ENCRYPTION

Encryption is the process of converting a plaintext message into ciphertext. This is

done via a mathematical function and a special encryption/decryption password called
the key.

Key Elements of Encryption Systems

Key elements of encryption systems include:
• Encryption algorithm—A mathematically based function or calculation that
encrypts/decrypts data

• Encryption keys—A piece of information that is used within an encryption

algorithm (calculation) to make the encryption or decryption process unique.

• Key length—The longer the key, the more difficult it is to compromise.

Most encrypted transactions over the Internet use a combination of private keys/public
keys, secret keys, hash functions and digital certificates to achieve confidentiality,
message integrity, authentication and nonrepudiation by either sender or recipient
(also known as a public key infrastructure).

There are two types of cryptographic systems:

 Symmetric or private key

 Asymmetric or public key cryptographic systems.

Private Key Cryptographic Systems

Private key cryptographic systems are based on a symmetric encryption algorithm,
which uses
Secret (private) key  encrypt and decrypt
• The most common private key cryptographic system is the Data Encryption Standard
(DES) also known as a block cipher. I

DES is no longer considered a strong cryptographic solution, since its entire key space can be
brute-forced (every possible key tried) by large computer systems within a relatively short period
of time.

Advantages to private key cryptosystems such as DES or AES

 The user has to remember/know only one key for both encryption and decryption.

 Private key cryptosystems are generally less complicated

Disadvantage of this approach is how to get the keys into the hands of those with whom you
want to exchange data

Public Key Cryptographic Systems

Based on an asymmetric encryption process, two keys work together as a pair. One key is used
to encrypt data, the other is used to decrypt data. Either key can be used to encrypt or decrypt,
but once the key has been used to encrypt data, only its partner can be used to decrypt the data

A common form of asymmetric encryption is RSA. RSA is a public key cryptosystem for both
encryption and authentication.

Generally, with asymmetric encryption

 One key—the secret or private key—is known only to one person.
 The other key— the public key—is known by many people.

In other words, a message that has been sent enciphered by the secret key of the
sender can be deciphered by anyone with the public key. but could only have come
from the sender. This forms the basis of authentication and nonrepudiation.

A message that has been sent enciphered using the public key of the receiver can be
generated by anyone, but can only be read by the receiver. This is the basis of
confidentiality.

A message that has been encrypted twice, first by the sender's secret key and
secondly by the receiver's public key achieves both authentication and
confidentiality objectives.

The disadvantage in using; an asymmetric key is that it takes much longer to

encrypt/decrypt than a symmetric key.

Elliptical Curve Cryptography

Elliptical curve cryptosystems work well on networked computers requiring strong
cryptography but have some limitations such as bandwidth and processing power.

Quantum Cryptography
Quantum cryptography taps the natural uncertainty of the quantum world (using
interaction of light pulses as a way of transmitting keys and secure information).Light
photon pulses randomly emitted to him/her from a sender. Using a prearranged code,
the sender and receiver then can translate polarization measurements into bits where
the horizontal and right diagonal equal 1 and the vertical and left diagonal equal 0 (i.e.,
1001).

Digital Signatures u
A digital signature is an electronic identification of a person or entity created by using a
public key algorithm and intended to verify to a recipient the integrity of the data and
the identity of the sender.
To verify the integrity of the data

 Message----------------Message Digest(128 bit)

(Hashing Algorithm)
  Message Digest----------encrypt(Message Digest)
(Sender’s Private key)
 Sign the document using sender’s digital signature for message authenticity

 To decrypt, the receiver would use the sender's public key

 Once decrypted, the receiver will recompute the hash using the same hashing
algorithm on the electronic document and compare the results with what was
sent to ensure the integrity of the message.

Therefore, digital signature is a cryptographic method that ensures:

• Data integrity—Any change to the plaintext message would result in the recipient
failing to compute the same message hash.
• Authentication—The recipient can ensure that the message has been sent by the
claimed sender, since only the claimed sender has the secret key.
• Nonrepudiation—The claimed sender cannot later deny generating and sending the
message. .H

Replay protection is not ensured by signing an electronic document using a

cryptographic technique. A timestamp is used to date a document and the document
hash could be used to uniquely identify or number the document. The timestamp or the
hashing of the document could provide replay protection or warranties.

Digital signatures and public key encryption are vulnerable to man-in-the-middle attacks

Digital Envelope
A digital envelope is used to send encrypted information and the relevant key along
with it.

A digital envelope mechanism works as follows:

 symmetric key( session key)---------encrypted------------encrypted
sender's private key receiver's public key.

 The encrypted message and the encrypted session key are sent to the
receiver,
 Encrypted Session key -----------Decrypt --------------Decrypt
receiver's private key sender's public key

 The session key is then applied to the message to get it in clear text.

The process of encrypting the bulk data using symmetric key cryptography and
encrypting the symmetric key with a public key algorithm is referred to as digital
envelope.

Public Key Infrastructure

Transactions over the Internet use a combination of private keys/public keys, secret
keys, hash functions and digital certificates to achieve confidentiality, message
integrity, authentication and nonrepudiation by either sender or recipient also
known as a public key infrastructure. To distribute the public key in a secure way, a
framework needs to be established to issue, maintain and revoke public key certificates by
a trusted party. This framework is known as a PKI.

Key elements of the infrastructure are as follows:

•Digital certificates( for authenticity) —A digital credential is composed of a public
key and identifying information about the owner of the public key. The purpose of
digital certificates is to associate a public key with the individual's identity. These
certificates are electronic documents, digitally signed by some trusted entity, with a
private key (transparent to users) that contains information about the individual and
his/her public key.

The process involves proving the sender's authenticity. When a person digitally signs
a document, that person attaches a digital certificate issued by a trusted entity. The
receiver of the message and accompanying digital certificate relies on the public key
of the trusted third-party certificate authority to authenticate the message. The receiver
can link the message to a person, not simply to a public key, because of their trust in
this third party.

The status and values of a current user's certificate should include a distinguishing
username, an actual public key, the algorithm used to compute the digital signature
inside the certificate and a certificate validity period.

*Certificate authority—A CA is an authority in a network that issues and manages

security credentials and public keys for message signature verification or encryption.

 The CA attests, to the authenticity of the owner of a public key.

 CA checks with a registration authority (RA) to verify information provided by
the requestor of a digital certificate.
 If the RA verifies the requestor's information, the CA can then issue a
certificate.
 Upon verifying the identity of the recipient, the CA signs the certificate with
its private key for distribution to the user.
 Upon receipt, the user will verify the certificate signature with the CA's public
key
 A certificate always includes the owner's public key, expiration date and the
owner's information.

CA structure include certificate practice statement (CPS), RAs and CRLS.

■
• Registration authority—A RA is an authority in a network that verifies user requests for a
digital certificate and tells th eCA to issue it. If an RA is not present in the PKI structure
established, the CA is assumed to have the same set of capabilities as those defined for an
RA.
These functions may include the following: U
 Verifying information supplied by the subject (personal authentication functions) I
 Verifying the right of the subject to requested certificate attributes
 Verifying that the subject actually possesses the private key being registered and that it
matches the public key requested for a certificate. This is generally referred to as proof
of possession (POP). ■
 Reporting key compromise or termination cases where revocation is required *
 Assigning names for identification purposes M
 Generating shared secrets for use during the initialization and certificate pick-up phases
of registration ■
 Initiating the registration process with the CA on behalf of the subject end entity
 Initiating the key recovery processing fl
 Distributing the physical tokens (such as smart cards) containing the private keys ™

• Certificate revocation list—The CRL details digital certificates that are no longer valid
because they were revoked by the CA.

• Certification practice statement—CPS is a detailed set of rules governing the certificate

authority's operations. It provides an understanding of the value and trustworthiness of
certificates issued by a given CA in terms of the controls that an organization observes, the
method it uses to validate the authenticity of certificate applicants and the CA's expectations of
how its certificates may be used.

Use of Encryption in OSI Protocols

Encryption is applicable to all layers in the OSI model except the physical layer.

Applications of Cryptographic Systems: E-mail and Internet transactions

On sending end
 Sender hash the message into a message digest or prehash code for message
integrity
 Message is encrypted using the sender's private key for authenticity (i.e., digital
signature).Using his/her secret key
 The sender will encrypt the message and the prehash code if authenticity
(nonrepudiation) is needed
 The secret key is encrypted with the recipient's public key, which has been
validated through the recipient's digital certificate and provides message
confidentiality.
On the receiving end (reverses what has been done by the sender)
 The recipient uses his/her private key to decrypt the secret key using
senders private key, exposing the message.
 The prehash code has been encrypted with the sender's private key
 The recipient will verify the authenticity of the public key with its digital
certificate and decrypt the prehash code, which provides the
nonrepudiation to the recipient of the sender's message..
 For integrity purposes, the recipient calculates a posthash code, which
should equal the prehash code,

Specific examples of this method or related variants are described below:

• Secure Sockets Layer (SSL) and Transport Layer Security (TLS)— These are
cryptographic protocols which provide secure communications on the Internet. In
typical use, only the server is authenticated while the client remains unauthenticated,
The SSL provides for: Confidentiality, Integrity, Authentication, Nonrepudiation
The SSL handshake protocol is based on the application layer

• Secure Hypertext Transfer Protocol (S/HTTP)—As an application layer protocol, S/HTTP

transmits individual messages or pages securely, between a web client and server by
establishing an SSL-type connection. This protocol utilizes SSL secure features, but does so
as a message rather than as a session-oriented protocol.

• IPSec—IPSec is used for communication between two or more hosts, two or more subnets, or
hosts and [Link] IP network layer packet security protocol establishes VPNs via
transport and tunnel mode encryption methods.
For the transport method, the data portion of each packet referred to as the encapsulation
security pay load (ESP) is encrypted achieving confidentiality over the process. In the
[Link], the ESP payload and its header are encrypted. To achieve nonrepudiation, an
additional authentication header (AH) is applied. M

In establishing IPSec sessions in either mode, security associations (SAs) are established.
SAs define which security parameters to apply between the communicating parties as
encryption algorithms, keys, initialization vectors, life span of keys, etc. Within either the ESP
or AH header respectively, an SA is established when a 32-bit security parameter index (SP1)
field is defined within the sending host. The SPI is a unique identifier that enables the
sending host to reference the security parameters to apply, as specified, on the receiving host.
 IPSec can be made more secure by using asymmetric encryption, through the of Internet
Security Association and Key Management Protocol/Oakley (ISAKMP/Oakley), which allows
Ihe key management, the use of public keys, the negotiation, the establishment, the
modification and the deletion of the SAs and the attributes. For authentication, the E
sender uses digital certificates. The connection is made secure by supporting the generation,
authentication, distribution of the SAs and those of the cryptographic keys. tj
•SSH—A client-server program that opens a secure, encrypted command-line shell session from
the Internet for remote logon. Similar to a VPN, it uses strong cryptography to protect data,
including passwords, binary files and administrative commands, transmitted between systems
on a network. It is typically implemented between two parties by validating each other's
credentials via digital certificates. It is useful in securing Telnet and FTP services. It is
implemented at the application layer, as opposed to operating at the network layer (IPSec
implementation). I
•Secure Multipurpose Internet Mail Extensions (S/MIME)—A standard secure e-mail protocol
that authenticates the identity of the sender and receiver, verifies message integrity, and
ensures the privacy of a message's contents, including attachments.
•Secure Electronic Transactions (SET)—It is a protocol developed jointly by VISA and Master
Card to secure payment transactions between all parties involved in credit card transactions on
behalf of cardholders and merchants. As an open system specification, SET is an application-
oriented protocol that uses trusted third parties' encryption and digital signature processes, via
a PKI infrastructure of trusted third-party institutions, to address confidentiality of information,
Wm
integrity of data, cardholder authentication, merchant authentication and interoperability. '
' ■!

Encryption Risks and Password Protection |

The more a key is used, the more vulnerable it is to compromise .When passwords are tied into
key generation, the strength of the encryption algorithm is diminished. Therefore, it is important
that effective password syntax rules are applied, and easily guessed passwords are prohibited.