Presentation is loading. Please wait.

Presentation is loading. Please wait.

Public Key Infrastructure – tell me in plain English AND THEN deep technical how PKI works Steve Lamb

Similar presentations

Presentation on theme: "Public Key Infrastructure – tell me in plain English AND THEN deep technical how PKI works Steve Lamb"— Presentation transcript:

1 Public Key Infrastructure – tell me in plain English AND THEN deep technical how PKI works Steve Lamb IT Pro Security Evangelist Microsoft Ltd

2 Objectives Demystify commonly used terminology Explain how PKI works Get you playing with PKI in the lab Make some simple recommendations

3 Agenda Foundational Concept (level 200) PKI and Signatures (level 330) Recommendations (level 310) Reference material Common Algorithms (level 360)

4 What can PKI enable? Secure – sign and/or encrypt messages Secure browsing – SSL – authentication and encryption Secure code – authenticode Secure wireless – PEAP & EAP-TLS Secure documents – Rights Management Secure networks – segmentation via IPsec Secure files – Encrypted File System(EFS)

5 Foundational Concepts

6 Encryption vs. Authentication Encrypted information cannot be automatically trusted You still need authentication Which we can implement using encryption, of course

7 Assets What we are securing? Data Services (i.e. business etc. applications or their individually accessible parts) This session is not about securing: People (sorry), cables, carpets, typewriters and computers (!?) Some assets are key assets Passwords, private keys etc…

8 Digital Security as Extension of Physical Security of Key Assets Strong Physical Security of KA Strong Digital Security Good Security Everywhere Weak Physical Security of KA Strong Digital Security Insecure Environment Strong Physical Security of KA Weak Digital Security Insecure Environment

9 Remember CP and CPS! The Certification Practice & Certification Practice Statement (CP/CPS) is a formal statement that describes who may have certificates, how certificates are generated and what they may be used for. ents/cp_cps.doc

10 Symmetric Key Cryptography Encryption The quick brown fox jumps over the lazy dog AxCv;5bmEseTfid3) fGsmWe#4^,sdgfMwi % The quick brown fox jumps over the lazy dog Decryption Plain-text input Plain-text output Cipher-text Same key (shared secret)

11 Symmetric Pros and Cons Strength: Simple and really very fast (order of 1000 to faster than asymmetric mechanisms) Super-fast (and somewhat more secure) if done in hardware (DES, Rijndael) Weakness: Must agree the key beforehand Securely pass the key to the other party

12 Public Key Cryptography Knowledge of the encryption key doesnt give you knowledge of the decryption key Receiver of information generates a pair of keys Publish the public key in a directory Then anyone can send him messages that only she can read

13 Public Key Encryption Encryption The quick brown fox jumps over the lazy dog Py75c%bn&*)9|fDe^ mdFg$5knvMdrkveg Ms The quick brown fox jumps over the lazy dog Decryption Clear-text Input Clear-text Output Cipher-text Different keys Recipients public key Recipients private key private public

14 Public Key Pros and Cons Weakness: Extremely slow Susceptible to known ciphertext attack Problem of trusting public key (see later on PKI) Strength Solves problem of passing the key Allows establishment of trust context between parties

15 Hybrid Encryption (Real World) As above, repeated for other recipients or recovery agents Digital Envelope Other recipients or agents public key (in certificate) in recovery policy Launch key for nuclear missileRedHeatis... Symmetric key encrypted asymmetrically (e.g., RSA) Digital Envelope Users public key (in certificate) RNG Randomly- Generated symmetric session key Symmetric encryption (e.g. DES) *#$fjda^ju539!3t t389E 5e%32\^kd

16 *#$fjda^ju539!3t 5e%32\^kd Launch key for nuclear missileRedHeatis... Launch key for nuclear missileRedHeatis... Symmetric decryption (e.g. DES) Digital Envelope Asymmetric decryption of session key (e.g. RSA) Symmetric session key Session key must be decrypted using the recipients private key Digital envelope contains session key encrypted using recipients public key Recipients private key Hybrid Decryption

17 PKI and Signatures

18 Public Key Distribution Problem We just solved the problem of symmetric key distribution by using public/private keys But… Scott creates a keypair (private/public) and quickly tells the world that the public key he published belongs to Bill People send confidential stuff to Bill Bill does not have the private key to read them… Scott reads Bills messages Scott reads Bills messages

19 Eureka! We need PKI to solve that problem And a few others…

20 Creating a Digital Signature Hash Function (SHA, MD5) Jrf843kjfgf* £$&Hdif*7o HDFHSD(** Py75c%bn&*)9|fDe^b mdFg$5knvMdrkveg Ms This is a really long message about Bills… Asymmetric Encryption Message or File Digital Signature 128 bits Message Digest Calculate a short message digest from even a long input using a one-way message digest function (hash) Signatorys private key private

21 Verifying a Digital Signature Jrf843kjf gf*£$&Hd if*7oUsd FHSD(** Py75c%bn&*) 9|fDe^bDFaq &nmdFg$5kn vMdrkvegMs Asymmetric decryption (e.g. RSA) Everyone has access to trusted public key of the signatory Signatorys public key Digital Signature This is a really long message about Bills… Same hash function (e.g. MD5, SHA…) Original Message Py75c%bn&*) 9|fDe^bDFaq &nmdFg$5kn vMdrkvegMs ? == ? Are They Same?

22 Word About Smartcards Some smartcards are dumb, i.e. they are only a memory chip Not recommended for storing a private key used in a challenge test (verifying identity) Anyway, they are still better than leaving keys on a floppy disk or on the hard drive Cryptographically-enabled smartcards are more expensive but they give much more security Private key is secure and used as needed Additional protection (password, biometrics) is possible Hardware implements some algorithms Self-destruct is possible

23 Recommendations Dont be scared of PKI! Set up a test environment to enable hyou to play Minimise the scope of your first implementation Read up on CP & CPS Document the purpose and operating procedures of your PKI

24 Summary Cryptography is a rich and amazingly mature field We all rely on it, everyday, with our lives Know the basics and make good choices avoiding common pitfalls Plan your PKI early Avoid very new and unknown solutions Certificate Policy Certification Practises statement

25 References Visit Read sci.crypt (incl. archives) Attend SEC499 for Encryption in Detail on Friday at in Room 1 For more detail, read: Cryptography: An Introduction, N. Smart, McGraw-Hill, ISBN Practical Cryptography, N. Ferguson & B. Schneier, Wiley, ISBN Contemporary Cryptography, R. Oppliger, Artech House, ISBN (to be published May 2005, see Applied Cryptography, B. Schneier, John Wiley & Sons, ISBN Handbook of Applied Cryptography, A.J. Menezes, CRC Press, ISBN , (free PDF) PKI, A. Nash et al., RSA Press, ISBN Foundations of Cryptography, O. Goldereich, Cryptography in C and C++, M. Welschenbach, Apress, ISBN X (includes code samples CD)

26 Community Resources Most Valuable Professional (MVP) Newsgroups Converse online with Microsoft Newsgroups, including Worldwide /newsgroups/en-us/default.aspx /newsgroups/en-us/default.aspx User Groups - Meet and learn with your peers default.mspx default.mspx

27 Copyright 2004 © Project Botticelli Ltd & Microsoft Corp. E&OE. For informational purposes only. No warranties of any kind are made and you have to verify all information before relying on it. You can re-use this presentation as long as you read, agree, and follow the guidelines described in the Comments field in File/Properties. Thanks to Rafal Lukawiecki for providing some of the content for this presentation deck – his contact details are as follows… Strategic Consultant, Project Botticelli Ltd

28 Common Algorithms

29 DES, IDEA, RC2, RC5, Twofish Symmetric DES (Data Encryption Standard) is still the most popular Keys very short: 56 bits Brute-force attack took 3.5 hours on a machine costing US$1m in Today it is done real-time Triple DES (3DES) more secure, but better options about Just say no, unless value of data is minimal IDEA (International Data Encryption Standard) Deceptively similar to DES, and not from NSA 128 bit keys RC2 & RC5 (by R. Rivest) RC2 is older and RC5 newer (1994) - similar to DES and IDEA Blowfish, Twofish B. Schneiers replacement for DES, followed by Twofish, one of the NIST competition finalists

30 Rijndael (AES) Standard replacement for DES for US government, and, probably for all of us as a result… Winner of the AES (Advanced Encryption Standard) competition run by NIST (National Institute of Standards and Technology in US) in Comes from Europe (Belgium) by Joan Daemen and Vincent Rijmen. X-files stories less likely (unlike DES). Symmetric block-cipher (128, 192 or 256 bits) with variable keys (128, 192 or 256 bits, too) Fast and a lot of good properties, such as good immunity from timing and power (electric) analysis Construction, again, deceptively similar to DES (S- boxes, XORs etc.) but really different

31 CAST and GOST CAST Canadians Carlisle Adams & Stafford Tavares 64 bit key and 64 bit of data Chose your S-boxes Seems resistant to differential & linear cryptanalysis and only way to break is brute force (but key is a bit short!) GOST Soviet Unions version of DES but with a clearer design and many more repetitions of the process 256 bit key but really 610 bits of secret, so pretty much tank quality Backdoor? Who knows…

32 Careful with Streams! Do NOT use a block cipher in a loop Use a crypto-correct technique for treating streams of data, such as CBC (Cipher Block Chaining) For developers:.NET Framework implements it as ICryptoTransform on a crypto stream with any supported algorithm

33 RC4 Symmetric Fast, streaming encryption R. Rivest in 1994 Originally secret, but published on sci.crypt Related to one-time pad, theoretically most secure But! It relies on a really good random number generator And that is the problem Nowadays, we tend to use block ciphers in modes of operation that work for streams

34 RSA, DSA, ElGamal, ECC Asymmetric Very slow and computationally expensive – need a computer Very secure Rivest, Shamir, Adleman – 1978 Popular and well researched Strength in todays inefficiency to factorise into prime numbers Some worries about key generation process in some implementations DSA (Digital Signature Algorithm) – NSA/NIST thing Only for digital signing, not for encryption Variant of Schnorr and ElGamal sig algorithm ElGamal Relies on complexity of discrete logarithms ECC (Elliptic Curve Cryptography) Really hard maths and topology Improves RSA (and others)

35 Quantum Cryptography Method for generating and passing a secret key or a random stream Not for passing the actual data, but thats irrelevant Polarisation of light (photons) can be detected only in a way that destroys the direction (basis) So if someone other than you observes it, you receive nothing useful and you know you were bugged Perfectly doable over up-to-120km dedicated long fibre-optic link Seems pretty perfect, if a bit tedious and slow Practical implementations still use AES/DES etc. for actual encryption Magiq QPN: Dont confuse it with quantum computing, which wont be with us for at least another 50 years or so, or maybe longer…

36 MD5, SHA Hash functions – not encryption at all! Goals: Not reversible: cant obtain the message from its hash Hash much shorter than original Two messages wont have the same hash MD5 (R. Rivest) 512 bits hashed into 128 Mathematical model still unknown But it resisted major attacks SHA (Secure Hash Algorithm) US standard based on MD5

37 Diffie-Hellman, SSL, Certs Methods for key generation and exchange DH is very clever since you always generate a new key- pair for each asymmetric session STS, MTI, and certs make it even safer Certs (certificates) are the most common way to exchange public keys Foundation of Public Key Infrastructure (PKI) SSL uses a protocol to exchange keys safely See later

38 Cryptanalysis Brute force Good for guessing passwords, and some 40-bit symmetric keys (in some cases needed only 27 attempts) Frequency analysis For very simple methods only (US mobiles) Linear cryptanalysis For stronger DES-like, needs 243 plain-cipher pairs Differential cryptanalysis Weaker DES-like, needs from 214 pairs Power and timing analysis Fluctuations in response times or power usage by CPU

39 Strong Systems It is always a mixture! Changes all the time… Symmetric: AES, min. 128 bits for RC2 & RC5, 3DES, IDEA, carefully analysed RC4, 256 bit better Asymmetric: RSA, ElGamal, Diffie-Hellman (for keys) with minimum 1024 bits (go for the maximum, typically 4096, if you can afford it) Hash: Either MD5 or SHA but with at least 128 bit results, 256 better

40 Weak Systems Anything with 40-bits (including 128 and 56 bit versions with the remainder fixed) Most consider DES as fairly weak algorithm CLIPPER A5 (GSM mobile phones outside US) Vigenère (US mobile phones) Dates from 1585! Unverified certs with no trust Weak certs (as in many class 1 personal certs)

Download ppt "Public Key Infrastructure – tell me in plain English AND THEN deep technical how PKI works Steve Lamb"

Similar presentations

Ads by Google