We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byCaleb McLain
Modified over 4 years ago
Chapter 10 Encryption: A Matter of Trust
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic Algorithm Digital Signatures Major Attacks on Cryptosystems Digital Certificates Key Management Internet Security Protocols & Standards Government Regulations Encryption: Objectives
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 3 WHAT IS ENCRYPTION? Based on use of mathematical procedures to scramble data to make it extremely difficult to recover the original message Converts the data into an encoded message using a key for decoding the message Encryption: What is Encryption?
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 4 WHAT DOES ENCRYPTION SATISFY? Authentication Integrity Non-repudiation Privacy Encryption: What is Encryption?
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 5 BASIC CRYPTOGRAPHIC ALGORITHM Secret Key –The sender and recipient possess the same single key Public Key –One public anyone can know to encrypt –One private only the owner knows to decrypt –Provide message confidentiality –Prove authenticity of the message of originator Encryption: Basic Cryptographic Algorithm
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 6 COMMONLY USED CRYPTOSYSTEMS RSA Algorithm –Most commonly used but vulnerable Data Encryption Standards (DES) –Turns a message into a mess of unintelligible characters 3DES RC4 International Data Encryption Algorithm (IDEA) Encryption: Basic Cryptographic Algorithm
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 7 DIGITAL SIGNATURES Transform the message signed so that anyone who reads it can be sure of the real sender A block of data representing a private key Serve the purpose of authentication Encryption: Digital Signatures
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 8 MAJOR ATTACKS ON CRYPTOSYSTEMS Chosen-plaintext Attack Known-plaintext Attack Ciphertext-only Attack Third-party Attack Encryption: Major Attacks on Cryptosystems
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 9 DIGITAL CERTIFICATES An electronic document issued by a certificate authority (CA) to establish a merchants identity by verifying its name and public key Includes holders name, name of CA, public key for cryptographic use, duration of certificate, the certificates class & ID Encryption: Digital Certificates
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 10 CLASSES OF CERTIFICATES Class 1 –Contains minimum checks on users background –Simplest & quickest Class 2 –Checks for information e.g. names, SSN, date of birth –Requires proof of physical address, etc. Encryption: Digital Certificates
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 11 CLASSES OF CERTIFICATES (Contd) Class 3 –You need to prove exactly who you are & that you are responsible –Strongest Class 4 –Checks on things like users position in an organization in addition to class 3 requirements Encryption: Digital Certificates
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 12 KEY MANAGEMENT Key Generation & Registration Key Distribution Key Backup / Recovery Key Revocation & Destruction Encryption: Key Management
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 13 THIRD PARTY SERVICES Public Key Infrastructure –Certification Authority –Registration Authority –Directory Services Notary Services Arbitration Services Encryption: Key Management
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 14 INTERNET SECURITY PROTOCOLS & STANDARDS Web Application –Secure Socket Layer (SSL) –Secure Hypertext Transfer Protocol (S-HTTP) E-Commerce –Secure Electronic Transaction (SET) E-Mail –PGP –S/MIME Encryption: Internet Security Protocols & Standards
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 15 SSL Operates between application & transport layers Most widely used standard for online data encryption Provide services: –Server authentication –Client authentication –Encrypted SSL connection Encryption: Internet Security Protocols & Standards
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 16 S-HTTP Secures web transactions merely Provides transaction confidentiality, integrity & non-repudiation of origin Able to integrate with HTTP applications Mainly used for intranet communications Does not require digital certificates / public keys Encryption: Internet Security Protocols & Standards
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 17 SET One protocol used for handling funds transferred from credit card issuers to a merchants bank account Provides confidentiality, authentication & integrity of payment card transmissions Requires customers to have digital certificate & digital wallet Encryption: Internet Security Protocols & Standards
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 18 PGP Encrypts the data with one-time algorithm, then encrypts the key to the algorithm using public-key cryptography Supports public-key encryption, symmetric- key encryption & digital signatures Supports other standards, e.g. SSL Encryption: Internet Security Protocols & Standards
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 19 S/MIME Provides security for different data types & attachments to e-mails Two key attributes: –Digital signature –Digital envelope Performs authentication using x.509 digital certificates Encryption: Internet Security Protocols & Standards
Awad –Electronic Commerce 1/e © 2002 Prentice Hall 20 GOVERNMENT REGULATIONS National Security Agency (NSA) National Computer Security Center (NCSC) National Institute of Standards & Technology (NIST) Office of Defense Trade Controls (DTC) Encryption: Government Regulations
Chapter 10 Encryption: A Matter of Trust
What is. Digital Certificate It is an identity.
Chapter 8 Payment Systems: Getting the Money
PKI Introduction Ravi Sandhu 2 © Ravi Sandhu 2002 CRYPTOGRAPHIC TECHNOLOGY PROS AND CONS SECRET KEY SYMMETRIC KEY Faster Not scalable No digital signatures.
Public Key Infrastructure and Applications
1 ABCs of PKI TAG Presentation 18 th May 2004 Paul Butler.
Spring 2000CS 4611 Security Outline Encryption Algorithms Authentication Protocols Message Integrity Protocols Key Distribution Firewalls.
Cryptography and Network Security
7-1 Chapter 7 – Web Security Use your mentality Wake up to reality —From the song, "I've Got You under My Skin“ by Cole Porter.
Topic 8: Secure communication in mobile devices. Choice of secure communication protocols, leveraging SSL for remote authentication and using HTTPS for.
SECURITY IN E-COMMERCE VARNA FREE UNIVERSITY Prof. Teodora Bakardjieva.
By: Mr Hashem Alaidaros MIS 326 Lecture 6 Title: E-Business Security.
1 Pertemuan 12 Authentication, Encryption, Digital Payments, and Digital Money Matakuliah: M0284/Teknologi & Infrastruktur E-Business Tahun: 2005 Versi:
Chapter 9: Using and Managing Keys Security+ Guide to Network Security Fundamentals Second Edition.
Principles of Information Security, 2nd edition1 Cryptography.
Client/Server Computing Model of computing in which very powerful personal computers (clients) are connected in a network with one or more server computers.
Electronic Transaction Security (E-Commerce)
Cryptography and Network Security Chapter 17
Elias M. Awad Third Edition ELECTRONIC COMMERCE From Vision to Fulfillment 13-1© 2007 Prentice-Hall, Inc ELC 200 Day 22.
© 2018 SlidePlayer.com Inc. All rights reserved.