BRIEFING OF MESSAGE AUTHENTICATION:
For centuries, various forms of encryption have provided confidentiality of information and have become integral
components of computer communication technology. Early encryption techniques were based on “shared knowledge”
between the communication participants.
Confidentiality and basic authentication were established by the fact that
“Each participant must know a common secret to encrypt or decrypt the communication” or
“As with very early encryption technology, the diameter of a stick”.
The complexity of communication technology has increased the sophistication of attacks and has intensified the
vulnerabilities confronting data.
The enhancement of communication technology inherently provides tools for attacking other communications.
Therefore, mechanisms are employed to reduce the new vulnerabilities that are introduced by new communication
technology.
The mechanisms utilized to ensure confidentiality, authentication and integrity are built on the under-standing that
encryption alone or simply applied to the data, will not suffice any longer.
The need to ensure that the information is from the purported sender, that it was not changed or viewed in transit and
to provide a process to validate these concerns is the responsibility of message authentication.
Technology of message authentication, its application in various communication environments and the security
considerations of those types of implementations.
History of Message Authentication:
An encrypted message could typically be trusted for several reasons.
First and fore-most, the validity of the message content was established by the knowledge that the sender had the
appropriate shared information to produce the encrypted message.
An extension of this type of assumed assurance was also recognized by the possession of the encrypting device.
An example is the World War-II German Enigma (a diabolically complex encryption machine) that used three or four
wheels to produce cipher text as an operator typed in a message.
Enigma was closely guarded. If it fell into the enemy’s possession, the process of deciphering any captured encrypted
messages would become much less complex.
The example of the Enigma demonstrates that possession of a device in combination with the secret code for a specific
message provided insurance that the message contents received were genuine and authenticated.
As the growth of communication technology embraced computers, the process of encryption moved away from
complex and rare mechanical devices to programs that provided algorithms for encryption.
The mechanical algorithm of wheels and electrical conduits was replaced by software that could be loaded on to
computers which are readily available to provide encryption.
As algorithms were developed, many became open to the public for inspection and verification for use as a standard.
Once the algorithm was exposed, the power of protection was in the key that was combined with the clear message
and fed into the algorithm to produce cipher text.
Why Authenticate a Message?
The ability of a recipient to trust the content of a message is placed squarely on the trust of the communication
medium and the expectation that it came from the correct source.
There are several types of attacks on communications that range from imposters posing as valid participants replaying
or redelivering outdated information, to data modification in transit.
Communication technology has eliminated the basic level of interaction between individuals. For two people talking
in a room, it can be assured—to a degree—that the information from one individual has not been altered prior to
meeting the listener’s ears.
It can be also assumed that the person that is seen talking is the originator of the voice that is being heard. This
example is basic, assumed and never questioned—it is trusted.
However, the same type of communication over an alternate medium must be closely scrutinized due to the massive
numbers of vulnerabilities to which the session is exposed.
Computers have added several layers of complexity to the trusting process and the Internet has introduced some very
interesting vulnerabilities.
With a theoretically unlimited number of people on a single network, the options of attacks are similarly unlimited.
Technology Overview:
It is virtually impossible to describe message authentication without discussing encryption.
Message authentication is nothing more than a form of cryptography and in certain implementations takes advantage
of encryption algorithms.
Encryption, simply stated, is the conversion of plaintext into un-intelligible cipher text.
Typically, this is achieved with the use of a key and an algorithm. The key is combined with the plaintext and
computed with a specific algorithm.
There are two primary types of encryption keys: symmetrical and asymmetrical.
1). Symmetrical:
Symmetrical keys are used for both encryption and decryption of the same data. It is necessary for all the
communication participants to have the same key to perform the encryption and decryption.
This is also referred to as a shared secret.
2). Asymmetrical:
To further accentuate authentication by means of encryption, the technology of public key cryptography or
asymmetrical keys can be leveraged to provide message authentication and confidentiality.
A message is combined with a key and processed by an algorithm to construct cipher text. However, the key being
used in the encryption cannot be used for decryption.