Elias M. Awad Third Edition ELECTRONIC COMMERCE From Vision to Fulfillment 13-1© 2007 Prentice-Hall, Inc ELC 200 Day 23

13-2 © 2007 Prentice-Hall, Inc End of days? (subject to change) Dec 6 –Chap 14 Encryption –Student Course Evaluations –Assignment 9 posted –CyberProtect Simulation Dec 10 –Chap 15 Getting the Money Dec 13 –Quiz 4 –Optional assignment 9 due Dec 18 (Tuesday) –10 AM eCommerce frameworks due –Student presentations 5 Mins each

13-3 © 2007 Prentice-Hall, Inc Agenda Assignment 8 not corrected yet Assignment 9 Posted –Due Dec 13 –Optional  replace lowest assignment grade. Ecommerce Initiative Frameworks –GuidelinesGuidelines –Due DEC 10 AM Student Course Evaluations Discussion on Encryption CyberProtect Simulation

Elias M. Awad Third Edition ELECTRONIC COMMERCE From Vision to Fulfillment 13-4© 2007 Prentice-Hall, Inc Encryption: A Matter of Trust

13-5 © 2007 Prentice-Hall, Inc Crypto, Digital Signature and Digital Certificates Cryptography provides security by using encryption –Ensures privacy Digital Signatures are just like a real signature –DCMA makes them just as legally binding as a signed paper document Digital Certificates uses Cryptographic techniques to prove Identity

13-6 © 2007 Prentice-Hall, Inc Digital Signature Sender Receiver DSPlaintext Add Digital Signature to Each Message Provides Message-by-Message Authentication Encrypted for Confidentiality

13-7 © 2007 Prentice-Hall, Inc Digital Signature: Sender DS Plaintext MD Hash Sign (Encrypt) MD with Sender’s Private Key To Create the Digital Signature: 1.Hash the plaintext to create a brief message digest; This is NOT the digital signature 2. Sign (encrypt) the message digest with the sender’s private key to create the digital Signature

13-8 © 2007 Prentice-Hall, Inc Digital Signature Sender Encrypts Receiver Decrypts Send Plaintext plus Digital Signature Encrypted with Symmetric Session Key DSPlaintext Transmission

13-9 © 2007 Prentice-Hall, Inc Digital Signature: Receiver DSReceived Plaintext MD 1. Hash 2. Decrypt with True Party’s Public Key 3. Are they Equal? 1. Hash the received plaintext with the same hashing algorithm the sender used. This gives the message digest 2. Decrypt the digital signature with the sender’s public key. This also should give the message digest. 3. If the two match, the message is authenticated; The sender has the true Party’s private key

13-10 © 2007 Prentice-Hall, Inc Public Key Deception Impostor “I am the True Person.” “Here is TP’s public key.” (Sends Impostor’s public key) “Here is authentication based on TP’s private key.” (Really Impostor’s private key) Decryption of message from Verifier encrypted with Impostor’s public key, so Impostor can decrypt it Verifier Must authenticate True Person. Believes now has TP’s public key Believes True Person is authenticated based on Impostor’s public key “True Person, here is a message encrypted with your public key.” Critical Deception

13-11 © 2007 Prentice-Hall, Inc Digital Certificates Digital certificates are electronic documents that give the true party’s name and public key Applicants claiming to be the true party have their authentication methods tested by this public key If they are not the true party, they cannot use the true party’s private key and so will not be authenticated Digital certificates follow the X.509 Standard

13-12 © 2007 Prentice-Hall, Inc Digital Signatures and Digital Certificates Public key authentication requires both a digital signature and a digital certificate to give the public key needed to test the digital signature DSPlaintext Applicant Verifier Certificate Authority Digital Certificate: True Party’s Public Key

13-13 © 2007 Prentice-Hall, Inc Four Classes of Digital Certificates Class 1 certificates contain minimum checks on the user’s background Class 2 certificates check for information like real name, Social Security number, and the date of birth Class 3 certificates are the strongest type Class 4 certificates are the most thorough

13-14 © 2007 Prentice-Hall, Inc Managing Cryptographic Keys Key management is the process of making keys known to the systems that need them and making sure keys are protected against disclosure or substitution Key Life Cycle –Key generation and registration –Key distribution –Key backup and recovery Key escrow : location where keys held in trust by a third party reside – Notary service : company that provides encryption- oriented services including key escrow, key recovery, time stamping, trusted intermediary, and archiving –Key revocation and destruction

13-15 © 2007 Prentice-Hall, Inc Third-Party Services Certificate authority verifies certificates intended for use by other distinct legal entities Certificate policy is a set of rules that identifies how, when, and for what reasons certificates are used within the assigned organization Directory service is a repository that distributes certificates as requested by message originators

13-16 © 2007 Prentice-Hall, Inc Internet Security Protocols Two key protocols for secure World Wide Web transactions are: –Secure Socket Layer (SSL) is a protocol for secure Web transactions, secures data packets at the network layer –Secure HTTP (S-HTTP) is a protocol that secures Web transactions and nothing else Secure Electronic Transaction (SET) is a protocol used for handling funds transfers from credit card issuers to a merchant’s bank account –A digital certificate customers can request from their issuing bank by filling out a form on the bank’s Web site –A digital wallet is an online shopping device that seals personal information in a free plug-in that can be invoked when making a purchase

13-17 © 2007 Prentice-Hall, Inc Secure Pretty Good Privacy (PGP) is a protocol that encrypts the data with a one-time algorithm and then encrypts the key to the algorithm using public-key cryptography – – S/MIME (Multipurpose Internet Mail Extension) is a powerful protocol that provides security for different data types and attachments to s Message Security Protocol (MSP) is a protocol that secures attachments across multiple platforms

13-18 © 2007 Prentice-Hall, Inc Implications for E-Commerce Developing high-powered and reliable encryption methods is a top priority for many organizations Most encryption systems have prevention as the sole means of defense Merchants face a number of choices when considering encryption methods A major concern is the cost associated with different encryption methods Government regulations present considerable problems for businesses