Chapter 8 Cryptography - Study Material
Template Cipher
**The template cipher or perforated page cipher is not strictly an encryption cipher, but more of an example of steganography. -The template cipher involves the use of a hidden message in a book, letter, or other message. The receiver must use a page with a specific number of holes cut into it and place it over the book page or letter to extract the hidden message. -A much simpler method would be to employ a variation of acrostics, where the first letter of each line of a message (or every nth letter) would spell out a hidden message.
Bluetooth
*Bluetooth is a de facto industry standard for short-range wireless communications between devices. -It is used to establish communications links between wireless telephones and headsets, between PDAs and desktop computers, and between laptops. -The Bluetooth wireless communications link can be exploited by anyone within a range ofapproximately 30 feet, unless suitable security controls are implemented. -Even in non-discoverable mode, a device is susceptible to access by other devices that have connected with it in the past. By default, Bluetooth does not authenticate connections; however, Bluetooth does implement some degree of security when devices access certain services, such as dial-up accounts and local-area file transfers. -Paired devices—usually a computer or a phone and a peripheral that a user plans to connect to it—require that the same passkey be entered on both devices. This key is used to generate a session key, which is used for all future communications. Unfortunately, some attacks can get around this key. If attackers use a device to simulate a Bluetooth access point, they can trick the device into connecting with it. The fake access point can capture and store all communications, including the pass-key submission. -Cabir virus infected phones and was one of the first Bluetooth attacks -The only way to secure Bluetooth-enabled devices is to incorporate a two-fold approach: Turn off Bluetooth when you do not intend to use it and do not accept an incoming communications pairing request unless you know the identity of the requestor.
Vernam Cipher
-Also known as the one-time pad, the Vernam cipher, developed by Gilbert Vernam in 1917while working at AT&T Bell Labs, uses a set of characters only one time for each encryption process (hence the name one-time pad). -The pad in the name comes from the days of manual encryption and decryption when the key values for each ciphering session were prepared by hand and bound into an easy-to-use form—a pad of paper. -To perform the Vernam cipher encryption, the pad values are added to numeric values representing the plaintext that needs to be encrypted. Each character of the plaintext is turned into a number and a pad value for that position is added to it. The resulting sum for that character is then converted back to a ciphertext letter for transmission. -If the sum of the two values exceeds 26, then 26 is subtracted from the total. The process of keeping a computed number within a specific range is called a modulo; thus, requiring that all numbers be in the range of 1-26 (#s in alphabet) is referred to as modulo 26. In this process, a number larger than 26 has 26 sequentially subtracted from it until the number is in the proper range. -Decryption of any ciphertext generated from a one-time pad requires either knowledge of the pad values or the use of elaborate and very difficult cryptanalysis
Rainbow Cracking
-An attack method called rainbow cracking has generated concern about the strength of the processes used for password hashing. -Well-constructed passwords that are of sufficient length can take a long time to crack even using the fastest computers, but by using a rainbow table—a database of precomputed hashes from sequentially calculated passwords—the rainbow cracker simply looks up the hashed password and reads out the text version. No brute force is required. This type of attack is more properly classified as a time-memory trade-off attack. To defend against such an attack, you must first protect the file of hashed passwords and implement strict limits on the number of attempts allowed per login session. -You can also use an approach called password hash salting. Salting is the process of providing a random piece of data to the hashing function when the hash is first calculated. The use of the salt value creates a different hash; when a large set of salt values are used, rainbow cracking fails because the time-memory trade-off is no longer in the attacker's favor. The salt value is not kept a secret: It is stored along with the account identifier so that the hash value can be recreated during authentication. -Additional techniques include key stretching and key strengthening. Key stretching involves repeating the hashing algorithm up to several thousand times to continuously inject the password, salt value, and interim hash results back into the process. Key strengthening extends the key with the salt value, but then deletes the salt value.
Cryptanalysis
-Cryptanalysis involves cracking or breaking encrypted messages back into their unencrypted origins.
Cryptography
-Cryptography comes from the Greek words kryptos, meaning "hidden," and graphein, meaning "to write," and involves making and using codes to secure messages.
Types of Symmetric Encryption
-DES: One of the most widely known is the Data Encryption Standard (DES); it was developed by IBM and is based on the company's Lucifer algorithm, which uses a key length of 128 bits. As implemented, DES uses a 64-bit block size and a 56-bit key. DES was adopted by NIST in 1976 as a federal standard for encryption of non classified information, after which it became widely employed in commercial applications. DES enjoyed increasing popularity for almost 20 years until 1997,when users realized that a 56-bit key size did not provide acceptable levels of security In 1998, a group called the Electronic Frontier Foundation (www.eff.org) used a specially designed computer to break a DES key in just over 56 hours. -3DES: Triple DES (3DES) was created to provide a level of security far beyond that of DES. 3DES was an advanced application of DES, and while it did deliver on its promise of encryption strength beyond DES, it soon proved too weak to survive indefinitely—especially as computing power continued to double every 18 months. Within just a few years, 3DES needed to be replaced. 3DES uses three 64-bit keys for an overall key length of192 bits. 3DES encryption is the same as that of standard DES, repeated three times. -AES: The successor to 3DES is the Advanced Encryption Standard (AES). AES is a federal information processing standard (FIPS) that specifies a cryptographic algorithm used within the U.S. government to protect information in federal agencies that are not part of the national defense infrastructure. AES was developed to replace both DES and 3DES. cryptographic standards approved by FIPS have been adopted on a voluntary basis by organizations outside government entities. The AES selection process involved cooperation between the U.S. government, private industry, and academia from around the world. AES was approved by the Secretary of Commerce as the official federal governmental standard on May 26, 2002. AES implements a block cipher called the Rijndael Block Cipher with a variable block length and a key length of 128, 192, or 256 bits. Experts estimate that the special computer used by the Electronic Frontier Foundation to crack DES within a couple of days would require approximately 4,698,864 quintillion years (4,698,864,000,000,000,000,000) to crack AES.
Hash Algorithm
-Hash algorithms are used to create a hash value by converting variable-length messages into a single fixed-length value -The message digest is a fingerprint of the author's message that is compared with the recipient's locally calculated hash of the same message.
Hash Functions
-Hash functions are mathematical algorithms used to confirm the identity of a specific message and confirm that the content has not been changed. -While they do not create ciphertext, hash functions confirm message identity and integrity, both of which are critical functions in e-commerce.
Cryptographic Tools
-Public key infrastructure (PKI) systems are based on public-key cryptosystems and include digital certificates and certificate authorities (CAs). -Digital certificates allow the PKI components and their users to validate keys and identify key owners. -
Securing Internet Communication with S-HTTP and SSL
-S-HTTP (Secure Hypertext Transfer Protocol) and SSL are two protocols designed to enable secure network communications across the Internet. S-HTTP and SSL ensure Internet security via different mechanisms and can be used independently or to get. -Netscape developed the Secure Sockets Layer (SSL) protocol to use public-key encryption to secure a channel over the Internet, thus enabling secure communications. -SSL: In addition to providing data encryption, integrity, and server authentication, SSL can provide client authentication when properly configured. -The OpenSSL tool is widely used for Internet sites around the world How SSL Works: The SSL protocol works as follows: during a normal client/server HTTP session, the client requests access to a portion of the Web site that requires secure communications, and the server sends a message to the client indicating that a secure connection must be established. The client sends its public key and security parameters. This handshaking phase is complete when the server finds a public key match and sends a digital certificate to the client to authenticate itself. Once the client verifies that the certificate is valid and trustworthy, the SSL session is established. Until the client or the server terminates the session, any amount of data can be transmitted secure SSL provides two protocol layers within the TCP framework: SSL Record Protocol and Standard HTTP: -***The SSL Record Protocol is responsible for the fragmentation, compression, encryption, and attachment of an SSL header to the plaintext prior to transmission. -The SSL Record Protocol provides basic security and communication services to the top levels of the SSL protocol stack. -Standard HTTP provides the Internet communication services between client and host without consideration for encryption of the data that is transmitted between client and server. -***Secure HTTP (S-HTTP): is an extended version of Hypertext Transfer Protocol that provides for the encryption of individual messages transmitted via the Internet between a client and server. -S-HTTP is the application of SSL over HTTP, which allows the encryption of all information passing between two computers through a protected and secure virtual connection. -Unlike SSL, in which a secure channel is established for the duration of a session, S-HTTP is designed for sending individual messages over the Internet; therefore, a session must be established for each individual exchange of data. -S-HTTP can provide confidentiality, authentication, and data integrity through a variety of trust models and cryptographic algorithms. In addition, this protocol is designed for easy integration with existing HTTP applications and for implementation in conjunction with -Heartbleed bug: The Heartbleed bug is classified as a buffer overread error. Web servers with the Heartbleed bug allow an attacker to bypass some of the controls that protect sensitive information. -The name of the bug comes from a feature implemented in OpenSSL that maintains the connection between host and client while data is not being transmitted between them. The so-called heartbeat packets were intended to maintain session awareness between the server and the client. The bug was that the heartbeat message included a feature to allow the transmission of a selectable quantity of data. In normal use, no data was requested by the client. If the server allowed the client to request data from the heartbeat packet, significant quantities of current server memory would be sent to the client system, including data the server administrator would not want released. The patch corrected this unintended data from being sent.
Securing E-mail with S/MIME, PEM, and PGP
-Secure Multipurpose Internet Mail Extensions (S/MIME) builds on the encoding format of the Multipurpose Internet Mail Extensions (MIME) protocol and uses digital signatures based on public-key cryptosystems to secure e-mail. -In 1993, the Internet Engineering Task Force (IETF) proposed the Privacy-Enhanced Mail (PEM) standard to use 3DES symmetric key encryption and RSA for key exchanges and digital signatures; however, it was never widely deployed. -Pretty Good Privacy (PGP) was developed by Phil Zimmermann, and uses the IDEA cipher for message encoding. PGP also uses RSA for symmetric key exchange and digital signatures. -The first commonly used Internet e-mail standard was SMTP/RFC 822, also called SMTP, but this standard has problems and limitations, such as an inability to transmit executable files or binary objects and an inability to handle character sets other than 7-bit ASCII. These limitations make SMTP unwieldy for organizations that need greater security and support for international character sets. MIME was developed to address the problems associated with SMTP. -S/MIME, an extension to MIME, is the second generation of enhancements to the SMTP standard. MIME and S/MIME have the same message header fields, except for those added to support new functionality. Like MIME, S/MIME uses a canonical form format, which allows it to standardize message content type among systems, but it has the additional ability to sign, encrypt, and decrypt messages (It should be mentioned that PGP is functionally similar to S/MIME, incorporates some of the same algorithms, and can interoperate with S/MIME to some degree.)
Diffie-Hellman Key Exchange
-The most common hybrid system is based on the Diffie-Hellman key exchange, which uses asymmetric encryption to exchange session keys. -Diffie-Hellman provides the foundation for subsequent developments in public-key encryption. It protects data from exposure to third parties, which is sometimes a problem when keys are exchanged out of band.
Cryptology
-The science of encryption, known as cryptology, encompasses cryptography and cryptanalysis. -Cryptology has an extensive, multicultural history. People have been making, using, and breaking codes for thousands of years -1900 B.C.: Egyptian scribes used nonstandard hieroglyphs while inscribing clay tablets; this is the first documented use of written cryptography. -1623 B.C.: Sir Francis Bacon described an encryption method that employed one of the first uses of steganography -1919: Hugo Alexander Koch filed a patent in the Netherlands for a rotor-based cipher machine; in 1927, Koch assigned the patent rights to Arthur Scherbius, the inventor of the Enigma machine. -1978:The initial RSA algorithm was published in Communications of the ACM. -1991:Phil Zimmermann released the first version of PGP (Pretty Good Privacy); PGP was released as freeware and became the worldwide standard for public cryptosystems. -2000: Rijndael's cipher was selected as the Advanced Encryption Standard. -In 1992, encryption tools were officially listed as Auxiliary Military Technology under the Code of Federal Regulations: International Traffic in Arms Regulations.
Steganography
-The word steganography—the art of secret writing—is derived from the Greek words steganos, meaning "covered," and graphein, meaning "to write". -Herodotus - one of first steganographers (who warned of an imminent invasion by writing a message on the wood beneath a wax writing) -While steganography is technically not a form of cryptography, it is another way of protecting the confidentiality of information in transit. -
Asymmetric Encryption
-While symmetric encryption systems use a single key both to encrypt and decrypt a message, asymmetric encryption uses two different but related keys. Either key can be used to encrypt or decrypt the message. However, if key A is used to encrypt the message, only key B can decrypt it; if key B is used to encrypt a message, only key A can decrypt it. -Asymmetric encryption can be used to provide elegant solutions to problems of secrecy and verification. -the more common name for asymmetric encryption is public-key encryption. **Asymmetric algorithms are one-way functions, meaning they are simple to compute in one direction, but complex to compute in the opposite direction. A mathematical trapdoor is a "secret mechanism that enables you to easily accomplish the reverse function in a one-way function." With a trap-door, you can use a key to encrypt or decrypt the ciphertext, but not both, thus requiring two keys. The public key becomes the true key, and the private key is derived from the public key using the trapdoor. -The problem with asymmetric encryption is that holding a single conversation between two parties requires four keys. Moreover, if four organizations want to exchange communications, each party must manage its private key and four public keys. -asymmetric encryption is sometimes regarded by experts as inefficient. -Consequently, hybrid systems, such as those described later in this chapter in the "public key infrastructure (PKI)" section, are more commonly used than pure asymmetric systems.
Exclusive OR operation
-a function of Boolean algebra in which two bits are compared and a binary result is generated. -XOR encryption method is very simple to implement and equally simple to break. The XOR encryption method should not be used by itself when an organization is transmitting or storing sensitive data. Actual encryption algorithms used to protect data typically use the XOR operator as part of a more complex encryption process.' -You can combine XOR with a block cipher to produce a simple but powerful operation.
Subsitution Cipher
-exchanges one value for another -based on a single alphabet is known as a monoalphabetic substitution -More advanced substitution ciphers use two or more alphabets, and are referred to as polyalphabetic substitutions. (Like Julius Caesar's letters) -Vignere Cipher: An advanced type of substitution cipher that uses a simple polyalphabetic code is the Vigenère cipher. The cipher is implemented using the Vigenère square (or table), also known as a tabula recta—a term invented by Johannes Trithemius in the 1500s. the setup of the Vigenère square, which is made up of 26 distinct cipher alphabets. -In the header row and column, the alphabet is written in its normal order. In each subsequent row, the alphabet is shifted one letter to the right until a 26 26 block of letters is formed.
Secure Hash Standard (SHS)
-is issued by the National Institute of Standards and Technology (NIST). Standard document FIPS 180-4 specifies SHA-1 (Secure Hash Algorithm 1)as a secure algorithm for computing a condensed representation of a message or data file. -SHA-1 produces a 160-bit message digest, which can be used as an input to a digital signature algorithm. SHA-1 is based on principles modeled after MD4, which is part of the MDx family of hash algorithms created by Ronald Rivest. -New hash algorithms, SHA-256, SHA-384, and SHA-512, have been proposed by NIST as standards for 128, 192, and 256 bits ,respectively. The number of bits used in the hash algorithm is a measurement of the algorithm's strength against collision attacks. SHA-256 is essentially a 256-bit block cipher algorithm that creates a key by encrypting the intermediate hash value, with the message block functioning as the key. The compression function operates on each 512-bit message block and a 256-bit intermediate message digest.2
Transposition Cipher (Permutation Cipher)
-simply rearranges the bits or bytes (characters) within a block to create the ciphertext. -In addition to being credited with inventing a substitution cipher, Julius Caesar was associated with an early version of the transposition cipher. In the Caesar block cipher, the recipient of the coded message knows to fit the text to a prime number square. (this means that if there are fewer than 25 characters, the recipient uses a 5 x 5 square.) -When mechanical and electronic cryptosystems became more widely used, transposition ciphers and substitution ciphers were combined to produce highly secure encryption processes. To make the encryption even stronger and more difficult to cryptanalyze, the keys and block sizes can be increased to 128 bits or more, which produces substantially more complex substitutions or transpositions. These systems use a block padding method to fill the last block of the plaintext with random characters to facilitate the algorithm.
2 Methods to Encrypt Plaintext
-two methods of encrypting plaintext: the bit stream method or the block cipher method most computer-based encryption methods operate on data at the level of its binary digits (bits), while others operate at the byte or character level Bit stream: -In the bit stream method, each bit in the plaintext is transformed into a cipher bit one bit at a time. -Bit stream methods commonly use algorithm functions like the exclusive OR operation(XOR) Block Cipher -In the block cipher method, the message is divided into blocks—for example, sets of 8-, 16-, 32-, or 64-bit blocks—and then each block of plaintext bits is transformed into an encrypted block of cipher bits using an algorithm and a key. -block methods can use substitution, transposition, XOR, or some combination of these operations
Hash Value
Aka message disgest -Hash functions are considered one-way operations in that the same message always provides the same hash value, but the hash value itself cannot be used to determine the contents of the message.
Book Based Ciphers (Pg 464)
Book cipher, running key cipher, **template cipher
Symmetric Encryption
Encryption methodologies that require the same secret key to encipher and decipher the message are performing "private-key encryption" or "symmetric encryption." -Symmetric encryption methods use mathematical operations that can be programmed into extremely fast computing algorithms so that encryption and decryption are executed quickly, even by small computers. -one of the challenges is that both the sender and the recipient must have the secret key. Also, if either copy of the key falls into the wrong hands, messages can be decrypted by others and the sender and intended receiver may not know a message was intercepted. -The primary challenge of symmetric key encryption is getting the key to the receiver, a process that must be conducted out of band to avoid interception. In other words, the process must use a channel or band other than the one carrying the ciphertext.
Hash Functions Cont.
Hashing functions do not require the use of keys, but it is possible to attach a message authentication code (MAC)to allow only specific recipients to access the message digest. Because hash functions are one-way, they are used in password verification systems to confirm the identity of the user. In such systems, the hash value, or message digest, is calculated based on the originally issued password, and this message digest is stored for later comparison. When the user logs on for the next session, the system calculates a hash value based on the user's password input, and this value is compared against the stored value to confirm identity.
Securing TCP/IP with IPSec and PGP
IP Security (IPSec) is an open-source protocol framework for security development within the TCP/IP family of protocol standards. -It is used to secure communications across IP-based networks such as LANs, WANs, and the Internet. The protocol is designed to protect data integrity, user confidentiality, and authenticity at the IP packet level. IPSec is the cryptographic authentication and encryption product of the IETF's IP Protocol Security Working Group. It is often described as the security system from IP version 6, the future version of the TCP/IP protocol, retrofitted for use with IP version 4 (the current version). -IPSec is defined in Request for Comments (RFC) 1825, 1826, and 1827, and is widely used to create virtual private networks (VPNs). IPSec itself is an open framework. -IPSec includes the IP Security protocol itself, which specifies the information to be added to an IP packet as well as how to encrypt packet data; and the Internet Key Exchange, which uses an asymmetric-based key exchange and negotiates the security associations. IPSec operates in two modes: transport and tunnel. -In transport mode, only the IP data is encrypted, not the IP headers. This allows intermediate nodes to read the source and destination addresses. -In tunnel mode, the entire IP packet is encrypted and then placed into the content portion of another IP packet. This requires other systems at the beginning and end of the tunnel to act as proxies and to send and receive the encrypted packets. These systems then transmit the decrypted packets to their true destinations. -IPSec uses several different cryptosystems: • Diffie-Hellman key exchange for deriving key material between peers on a public network • Public-key cryptography for signing the Diffie-Hellman exchanges to guarantee the identity of the two parties • Bulk encryption algorithms, such as DES, for encrypting the data • Digital certificates signed by a certificate authority to act as digital ID cards Within IPSec, IP layer security is achieved by means of an application header protocol or an encapsulating security payload protocol. -The application header (AH) protocol provides system-to-system authentication and data integrity verification, but does not provide secrecy for the content of a network communication. -The encapsulating security payload (ESP) protocol provides secrecy for the contents of network communications as well as system-to-system authentication and data integrity verification. -When two networked systems form an association that uses encryption and authentication keys, algorithms, and key lifetimes, they can implement either the AH or the ESP protocol, but not both. -The AH protocol is designed to provide data integrity and IP packet authentication. Although AH does not provide confidentiality protection, IP packets are protected from replay attacks and address spoofing as well as other types of cyberattacks against open net-works. -Packet format of the IPSec authentication header protocol: As shown in this diagram, the security parameters index (SPI) references the session key and algorithm used to protect the data being transported. Sequence numbers allow packets to arrive out of sequence for reassembly. The integrity check value (ICV) of the authentication data serves as a check sum to verify that the packet itself is unaltered. Whether used in IPv4 or IPv6, authentication secures the entire packet, excluding mutable fields in the new IP header. In tunnel mode, however, the entire inner IP packet is secured by the authentication header protocol. -The ESP protocol provides confidentiality services for IP packets across insecure networks. ESP can also provide the authentication services of AH. -ESP in tunnel mode can be used to establish a virtual private network, assuring encryption and authentication between networks communicating via the Internet. In tunnel mode, the entire IP packet is encrypted with the attached ESP header. A new IP header is attached to the encrypted payload, providing the required routing information. -An ESP header is inserted into the IP packet prior to the TCP header, and an ESP trailer is placed after the IPv4 packet. If authentication is desired, an ESP authentication data field is appended after the ESP trailer. The complete transport segment, in addition to the ESP trailer, is encrypted. In an IPv6 transmission, the ESP header is placed after the hop-by-hop and routing headers. Encryption under IPv6 covers the transport segment and the ESP trailer. Authentication in both IPv4 and IPv6 covers the ciphertext data plus the ESP header. -IPSec ESP-compliant systems must support the implementation of the DES algorithm using the CBC (cipher block chaining) mode, which incorporates the following encryption algorithms: Triple DES, IDEA, RC5, CAST, and Blowfish.
Book Cipher
In a book cipher, the ciphertext consists of a list of codes representing the page number, line number, and word number of the plaintext word. The algorithm is the mechanical process of looking up the references from the ciphertext and converting each reference to a word by using the ciphertext's value and the key (the book). An even more sophisticated version might use multiple books, perhaps even in a particular sequence for each word or phrase.
Cryptographic Algorithms
In general, cryptographic algorithms are often grouped into two broad categories—symmetric and asymmetric—but in practice, today's popular cryptosystems use a combination of both algorithms. -Symmetric and asymmetric algorithms are distinguished by the types of keys they use for encryption and decryption operations.
Securing Web Transactions with SET, SSL, and S-HTTP
Just as PGP, PEM, and S/MIME work to secure e-mail operations, a number of related protocols work to secure Web browsers, especially at e-commerce sites. Among these protocols are SET, SSL, S-HTTP, Secure Shell (SSH-2), and IP Security (IPSec). -SET: Secure Electronic Transactions (SET) was developed by MasterCard and Visa in 1997 to protect against electronic payment fraud. SET uses DES to encrypt credit card information transfers and RSA for key exchange. SET provides security both for Internet-based credit card transactions and credit card swipe systems in retail stores. SSL: SSL also provides secure online e-commerce transactions. SSL uses a number of algorithms, but mainly relies on RSA for key transfer and uses IDEA, DES, or 3DES for encrypted symmetric key-based data transfer.
Public Key Infrastructure (PKI)
PKI systems and their digital certificate registries enable the protection of information assets by making verifiable digital certificates read-ily available to business applications. This, in turn, allows the applications to implement several key characteristics of information security and integrate these characteristics into the following business processes across an organization: • Authentication: Individuals, organizations, and Web servers can validate the identity of each party in an Internet transaction. • Integrity: Content signed by the certificate is known not to have been altered while in transit from host to host or server to client. • Privacy: Information is protected from being intercepted during transmission. • Authorization: The validated identity of users and programs can enable authorization rules that remain in place for the duration of a transaction; this reduces overhead and allows for more control of access privileges for specific transactions. • Nonrepudiation: Customers or partners can be held accountable for transactions, such as online purchases, which they cannot later dispute. A typical PKI solution protects the transmission and reception of secure information by integrating the following components: • A certificate authority (CA), which issues, manages, authenticates, signs, and revokes users' digital certificates. These certificates typically contain the user name, public key, and other identifying information. • A registration authority (RA), which handles certification functions such as verifying registration information, generating end-user keys, revoking certificates, and validating user certificates, in collaboration with the CA. • Certificate directories, which are central locations for certificate storage that provide a single access point for administration and distribution. • Management protocols, which organize and manage communications among CAs, RAs, and end users. This includes the functions and procedures for setting up new users, issuing keys, recovering keys, updating keys, revoking keys, and enabling the transfer of certificates and status information among the parties involved in the PKI's area of authority. • Policies and procedures, which assist an organization in the application and management of certificates, in the formalization of legal liabilities and limitations, and in actual business use.
PGP
Pretty Good Privacy (PGP) is a hybrid cryptosystem that combines some of the best available cryptographic algorithms. It has become the open-source de facto standard for encryption and authentication of e-mail and file storage applications. -The PGP security solution provides six services: authentication by digital signatures, message encryption, compression, e-mail compatibility, segmentation, and key management. -One of the algorithms used in PGP public-key encryption is Secure Hash Algorithm 1 (SHA-1), which computes hash values for calculating a 160-bit hash code based on the plaintext message. -The hash code is then encrypted with DSS or RSA and appended to the original message. The recipient uses the sender's public key to decrypt and recover the hash code. Using the same encryption algorithm, the recipient then generates anew hash code from the same message. If the two hash codes are identical, then the message and the sender are authentic. -3DES, IDEA, or CAST, which are all standard algorithms, may be used to encrypt the message contents with a unique, randomly generated 128-bit session key. The session key is encrypted by RSA, using the recipient's public key, and then appended to the message. The recipient uses his or her private key with RSA to decrypt and recover the session key. The recovered session key is used to decrypt the message. -Authentication and message encryption can be used together by first digitally signing the message with a private key, encrypting the message with a unique session key, and then encrypting the session key with the intended recipient's public key. -PGP uses the freeware ZIP algorithm to compress the message after it has been digitally signed but before it is encrypted. This saves space and generates a more secure encrypted document because a smaller file offers an attacker fewer chances to look for patterns in the data and fewer characters with which to perform frequency analysis. -PGP also uses a process known as Radix-64, which encodes non-textual data and assures that encrypted data can be transferred using e-mail systems by maintaining the required 8-bit blocks of ASCII text. The format maps three octets of binary data into four ASCII characters and appends acyclic redundancy check (CRC) to detect transmission errors. -Because many Internet facilities impose restrictions on message size, PGP can automatically subdivide messages into a manageable stream size. -PGP does not impose a rigid structure for public-key management, but it can assign a level of trust within the confines of PGP, though it does not specify the actual degree of trust the user should place in any specific key.
Next Generation Wireless Protocols
RSN: Robust Secure Network (RSN) is a protocol for establishing secure communications over an 802.11 wireless network. It is a part of the802.11i standard. RSN uses AES along with 802.1x and EAP. RSN extends AES with the Counter Mode CBC MAC Protocol (CCMP). AES supports key lengths of up to 256 bits, but it is not compatible with older hardware. -The RSN protocol functions as follows: 1. The wireless network interface card (NIC) sends a probe request. 2. The wireless access point sends a probe response with an RSN Information Exchange(IE) frame. 3. The wireless NIC requests authentication via one of the approved methods. 4. The wireless access point provides authentication for the wireless NIC. 5. The wireless NIC sends an association request with an RSN IE frame. 6. The wireless access point sends an association response.
Running Key Cipher
Similar in concept to the book cipher is the running key cipher, which uses a book for passing the key to a cipher that is similar to the Vigenère cipher. The sender provides an encrypted message with a short sequence of numbers that indicate the page, line, and word number from a predetermined book to be used as the key or indicator block. Unlike the Vigenère cipher, if the key needs to be extended in a running key cipher, you don't repeat the key. Instead, you continue the text from the indicator block. From this point, you follow the same basic method as the Vigenère cipher, using the tabula recta to find the column based on the plaintext, and the row based on the key-indicator block letter. -Reversing the processes deciphers the ciphertext, using the ciphertext letter and key. You simply use the row or column corresponding to the key letter, find the ciphertext in the row or column of text, and then identify the letter on the opposing axis. The mirrored lay-out of the table simplifies the selection of rows or columns during encryption and decryption.
Certificate Authority
The CA performs many housekeeping activities regarding the use of keys and certificates that are issued and used in its zone of authority. Each user authenticates himself or herself with the CA. The CA can issue new or replacement keys, track issued keys, provide a directory of public-key values for all known users, and perform other management activities. -The CA periodically distributes a certificate revocation list(CRL)to all users.
Encryption Key Size
The security of any cryptosystem depends on keeping some or all elements of the cryptovariable(s) or key(s) secret, and effective security is maintained by manipulating the size (bit length) of the keys and following proper procedures and policies for key management. An eight-bit system has 256 possible keys. If you use a 24-bit key, which is puny by modern standards, you have almost 16.8 million possible keys. There is no net advantage for sequential operations unless each subsequent operation is different. Therefore, to substitute, then transpose, then XOR, then substitute again, the cryptosystem will have dramatically scrambled, substituted, and recoded the original plaintext with ciphertext, which the cryptosystem hopes is unbreakable without the key.
Securing Wireless Networks with WEP and WPA
To prevent interception of communications, wireless networks must use some form of cryptographic security control. Two sets of protocols are widely used to help secure wireless transmissions: Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA). Both are designed for use with the IEEE 802.11 wireless networks. Wired Equivalent Privacy (WEP): -WEP was an early attempt to provide security with the 802.11 network protocol. It is now considered too cryptographically weak to provide any meaningful protection from eavesdropping, but for a time it did provide some measure of security for low-sensitivity networks. -WEP uses the RC4 cipher stream to encrypt each packet using a 64-bit key. This key is created using a 24-bit initialization vector and a 40-bit key value. The packets are formed with an XOR function to use the RC4 key value stream to encrypt the data packet. A 4-byte integrity check value (ICV) is calculated for each packet and then appended. -WEP is too weak for use inmost network settings for the following reasons: • Key management is not effective because most networks use a single shared secret key value for each node. Synchronizing key changes is a tedious process, and no key management is defined in the protocol, so keys are seldom changed. • The initialization vector (IV) is too small, resulting in the recycling of IVs. An attacker can reverse-engineer the RC4 cipher stream and decrypt subsequent packets, or can forge future packets. In 2007, a brute force decryption was accomplished in less than one minute. -In summary, an intruder who collects enough data can threaten a WEP network in just a few minutes by decrypting or altering the data being transmitted, or by forging the WEP key to gain unauthorized access to the network. WEP also lacks a means of validating user credentials to ensure that only authorized network users are allowed to access Wi-Fi Protected Access (WPA and WPA2): -WPA was created to resolve the issues with WEP -WPA has a key size of 128 bits; instead of static, seldom-changed keys, it uses dynamic keys created and shared by an authentication server. WPA accomplishes this through the use of the Temporal Key Integrity Protocol (TKIP). TKIP is a suite of algorithms that attempts to deliver the best security possible given the constraints of the wireless network environment. The algorithms are designed to work with legacy networking devices. -TKIP adds four new algorithms in addition to those that were used in WEP: • A cryptographic message integrity code, or MIC, called Michael, to defeat forgeries • A new IV sequencing discipline to remove replay attacks from the attacker's arsenal • A per-packet key mixing function to decorrelate the public IVs from weak keys • A rekeying mechanism to provide fresh encryption and integrity keys, undoing the threat of attacks stemming from key reuse. -While it offered dramatically improved security over WEP, WPA was not the most secure wireless protocol design. Some compromises were made in the security design to allow compatibility with existing wireless network components. Protocols to replace TKIP are currently under development. -In 2004, WPA2 was made available as a replacement for WPA. WPA2 provided many of the elements missing from WPA, most notably AES-based encryption. Beginning in 2006, WPA2 became mandatory for all new Wi-Fi devices.
