `normal people.' Normal people wouldn't encrypt normal messages. I work with somebody... and he sends everysingle-message of his is encrypted Equating encryption with confidentiality might disappear if encryption was invisible to the user 21
22 Current Issues DigiNotar, Comodo Stuxnet, Duqu Windows 8 SecurID 22
23 Comodo- March 2011 Comodo- a certificate authority The login.live.com domain used for logging in to Windows Live accounts was one of the domains compromised by the rogue Comodo certificates. Google, Skype, Yahoo Targeted by Rogue Comodo SSL Certificates. by_rogue_comodo_ssl_certificates.html 23
24 DigiNotar- August 2011 DigiNotar- Dutch CA 531 certificates compromised Covertly revoked certificates Trust in all certificates issued by DigiNotar was revoked by most major browser and operating system manufacturers 24
25 Browsers' CAs 25
26 Sadly, the state of digital certificates is such a mess that it probably matters little either way. Legitimate companies with legitimate sites often have improper or expired certificates. Users are already jaded and conditioned to simply accept erroneous certificates and bypass browser and operating system warning messages. r_certificates_hack.html 26
27 Stuxnet June 2010 Malware that attacks Siemens PLC Suspected target: Iranian Nuclear Program Rumored creator: USA/Israel The malware is digitally signed with legitimate certificates stolen from two certificate authorities. 27
28 28
29 29
30 Duqu Keylogger McAfee Labs advises Certificate Authorities to carefully verify if their systems might have been affected by this threat or any variations. After analyzing the captured code, researchers believe that Duqu is specifically designed to target certificate authorities. 30
31 Duqu The trojan-spy is able to record keystrokes and collect various details of system information. The collected information is saved to an encrypted file, which the attackers can retrieve via the CC server. Duqu has a driver signed with a stolen certificate belonging to a Taiwanese company called C-Media Electronics Incorporation. The driver still claims to be from JMicron, though. 31
32 Windows 8 Windows 8- PKI-based Secure Boot Is this a good idea? 32
33 SecurID Breach March While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack. 33
34 SecurID Breach June The company s admission of the RSA tokens vulnerability on Monday was a shock to many customers because it came so long after a hacking attack on RSA in March and one on Lockheed Martin last month. The concern of customers and consultants over the way RSA, a unit of the tech giant EMC, communicated also raises the possibility that many customers will seek alternative solutions to safeguard remote access to their computer networks. 34
35 SecurID Breach Rumor: cryptographic seeds compromised Rumor: Lockheed Martin break-in RSA claim: nation state 35
36 PKIs in the Enterprise How do enterprises use PKIs? What usability issues do enterprises suffer from? How do enterprises address PKI usability issues?
37 How do enterprises use PKIs? Workstation Logon Via Smart Cards Encryption/Signing Via Soft Certs Assigning Identities to Applications Via Soft Certs Identifying Websites Via HTTPS Establishing Secure Channels Via HTTPS/SSL/FTPS Code Signing Via Hardware Managed or Soft Certs
38 How do enterprises use PKIs? There are many ways to structure CAs, but the following make particular sense for an enterprise: Maintain a root CA for internal use, but utilize intermediate CAs to actually issue certificates Maintain a root CA for major product silos (e.g., employee badges, secure messaging, etc.), and utilize intermediate CAs to issue certificates when appropriate
39 Usability Issues for Users Users don't understand issuance process Badges can't be used until users have visited a website with their smart card in their reader to initialize the badge Enrolling in and configuring encrypted for Outlook can take 5+ steps, each more confusing than the last Users don't understand CA scoping issues You can't necessarily send an encrypted outside of the company and have it work Browsers installed from the wild won't necessarily be configured by default to trust the internal CA
40 Usability Issues for Devs/SAs Developers and System Administrators may manage so many certificates they can't manually keep track of them all When certificates expire, systems and applications become inaccessible Acquiring new soft certificates can be a trying process (6+ steps with 4+ required switches per step, each more confusing than the last) Root certificates expire and have to be replaced everywhere they are located Error messages for programming libraries that make use of certificates and cryptography tend to be beyond terrible (I am being nice...) Cryptographic APIs are very complicated
41 Usability Issues for Devs/SAs Using an assumed nominal rate of $170, this error message cost one of my former employers ~$31,000: SUN.SECURITY.VALIDATOR.VALIDATOREXCEPTIO N: PKIX PATH BUILDING FAILED: SUN.SECURITY.PROVIDER.CERTPATH.SUNCER TPATHBUILDEREXCEPTION: UNABLE TO FIND VALID CERTIFICATE PATH TO REQUESTED TARGET
42 Usability Issues for Devs/SAs Java's cryptography libraries are some of the easiest to use in the industry The Java Cryptographic Architecture takes 66 printed pages to specify Java's JavaDocs for Cryptographic Classes generally assume a strong vocabulary in: Block Cipher Internals Cipher Modes Public Key Encryption Internals Certificate Specifications Key Specifications On and on and on... Encrypting a byte buffer with AES requires 9 lines of code, using 7 classes documented over 44 printed pages of JavaDoc
43 Dealing with Usability Issues Automation: Make enrollment processes as point and click as possible Provide online tools to issue certificates for applications, secure channels, etc. Utilize these tools to automatically warn certificate managers when their certificates are about to expire Utilize these tools to convert certificates or encode keys to whatever format is needed in a particular context Provide a central authority for acquiring new root certificates out of band (perhaps the same tool as above) Utilize configuration management to push out certificate updates Provide error messages humans can comprehend
44 Discussion 44
45 Convergence Black Hat 8/2010 Marlinspike's Convergence is radically different from the situation today where the web of trust is based on a SSL server certificate signed by a certificate authority and recognized by the user's browser, based on recognition of the certificate authority that's programmed in by the browser vendors. The idea is that the Convergence notaries, based on the user's own selection of which ones they prefer, electronically inform the user if the SSL certificate is considered valid. 45
46 SSL Security Dr Taher Elgamal, the creator of the widely used security protocol [SSL], said that little has been done to bump up SSL security since the attacks, which means 'it could happen again'. He said that the problem was less an issue of technology and more to do with people, particularly in terms of how many SSL certificate authorities are out there. 'There's way too many of them,' he said. 'Nobody asked the question of what to do if a certificate authority turns out to be bad.' 46
47 Sir Tim Berners-Lee "I'm amazed I still can't do public key-encrypted with people in the local community," Berners-Lee said at an RSA Conference press event on Thursday. "The things that public key cryptography promised us are not actually there in practice... Certain services, such as Gmail, already allow users to send and receive encrypted within the service. Berners-Lee envisages an overarching public key infrastructure system that would allow encrypted s between different services and pieces of software. " 47
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate
SSL/TLS: The Ugly Truth
SSL/TLS: The Ugly Truth Examining the flaws in SSL/TLS protocols, and the use of certificate authorities. Adrian Hayter CNS Hut 3 Team adrian.hayter@cnsuk.co.uk Contents Introduction to SSL/TLS Cryptography
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features in this chapter apply to IPv4 and IPv6 unless otherwise noted. Secure
Dashlane Security Whitepaper
Dashlane Security Whitepaper November 2014 Protection of User Data in Dashlane Protection of User Data in Dashlane relies on 3 separate secrets: The User Master Password Never stored locally nor remotely.
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th November 2014 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
Savitribai Phule Pune University
Savitribai Phule Pune University Centre for Information and Network Security Course: Introduction to Cyber Security / Information Security Module : Pre-requisites in Information and Network Security Chapter
Overview of CSS SSL. SSL Cryptography Overview CHAPTER
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers
SSL and Browsers: The Pillars of Broken Security
SSL and Browsers: The Pillars of Broken Security Ivan Ristic Wolfgang Kandek Qualys, Inc. Session ID: TECH-403 Session Classification: Intermediate SSL, TLS, And PKI SSL (or TLS, if you prefer) is the
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
Introduction to Cryptography
Introduction to Cryptography Part 3: real world applications Jean-Sébastien Coron January 2007 Public-key encryption BOB ALICE Insecure M E C C D channel M Alice s public-key Alice s private-key Authentication
Network Security (2) CPSC 441 Department of Computer Science University of Calgary
Network Security (2) CPSC 441 Department of Computer Science University of Calgary 1 Friends and enemies: Alice, Bob, Trudy well-known in network security world Bob, Alice (lovers!) want to communicate
Sync Security and Privacy Brief
Introduction Security and privacy are two of the leading issues for users when transferring important files. Keeping data on-premises makes business and IT leaders feel more secure, but comes with technical
7 Key Management and PKIs
CA4005: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Key Management and PKIs 7.1 Key Management Key Management For any use of cryptography, keys must be handled correctly. Symmetric keys must be kept secret.
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography
Chapter 11 Security+ Guide to Network Security Fundamentals, Third Edition Basic Cryptography What Is Steganography? Steganography Process of hiding the existence of the data within another file Example:
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
Ciphire Mail. Abstract
Ciphire Mail Technical Introduction Abstract Ciphire Mail is cryptographic software providing email encryption and digital signatures. The Ciphire Mail client resides on the user's computer between the
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies Dave Corbett Technical Product Manager Implementing Forward Secrecy 1 Agenda Part 1: Introduction Why is Forward Secrecy important?
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
CS3235 - Computer Security Third topic: Crypto Support Sys
Systems used with cryptography CS3235 - Computer Security Third topic: Crypto Support Systems National University of Singapore School of Computing (Some slides drawn from Lawrie Brown s, with permission)
Lukasz Pater CMMS Administrator and Developer
Lukasz Pater CMMS Administrator and Developer EDMS 1373428 Agenda Introduction Why do we need asymmetric ciphers? One-way functions RSA Cipher Message Integrity Examples Secure Socket Layer Single Sign
SBClient SSL. Ehab AbuShmais
SBClient SSL Ehab AbuShmais Agenda SSL Background U2 SSL Support SBClient SSL 2 What Is SSL SSL (Secure Sockets Layer) Provides a secured channel between two communication endpoints Addresses all three
Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
The DoD Public Key Infrastructure And Public Key-Enabling Frequently Asked Questions
The DoD Public Key Infrastructure And Public Key-Enabling Frequently Asked Questions May 3, 2004 TABLE OF CONTENTS GENERAL PKI QUESTIONS... 1 1. What is PKI?...1 2. What functionality is provided by a
Key Management. CSC 490 Special Topics Computer and Network Security. Dr. Xiao Qin. Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.
CSC 490 Special Topics Computer and Network Security Key Management Dr. Xiao Qin Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.edu Slide 09-1 Overview Key exchange Session vs. interchange
Lecture 9: Application of Cryptography
Lecture topics Cryptography basics Using SSL to secure communication links in J2EE programs Programmatic use of cryptography in Java Cryptography basics Encryption Transformation of data into a form that
OFFICE OF THE CONTROLLER OF CERTIFICATION AUTHORITIES TECHNICAL REQUIREMENTS FOR AUDIT OF CERTIFICATION AUTHORITIES
OFFICE OF THE CONTROLLER OF CERTIFICATION AUTHORITIES TECHNICAL REQUIREMENTS FOR AUDIT OF CERTIFICATION AUTHORITIES Table of contents 1.0 SOFTWARE 1 2.0 HARDWARE 2 3.0 TECHNICAL COMPONENTS 2 3.1 KEY MANAGEMENT
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Properties of Secure Network Communication
Properties of Secure Network Communication Secrecy: Only the sender and intended receiver should be able to understand the contents of the transmitted message. Because eavesdroppers may intercept the message,
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Public Key Cryptogrophy 1 Roadmap Introduction RSA Diffie-Hellman Key Exchange Public key and
Entrust Managed Services PKI. Getting started with digital certificates and Entrust Managed Services PKI. Document issue: 1.0
Entrust Managed Services PKI Getting started with digital certificates and Entrust Managed Services PKI Document issue: 1.0 Date of issue: May 2009 Copyright 2009 Entrust. All rights reserved. Entrust
SENSE Security overview 2014
SENSE Security overview 2014 Abstract... 3 Overview... 4 Installation... 6 Device Control... 7 Enrolment Process... 8 Authentication... 9 Network Protection... 12 Local Storage... 13 Conclusion... 15 2
7! Cryptographic Techniques! A Brief Introduction
7! Cryptographic Techniques! A Brief Introduction 7.1! Introduction to Cryptography! 7.2! Symmetric Encryption! 7.3! Asymmetric (Public-Key) Encryption! 7.4! Digital Signatures! 7.5! Public Key Infrastructures
SSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
Why it s Time to Make the Change Analysis of Current Technologies for Multi-Factor Authentication in Active Directory
GoldKey vs RSA Why it s Time to Make the Change Analysis of Current Technologies for Multi-Factor Authentication in Active Directory WideBand Corporation www.goldkey.com Analysis of Current Technologies
Take-home points. Distributed Systems Security II. Remember digital signatures. Today: Auth protocols 15-440
Distributed Systems Security II 5-440 Take-home points What does using public-key for our authentication buy us? Compare kerberos (needham-schroeder) and SSL with a certificate authority Metrics: Scaling,
Secure Socket Layer. Introduction Overview of SSL What SSL is Useful For
Secure Socket Layer Secure Socket Layer Introduction Overview of SSL What SSL is Useful For Introduction Secure Socket Layer (SSL) Industry-standard method for protecting web communications. - Data encryption
Websense Content Gateway HTTPS Configuration
Websense Content Gateway HTTPS Configuration web security data security email security Support Webinars 2010 Websense, Inc. All rights reserved. Webinar Presenter Title: Sr. Tech Support Specialist Cisco
CIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives
CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange; Hash functions; Application of hash
Server Certificates based on DNSSEC
Server Certificates based on DNSSEC Audun Jøsang and Kashif Sana Dar University of Oslo josang@mn.uio.no and kashifd@ifi.uio.no Abstract. Globally unique domain names and IP addresses that are provided
Neutralus Certification Practices Statement
Neutralus Certification Practices Statement Version 2.8 April, 2013 INDEX INDEX...1 1.0 INTRODUCTION...3 1.1 Overview...3 1.2 Policy Identification...3 1.3 Community & Applicability...3 1.4 Contact Details...3
Chapter 10. Cloud Security Mechanisms
Chapter 10. Cloud Security Mechanisms 10.1 Encryption 10.2 Hashing 10.3 Digital Signature 10.4 Public Key Infrastructure (PKI) 10.5 Identity and Access Management (IAM) 10.6 Single Sign-On (SSO) 10.7 Cloud-Based
Security Digital Certificate Manager
System i Security Digital Certificate Manager Version 5 Release 4 System i Security Digital Certificate Manager Version 5 Release 4 Note Before using this information and the product it supports, be sure
Designing a Secure Client-Server System Master of Science Thesis in the Programme Software Engineering & Technology
Designing a Secure Client-Server System Master of Science Thesis in the Programme Software Engineering & Technology FREDRIK ANDERSSON Department of Computer Science and Engineering CHALMERS UNIVERSITY
Security Digital Certificate Manager
IBM i Security Digital Certificate Manager 7.1 IBM i Security Digital Certificate Manager 7.1 Note Before using this information and the product it supports, be sure to read the information in Notices,
Content Teaching Academy at James Madison University
Content Teaching Academy at James Madison University 1 2 The Battle Field: Computers, LANs & Internetworks 3 Definitions Computer Security - generic name for the collection of tools designed to protect
White Paper: Managing Security on Mobile Phones
White Paper: Managing Security on Mobile Phones April 2006 Managing Security on Mobile Phones April 2006 Table of Contents Abstract...2 Executive Summary...2 The Importance Of Managing Security On Mobile
Understanding digital certificates
Understanding digital certificates Mick O Brien and George R S Weir Department of Computer and Information Sciences, University of Strathclyde Glasgow G1 1XH mickobrien137@hotmail.co.uk, george.weir@cis.strath.ac.uk
Introduction to Network Security Key Management and Distribution
Introduction to Network Security Key Management and Distribution Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology cetinkayae@mst.edu http://web.mst.edu/~cetinkayae/teaching/cpe5420fall2015
Chapter 7: Network security
Chapter 7: Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application layer: secure e-mail transport
IT Networks & Security CERT Luncheon Series: Cryptography
IT Networks & Security CERT Luncheon Series: Cryptography Presented by Addam Schroll, IT Security & Privacy Analyst 1 Outline History Terms & Definitions Symmetric and Asymmetric Algorithms Hashing PKI
INTRODUCTION to CRYPTOGRAPHY & CRYPTOGRAPHIC SERVICES on Z/OS BOSTON UNIVERSITY SECURITY CAMP MARCH 14, 2003
INTRODUCTION to CRYPTOGRAPHY & CRYPTOGRAPHIC SERVICES on Z/OS BOSTON UNIVERSITY SECURITY CAMP MARCH 14, 2003 History of Cryptography The concept of securing messages through cryptography has a long history.
How To Encrypt Data With Encryption
USING ENCRYPTION TO PROTECT SENSITIVE INFORMATION Commonwealth Office of Technology Security Month Seminars Alternate Title? Boy, am I surprised. The Entrust guy who has mentioned PKI during every Security
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt 1 Lecture 11: Network Security Reference: Chapter 8 - Computer Networks, Andrew S. Tanenbaum, 4th Edition, Prentice
Secure Network Communication Part II II Public Key Cryptography. Public Key Cryptography
Kommunikationssysteme (KSy) - Block 8 Secure Network Communication Part II II Public Key Cryptography Dr. Andreas Steffen 2000-2001 A. Steffen, 28.03.2001, KSy_RSA.ppt 1 Secure Key Distribution Problem
Data Encryption WHITE PAPER ON. Prepared by Mohammed Samiuddin. www.itmr.ac.in
01 0110 0001 01101 WHITE PAPER ON Data Encryption Prepared by Mohammed Samiuddin www.itmr.ac.in Contents INTRODUCTION... 2 NEED FOR DATA ENCRYPTION... 3 DUE CARE... 3 REPUTATIONAL RISK... 3 REGULATORY
An Overview of the Secure Sockets Layer (SSL)
Chapter 9: SSL and Certificate Services Page 1 of 9 Chapter 9: SSL and Certificate Services The most widespread concern with the Internet is not the limited amount of bandwidth or the occasional objectionable
The science of encryption: prime numbers and mod n arithmetic
The science of encryption: prime numbers and mod n arithmetic Go check your e-mail. You ll notice that the webpage address starts with https://. The s at the end stands for secure meaning that a process
CIPHERMAIL EMAIL ENCRYPTION. CipherMail white paper
CIPHERMAIL EMAIL ENCRYPTION CipherMail white paper Copyright 2009-2014, ciphermail.com. Introduction Most email is sent as plain text. This means that anyone who can intercept email messages, either in
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
NIST ITL July 2012 CA Compromise
NIST ITL July 2012 CA Compromise Prepared for: Intelligent People paul.turner@venafi.com 1 NIST ITL Bulletin on CA Compromise http://csrc.nist.gov/publications/nistbul/july-2012_itl-bulletin.pdf These
Is Your SSL Website and Mobile App Really Secure?
Is Your SSL Website and Mobile App Really Secure? Agenda What is SSL / TLS SSL Vulnerabilities PC/Server Mobile Advice to the Public Hong Kong Computer Emergency Response Team Coordination Centre 香 港 電
Certificates. Noah Zani, Tim Strasser, Andrés Baumeler
Certificates Noah Zani, Tim Strasser, Andrés Baumeler Overview Motivation Introduction Public Key Infrastructure (PKI) Economic Aspects Motivation Need for secure, trusted communication Growing certificate
Ensuring the security of your mobile business intelligence
IBM Software Business Analytics Cognos Business Intelligence Ensuring the security of your mobile business intelligence 2 Ensuring the security of your mobile business intelligence Contents 2 Executive
What Are Certificates?
The Essentials Series: Code-Signing Certificates What Are Certificates? sponsored by by Don Jones W hat Are Certificates?... 1 Digital Certificates and Asymmetric Encryption... 1 Certificates as a Form
CSE543 - Introduction to Computer and Network Security. Module: Public Key Infrastructure
CSE543 - Introduction to Computer and Network Security Module: Public Key Infrastructure Professor Trent Jaeger 1 Meeting Someone New Anywhere in the Internet 2 What is a certificate? A certificate makes
What is network security?
Network security Network Security Srinidhi Varadarajan Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application
Modeling and verification of security protocols
Modeling and verification of security protocols Part I: Basics of cryptography and introduction to security protocols Dresden University of Technology Martin Pitt martin@piware.de Paper and slides available
Full Drive Encryption Security Problem Definition - Encryption Engine
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 Full Drive Encryption Security Problem Definition - Encryption Engine Introduction for the FDE Collaborative Protection Profiles
Complying with PCI Data Security
Complying with PCI Data Security Solution BRIEF Retailers, financial institutions, data processors, and any other vendors that manage credit card holder data today must adhere to strict policies for ensuring
DJIGZO EMAIL ENCRYPTION. Djigzo white paper
DJIGZO EMAIL ENCRYPTION Djigzo white paper Copyright 2009-2011, djigzo.com. Introduction Most email is sent as plain text. This means that anyone who can intercept email messages, either in transit or
SubmitedBy: Name Reg No Email Address. Mirza Kashif Abrar 790604-T079 kasmir07 (at) student.hh.se
SubmitedBy: Name Reg No Email Address Mirza Kashif Abrar 790604-T079 kasmir07 (at) student.hh.se Abid Hussain 780927-T039 abihus07 (at) student.hh.se Imran Ahmad Khan 770630-T053 imrakh07 (at) student.hh.se
EXAM questions for the course TTM4135 - Information Security May 2013. Part 1
EXAM questions for the course TTM4135 - Information Security May 2013 Part 1 This part consists of 5 questions all from one common topic. The number of maximal points for every correctly answered question
Attacks against certification service providers and their ramifications
Federal IT Steering Unit FITSU Federal Intelligence Service FIS Reporting and Analysis Centre for Information Assurance MELANI www.melani.admin.ch Technological consideration Attacks against certification
Authentication. Computer Security. Authentication of People. High Quality Key. process of reliably verifying identity verification techniques
Computer Security process of reliably verifying identity verification techniques what you know (eg., passwords, crypto key) what you have (eg., keycards, embedded crypto) what you are (eg., biometric information)
Common security requirements Basic security tools. Example. Secret-key cryptography Public-key cryptography. Online shopping with Amazon
1 Common security requirements Basic security tools Secret-key cryptography Public-key cryptography Example Online shopping with Amazon 2 Alice credit card # is xxxx Internet What could the hacker possibly
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
Why you need secure email
Why you need secure email WHITE PAPER CONTENTS 1. Executive summary 2. How email works 3. Security threats to your email communications 4. Symmetric and asymmetric encryption 5. Securing your email with
ipad in Business Security
ipad in Business Security Device protection Strong passcodes Passcode expiration Passcode reuse history Maximum failed attempts Over-the-air passcode enforcement Progressive passcode timeout Data security
Digital certificates and SSL
Digital certificates and SSL 20 out of 33 rated this helpful Applies to: Exchange Server 2013 Topic Last Modified: 2013-08-26 Secure Sockets Layer (SSL) is a method for securing communications between
Secure E-Commerce: Understanding the Public Key Cryptography Jigsaw Puzzle
CRYPTOGRAPHY Secure E-Commerce: Understanding the Public Key Cryptography Jigsaw Puzzle Viswanathan Kodaganallur, Ph.D. Today almost all organizations use the Internet extensively for both intra- and inter-organizational
Module 7 Security CS655! 7-1!
Module 7 Security CS655! 7-1! Issues Separation of! Security policies! Precise definition of which entities in the system can take what actions! Security mechanism! Means of enforcing that policy! Distributed
A Standards-based Approach to IP Protection for HDLs
A Standards-based Approach to IP Protection for HDLs John Shields Staff Engineer, Modelsim Overview Introduction A Brief Status First Look at The Flow Encryption Technology Concepts Key Management Second
Credit Card Security
Credit Card Security Created 16 Apr 2014 Revised 16 Apr 2014 Reviewed 16 Apr 2014 Purpose This policy is intended to ensure customer personal information, particularly credit card information and primary
Authentication Application
Authentication Application KERBEROS In an open distributed environment servers to be able to restrict access to authorized users to be able to authenticate requests for service a workstation cannot be
Securing your Online Data Transfer with SSL
Securing your Online Data Transfer with SSL A GUIDE TO UNDERSTANDING SSL CERTIFICATES, how they operate and their application 1. Overview 2. What is SSL? 3. How to tell if a Website is Secure 4. What does
Should You Trust the Padlock? Web Security and the HTTPS Value Chain. Keeping Current 20 November 2013 Ken Calvert
Should You Trust the Padlock? Web Security and the HTTPS Value Chain Keeping Current 20 November 2013 Ken Calvert Outline 1. What are we afraid of? 2. Countermeasures: Securing the Web 3. Public-key Crypto
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Deploying EFS: Part 1
Security Watch Deploying EFS: Part 1 John Morello By now, everyone has heard reports about personal or sensitive data being lost because of laptop theft or misplacement. Laptops go missing on a regular
Arcot Systems, Inc. Securing Digital Identities. FPKI-TWG Mobility Solutions Today s Speaker Tom Wu Principal Software Engineer
Arcot Systems, Inc. Securing Digital Identities FPKI-TWG Mobility Solutions Today s Speaker Tom Wu Principal Software Engineer Today s Agenda Background Who is Arcot Systems? What is an ArcotID? Why use
Associate Prof. Dr. Victor Onomza Waziri
BIG DATA ANALYTICS AND DATA SECURITY IN THE CLOUD VIA FULLY HOMOMORPHIC ENCRYPTION Associate Prof. Dr. Victor Onomza Waziri Department of Cyber Security Science, School of ICT, Federal University of Technology,
Public Key Infrastructure
UT DALLAS Erik Jonsson School of Engineering & Computer Science Public Key Infrastructure Murat Kantarcioglu What is PKI How to ensure the authenticity of public keys How can Alice be sure that Bob s purported
How To Understand And Understand The Security Of A Key Infrastructure
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography Objectives Define digital certificates List the various types of digital certificates and how they are used
Djigzo email encryption. Djigzo white paper
Djigzo email encryption Djigzo white paper Copyright 2009-2011, djigzo.com. Introduction Most email is sent as plain text. This means that anyone who can intercept email messages, either in transit or
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
Key Management and Distribution
Key Management and Distribution Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu udio/video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
BYOD Guidance: BlackBerry Secure Work Space
GOV.UK Guidance BYOD Guidance: BlackBerry Secure Work Space Published 17 February 2015 Contents 1. About this guidance 2. Summary of key risks 3. Secure Work Space components 4. Technical assessment 5.
Securing your Online Data Transfer with SSL A GUIDE TO UNDERSTANDING SSL CERTIFICATES, how they operate and their application INDEX 1. Overview 2. What is SSL? 3. How to tell if a Website is Secure 4.
CRYPTOGRAPHY AS A SERVICE
CRYPTOGRAPHY AS A SERVICE Peter Robinson RSA, The Security Division of EMC Session ID: ADS R01 Session Classification: Advanced Introduction Deploying cryptographic keys to end points such as smart phones,
VICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui
VICTORIA UNIVERSITY OF WELLINGTON Te Whare Wānanga o te Ūpoko o te Ika a Māui School of Engineering and Computer Science Te Kura Mātai Pūkaha, Pūrorohiko PO Box 600 Wellington New Zealand Tel: +64 4 463
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy
Secure Network Communications FIPS 140 2 Non Proprietary Security Policy 21 June 2010 Table of Contents Introduction Module Specification Ports and Interfaces Approved Algorithms Test Environment Roles