Wireless PKI Shakeel Ahamad Shaik (Research Fellow) Under the supervision of Dr.V.N.Sastry, Associate Professor (IDRBT) & Dr.S.K.Udgata, Reader (UOH) Saturday, April 18, 20151Wireless PKI

Agenda Public Key Systems PKI Functions in Mobile devices Problems faced in the adoption of PKI in Mobile Environment Validation of certificate in WPKI Environment Requirements & Configurations needed for the Implementation of WPKI in mobile payments Conclusion References Saturday, April 18, 2015Wireless PKI2

Saturday, April 18, 20153Wireless PKI Public Key Systems Public Key Cryptography (PKC) Public Key Infrastructure (PKI) Personal security environment (PSE) Public-Key Systems

Saturday, April 18, 20154Wireless PKI The main components of a PKI Certification Authority (CA) is responsible for issuing and revoking certificates for customers public keys. The Registration Authority (RA) provides a binding between public keys and the entities of their holders. Repositories store and make available certificate directories and a certificate revocation list (CRL). Directory service providers. CA’s in India IDRBT, Safescrypt, NIC,TCS,MTNL,GNFC,e MudhraCA Public-Key Systems (Cont….)

Generation of key-pair (public and private keys) Receiving & Storing certificate issued by CA Digital Signature generation and verification Functions for encryption and decryption Validating third party certificates Saturday, April 18, 20155Wireless PKI PKI functions in Mobile Devices

Saturday, April 18, 20156Wireless PKI Wireless network has less bandwidth, more latency, insecure connection and device problems such as less powerful CPU, less memory size, restricted battery power, small display and input device. Mobile phone lacks computing capabilities of PKI services such as key generation, digital signature generation and verification, certificate validation, and Certificate Revocation List (CRL) verification, and memory size of storing certificate and CRL. Due to less wireless communication bandwidth, processing of CMP (Certificate Management Protocol) for certificate life cycle such as certificate issue in the mobile phone, and downloading CRL required for certificate verification must be a considerable burden. Challenges in adopting Wired PKI for Mobile Devices

Certificate Validation contains the following steps Verifying the integrity and authenticity of the certificate by verifying the digital signature of CA on the certificate. Verifying the validity period of the certificate. Accessing and examining certificate chain and CRL. The validation is considered successful if all the certificates in the certificate path (i.e. from leaf to the root of the tree) are checked and ensured that none of them have been revoked. This process is heavy on resources and time consuming and it is not suitable for mobile devices. Saturday, April 18, 20157Wireless PKI Validation of Certificate in WPKI Environment

General hierarchical structure Saturday, April 18, 2015Wireless PKI8

Saturday, April 18, 2015Wireless PKI9 Mechanisms to minimize the Certificate validation process Online Certificate Status Protocol (OCSP) Short Lived Certificate (SLC) Validation of Certificate in WPKI Environment (Cont…)

Saturday, April 18, 2015Wireless PKI10 Validation of Certificate in WPKI Environment (Cont….) 1. Sends URL of certificat e (or) Certificat e 6. Response of Certificate Validation 2. Merchant sends his X.509 Certificate 3. Delegates certificate Validation of merchant’s Certificate 4. Requests for CRL 5. Sends CRL OCSP mechanism

Short-Lived Certificate (SLC) mechanism Certificate: Data: Version: 3 (0x2) Serial Number: (0x4d336) Signature Algorithm: ecdsa-with-SHA1 Issuer: C=IN, O=IDRBT, OU=CA, CN=CertSIGNECDSA1 Validity Not Before: Apr 17 15:00: GMT Not After : Apr 26 14:59: GMT Subject: C=IN, O=SBI, OU=CA, CN=test() Subject Public Key Info: Public Key Algorithm: id-ecPublicKey df e4 6d a f3 f4 8e 80 ec ac ac f2 a3 26 b7 e e 7d 6c ba b9 3e ac 9b eb ed 6a b9 75 5c f5 c2 02 b1 Signature Algorithm: ecdsa-with-SHA1 30:2e:02:15:01:3a:07:0f:dc:e4:68:bc:c9:c1:1c:48:68:6b: 1f:99:65:0c:b5:13:55:02:15:03:65:ac:e4:82:c2:30:42:de: ce:f2:49:c5:91:30:c1:90:f3:59:72:5e Saturday, April 18, 2015Wireless PKI11 Validation of Certificate in WPKI Environment (Cont….)

Short-Lived Certificate (SLC) mechanism Improved computing & storage resources in mobile devices have made it convenient to generate key pairs & verify digital signatures on mobile devices. Using SLC mobile clients does not have to implement either CRL or OCSP for server authentication. Saturday, April 18, 2015Wireless PKI12 Validation of Certificate in WPKI Environment (Cont….)

Saturday, April 18, Wireless PKI Requirements & Configurations needed for the Implementation of WPKI in mobile payments

Saturday, April 18, Wireless PKI Requirements & Configurations needed for the Implementation of WPKI in mobile payments (Cont..)

Saturday, April 18, Wireless PKI Requirements & Configurations needed for the Implementation of WPKI in mobile payments (Cont..)

Mobile FINEID (Finnish Electronic Identity) is a mobile electronic ID for inhabitants in Finland. Based on PKI with user private keys integrated in a PKI SIM. PKI SIM cards are currently issued by two Finnish network operators. PKI SIM owner identities are verified by mobile citizen certificates issued by Finnish Population Register Center (PRC) Saturday, April 18, Wireless PKI Implementation of WPKI in Finland

Technical features of FINEID PKI SIM Contains a crypto processor and two PIN code protected private keys: They are (a) Authentication/ Encryption Key & (b) Signature key. In addition to these keys PKI SIM contains PRC ‘s certificate (i.e. CA certificate). Authentication of users and non-repudiation of payments are ensured using Finnish National PKI infrastructure, for mobile payments in Finland. PRC maintains an online certificate directory (FINEID directory). Each registered individual gets a unique Finnish Electronic User ID (FINUID). The public keys are maintained in FINEID directory with their certificates. FINEID directory also maintains a revocation list of invalid certificates. Saturday, April 18, Wireless PKI Implementation of WPKI in Finland (Cont…)

Conclusion Compared to wired PKI Wireless PKI is suitable for low end computing devices such as mobile phones. Since Mobile payments require high level of security for its transactions which can be ensured by WPKI. We suggest the existing CA to provide digital certificate to individuals through mobile phones which can be used for mobile payment transactions. Saturday, April 18, 2015Wireless PKI18

4/18/2015Security Issues in Mobile Payments19 Abbreviations CMP Certificate Management Protocol WTLS Wireless Transport Layer Security WIM Wireless Identity Module WAP Wireless Application Protocol OCSP Online Certificate Status Protocol CRL Certificate Revocation List CA Certification Authority PKI Public Key Infrastructure WPKI Wireless Public Key Infrastructure SIM Subscriber’s Identity Module BER Basic Encoding Rules DER Distinguished Encoding Rules ECC Elliptic Curve Cryptography SSL Secure Socket Layer ECDSA Elliptic Curve Digital Signature Algorithm ECDH Elliptic Curve Diffie-Hellman URL Uniform Resource Locator

4/18/2015Security Issues in Mobile Payments20 REFERENCES 1)Yong Lee, Jeail Lee, JooSeokSong, “Design and implementation of wireless PKI technology suitable for Mobile phone in Mobile Commerce” in Computer Communications 30 (2007), )Marko Hassinen, Konstantin Hypponen, Elena Trichina, “Utilizing national public- key infrastructure in mobile payment system”, Electronic Commerce Research and Applications 7 (2008), pp )Population Register Centre. FINEID-S4-1 Electronic ID Application )Antonio Ruiz-Martinez, Daniel Sanchez-Martinez, Maria martinez-Montesinos and Antonio F. Gomez-Skrmeta, “A Survey of Electronic Signature Solutions in Mobile Devices” in Journal of Theoretical and Applied Electronic Commerce Research, Vol 2, Issue 3, December 2007, pp )f Theoretical and Applied Electronic Commerce Research 4/18/201520Security Issues in Mobile Payments