Public Key Infrastructure (PKI) Providing secure communications and authentication over an open network.

Slides:

Advertisements

Similar presentations

Chapter 10 Encryption: A Matter of Trust. Awad –Electronic Commerce 1/e © 2002 Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic Algorithm.

Advertisements

Public Key Infrastructure A Quick Look Inside PKI Technology Investigation Center 3/27/2002.

Grid Computing, B. Wilkinson, 20045a.1 Security Continued.

Public Key Infrastructure (PKI)

Cryptography Chapter 7 Part 4 Pages 833 to 874. PKI Public Key Infrastructure Framework for Public Key Cryptography and for Secret key exchange.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Public Key Management and X.509 Certificates

Chapter 14 From Cryptography and Network Security Fourth Edition written by William Stallings, and Lecture slides by Lawrie Brown, the Australian Defence.

Lecture 23 Internet Authentication Applications

Authentication Cristian Solano. Cryptography is the science of using mathematics to encrypt and decrypt data. Public Key Cryptography –Problems with key.

Public Key Infrastructure (X509 PKI)

Encryption and Firewalls Chapter 7. Learning Objectives Understand the role encryption plays in firewall architecture Know how digital certificates work.

Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography.

Lesson 12 Cryptography for E-Commerce. Approaches to Network Security Separate Security Protocol--SSL Application-Specific Security--SHTTP Security with.

Mar 12, 2002Mårten Trolin1 This lecture Diffie-Hellman key agreement Authentication Certificates Certificate Authorities SSL/TLS.

16.1 © 2004 Pearson Education, Inc. Exam Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure.

Chapter 9: Using and Managing Keys Security+ Guide to Network Security Fundamentals Second Edition.

An Introduction to Security Concepts and Public Key Infrastructure (PKI) Mary Thompson.

Introduction to PKI Seminar What is PKI? Robert Brentrup July 13, 2004.

Mar 4, 2003Mårten Trolin1 This lecture Diffie-Hellman key agreement Authentication Certificates Certificate Authorities.

Symmetric Key Distribution Protocol with Hybrid Crypto Systems Tony Nguyen.

CN1276 Server Kemtis Kunanuraksapong MSIS with Distinction MCTS, MCDST, MCP, A+

CERTIFICATES “a document containing a certified statement, especially as to the truth of something ”

Copyright, 1996 © Dale Carnegie & Associates, Inc. Digital Certificates Presented by Sunit Chauhan.

Copyright © Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE CSci530: Computer Security Systems Authentication.

03 December 2003 Public Key Infrastructure and Authentication Mark Norman DCOCE Oxford University Computing Services.

Introduction to Public Key Infrastructure (PKI) Office of Information Security The University of Texas at Brownsville & Texas Southmost College.

Security Management.

1 Authentication Protocols Celia Li Computer Science and Engineering York University.

Digital Signature Xiaoyan Guo/ Xiaohang Luo/

Controller of Certifying Authorities PKI Technology - Role of CCA Assistant Controller (Technology) Controller of Certifying Authorities Ministry of Communications.

INTRODUCTION Why Signatures? A uthenticates who created a document Adds formality and finality In many cases, required by law or rule Digital Signatures.

Controller of Certifying Authorities Public Key Infrastructure for Digital Signatures under the IT Act, 2000 : Framework & status Mrs Debjani Nag Deputy.

Public Key Infrastructure Ammar Hasayen ….

Digital Certificates. What is a Digital Certificate? A digital certificate is the equivalent of your business card in the e-commerce world. It says who.

Digital Certificates Public Key Deception Digital Certificates Certificate Authorities Public Key Infrastructures (PKIs)

Wolfgang Schneider NSI: A Client-Server-Model for PKI Services.

Deploying a Certification Authority for Networks Security Prof. Dr. VICTOR-VALERIU PATRICIU Cdor.Prof. Dr. AUREL SERB Computer Engineering Department Military.

Digital Certificates With Chuck Easttom. Digital Signatures  Digital Signature is usually the encryption of a message or message digest with the sender's.

Lecture 12 Electronic Business (MGT-485). Recap – Lecture 11 E-Commerce Security Environment Security Threats in E-commerce Technology Solutions.

Chapter 14 Encryption: A Matter Of Trust. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond,

Introduction to Secure Messaging The Open Group Messaging Forum April 30, 2003.

E-Commerce Security Technologies : Theft of credit card numbers Denial of service attacks (System not availability ) Consumer privacy (Confidentiality.

Chapter 9: Using and Managing Keys Security+ Guide to Network Security Fundamentals Second Edition.

Public Key Infrastructure (X509 PKI) Presented by : Ali Fanian.

Protecting Internet Communications: Encryption  Encryption: Process of transforming plain text or data into cipher text that cannot be read by anyone.

E-Commerce Security Professor: Morteza Anvari Student: Xiaoli Li Student ID: March 10, 2001.

Configuring Directory Certificate Services Lesson 13.

Cryptography Chapter 14. Learning Objectives Understand the basics of algorithms and how they are used in modern cryptography Identify the differences.

Chapter 23 Internet Authentication Applications Kerberos Overview Initially developed at MIT Software utility available in both the public domain and.

Certificate-Based Operations. Module Objectives By the end of this module participants will be able to: Define how cryptography is used to secure information.

06 APPLYING CRYPTOGRAPHY

Module 9: Fundamentals of Securing Network Communication.

Secure Messaging Workshop The Open Group Messaging Forum February 6, 2003.

Introduction to Public Key Infrastructure January 2004 CSG Meeting Jim Jokl.

NDSU Lunchbytes "Are They Really Who They Say They Are?" Digital or Electronic Signature Information Rick Johnson, Theresa Semmens, Lorna Olsen April 24,

Public Key Infrastructure (X509 PKI) Presented by : Ali Fanian

ELECTROINC COMMERCE TOOLS Chapter 6. Outline 6.0 Introduction 6.1 PUBLIC KEY INFRASTRUCTURE (PKI) AND CERTIFICATE AUTHORITIES (CAs) TRUST

Who’s watching your network The Certificate Authority In a Public Key Infrastructure, the CA component is responsible for issuing certificates. A certificate.

Traditional Security Issues Confidentiality –Prevent unauthorized access or reading of information Integrity –Insure that writing or operations are allowed.

Security fundamentals Topic 5 Using a Public Key Infrastructure.

Key Management. Authentication Using Public-Key Cryptography  K A +, K B + : public keys Alice Bob K B + (A, R A ) 1 2 K A + (R A, R B,K A,B ) 3 K A,B.

Key management issues in PGP

Information Security message M one-way hash fingerprint f = H(M)

IS3230 Access Security Unit 9 PKI and Encryption

Information Security message M one-way hash fingerprint f = H(M)

Information Security message M one-way hash fingerprint f = H(M)

Information Security message M one-way hash fingerprint f = H(M)

Presentation transcript:

Public Key Infrastructure (PKI) Providing secure communications and authentication over an open network.

Topics Understanding the technology –Cryptography, Digital Signatures, Third Party Trust, and Public Key Certificates. Public Key Infrastructure –Definitions, Components, Infrastructure, Processes, and Issues. Western’s PKI

Cryptography Methods 2 Types of Cryptography being used. –Symmetric Key (shared secret) Cryptography –Public Key Cryptography Each has a role in a Public Key Infrastructure.

Symmetric Key Cryptography 1 Key known by both parties (shared) A message encrypted by the key can only be decrypted using the same key. Issue: Hard to share the key securely. HelloIjfd82*7dfHello

Public Key Cryptography 2 keys generated. 1 private, 1 public. A message encrypted by 1 key can only be decrypted by the other. Public keys are stored in a public repository and are freely available. Private keys are stored on local system protected by a password. Never transmitted over the network. Hello9klfms83fHello ByeJf#f9j3f92Bye PrivatePublic

Public key Cryptography 2 way encrypted communication possible using 2 sets of public keys. Issue: Large resources required. Hello9klfms83fHello ByeJf#f9j3f92Bye Party A’s Public Party B’s Private Party A’s Private Party B’s Public Party A Party B

Their roles in PKI Public keys are used to securely transmit a symmetric session key. The symmetric key is used to setup secure encrypted communications. Party B’s Private Party B’s Public Party A Party B HelloIjfd82*7dfHello Step 1: Party A creates symmetric key and transmits it to Party B using their public key. Step 2: Secure communications setup using the symmetric key.

Digital Signature Private keys can be used to sign a document. The public key is used to decrypt the signature which verifies that the message came from the person who owns the private key. Issue: How does party B verify Party’s A Public Key. Party A’s Public Party A’s Private Party A Party B Hello Bob signed Jonny Hello Bob signed dfjlf9#fsi Hello Bob signed Jonny

Trusted Third Party A trusted third party is someone both communicating parties trusts. This party authenticates Party A using older style methods (ID Card) and verifies they own the private key. This party then uses its own private key to digitally sign party A’s public key. Since party B trusts the public key of the third party, when it decrypts the signature on party A’s Public key it can then trust A’s public key. Signed public keys can be used for authentication.

Public Key Certificate (PKC) A public key certificate is a document that: –Contains the public key of its owner. –Contains a set of attributes that identifies its owner –Is digitally signed by a trusted third party called a Certificate Authority (CA). –Has an life span (expiry date). Certificates are stored in public repositories. Used to authenticate, setup secure communications and trust a digital signature.

Public Key Infrastructure (PKI) Defined by the IETF PKIX Working Group as: “The set of hardware, software, people, policies and procedures needed to create, manage, store, distribute, and revoke public key certificates based on public key cryptography.”

PKI Component Definitions Certificate Authority (CA) : An authority trusted to create and assign public key certificates. Required to validate user information and verify they own the private key. Required to maintain CRLs. Registration Authority (RA) : An optional authority that can act on behalf of a CA to validate user information and verify they own the private key. Repository : A data base or directory used to store and distribute Public Key Certificates and CRLs. Certificate Revocation Lists (CRL) : A list of certificates that have been revoked due to their owners breaking one of the rules in the certificate policy or by having its private key compromised. Certificate Policy (CP) : A set of rules which indicates how a certificate is to be used by a community of users or set of applications. Certificate Practice Statement (CPS) : A set of guidelines a CA follows when issuing certificates.

Governed by Certificate Practice Statement. Governed by Certificate Policy. The Infrastructure Repository for PKCs and CRLs Certificate Authority Registration Authority User Application or Server Certificate and revocation list storage. Certificate and revocation list retrieval. Certificate requests Authentication and Secure communication Registration process

Certificate use. During setup of connection between a server and user: –Certificates are withdrawn from the repository for both parties. –Digital signatures are decrypted using the CA’s public key. –The Certificate revocation list for the signing CA is referenced to verify that the certificate has not been revoked. –If all passes then authentication of the server and user has been accomplished (i.e. each trusts that the private key is owned by the person identified in the certificate). Secure communications are then setup by the user generating a symmetric session key and transmitting it to the server using the servers public key to encrypt it. Once the server has decrypted the session key using its private key a secure socket is setup using the session key.

The Repository(LDAP) A Repository: –Requires an efficient directory capable of authentication, replication and redundancy –should be capable of storing more data than just certificates and must be capable of complicated searches LDAP provides all the requirements plus: –can use Public Keys during its authentication –is being integrated into many other technologies –Has a good set of standard APIs

Issues with PKI Certificate Revocation is still in its infancy. Trust –Do we trust the commercial CAs out there. Why do we trust them to authenticate information they are not the authority of. –How do we trust repositories. Non PKI security holes –How secure are clients, CAs, and repository systems from hackers and virus attacks. Are they physically secure. –How well guarded are private keys. Is the data in the certificate being check thoroughly. The idea of Non-Repudiation. Roaming Access (Smart Cards)

Western’s PKI Western currently has an agreement with Thawte Certification (owned by VeriSign) to provided signed certificates and be our Certificate Authority (CA). A representative of ITS acts as a Registration authority (RA) on behalf of Thawte Certification. Currently only Secure Socket Layer (SSL) certificates are in use to provide encrypted web communications (Authentication of web server only). Thawte offers other types of certificates but they have not been investigates for use at Western yet and may be cost prohibitive to use.

Western’s PKI Repository for PKCs and CRLs SSL Certificates are stored in the web server and distributed by the web server. CA: Thawte Certification RA: ITS Representative UWO web user. Web Server 5. User generates session key and transmits it to web server using public key. A secure socket is then setup. (SSL) 1.Web server admin generates and send a certificate request to Thawte. 4. Thawte signs certificate and returns it to the web server admin who loads it into web serer configuration. 2. Thawte asks ITS if request is good. 3. ITS Verifies request and say yes.