1. Cryptography and the Web Lincoln Stein Whitehead Institute/MIT Center for Genome Research

2. Cryptography u The art of secret message writing. u Creating texts that can only be read by authorized individuals only.

3. Simple Cryptography   Plaintext Key Ciphertext

4. Caesar Cipher ABCDEFGHIJKLMNOPQRSTUVWXYZ NOPQRSTUVWXYZABCDEFGHIJKLM THE GOTHS COMETH rotate 13 positions FUR TAFUE PAYRFU Plaintext Key Ciphertext 13

5. ABCDEFGHIJKLMNOPQRSTUVWXYZ BCDEFGHIJKLMNOPQRSTUVWXYZA CDEFGHIJKLMNOPQRSTUVWXYZAB DEFGHIJKLMNOPQRSTUVWXYZABC EFGHIJKLMNOPQRSTUVWXYZABCD FGHIJKLMNOPQRSTUVWXYZABCDE GHIJKLMNOPQRSTUVWXYZABCDEF HIJKLMNOPQRSTUVWXYZABCD... Rotating Key Cipher SOUND THE RETREAT DEADFED VSUPC XKG UEWWEX plaintext key ciphertext

6. General Principles u Longer keys make better ciphers u Random keys make better ciphers u Good ciphers produce “random” ciphertext u Best keys are used once and thrown away

7. Symmetric (Private Key) Cryptography 8 u Examples: DES, RC4, RC5, IDEA, Skipjack u Advantages: fast, ciphertext secure u Disadvantages: must distribute key in advance, key must not be divulged

8. DES: Data Encryption Standard u Widely published & used - federal standard u Complex series of bit substitutions, permutations and recombinations u Basic DES: 56-bit keys –Crackable in about a day using specialized hardware u Triple DES: effective 112-bit key –Uncrackable by known techniques

9. Asymmetric (Public Key) Cryptography 8 8 u Examples: RSA, Diffie-Hellman, ElGamal u Advantages: public key widely distributable, does digital signatures u Disadvantages: slow, key distribution

10. RSA u Algorithm patented by RSA Data Security u Uses special properties of modular arithmetic –C = P e (mod n) –P = C d (mod n) –e, d, and n all hundreds of digits long and derived from a pair of large prime numbers u Keys lengths from 512 to 1024 bits

11. Public Key Encryption: The Frills FrillTechnique Fast encryption/decryptionDigital envelopes Authentication of senderDigital signature Verification of message integrityMessage digests Safe distribution of public keysCertifying authorities

12. Digital Envelopes 88

13. Digital Signatures 88

14. Message Digests

15. Certifying Authorities

16. Hierarchy of Trust

17. Secure, Verifiable Transmission 8

18. Public Key Cryptography on the Web u Secure Socket Layer (SSL) –Netscape Communications Corporation u Secure HTTP (SHTTP) –Commerce Net

19. SSL and SHTTP, similarities u RSA public key cryptography u MD5 message digests u Variety of private key systems –Strong cryptography for use in U.S. –Weakened cryptography for export.

20. SSL and SHTTP, differences Physical Layer Network interface Internet Transport Application SSL HTTP TELNETNNTP FTP SHTTP

21. Using SSL

22. Signed Certificate

23. Applying for a Server Certificate

24. Filling out Certificate Request

25. URLs u SSL Protocol –http://home.netscape.com/newsref/std/SSL.html u SHTTP Protocol –http://www.eit.com/projects/s-http/ u Verisign –http://www.verisign.com/ u RSA Data Security –http://www.rsa.com/