Chap 09 Cryptography & Encryption

Sommaire

Cryptographie

Cryptographie

Definitions

Cryptology is the science of making and breaking secret codes.

Cryptography is a way to store and transmit data so only the intended recipient can read or process it.

When enabling encryption, readable data is plaintext, or cleartext, while the encrypted version is encrypted text or ciphertext. Encryption converts the plaintext readable message to ciphertext, which is the unreadable, disguised message. Decryption reverses the process. Encryption also requires a key, which plays a critical role in encrypting and decrypting a message. The person possessing the key can decrypt the ciphertext to plaintext.

Domaines d'application

Authentification (détermination de l'identité de l'interlocuteur) Le serveur est-il réellement celui qu'il dit être? L'utilisateur est-il bien celui qu'il prétend être? Usurpation d'identité

Intégrité (l'assurance que l'information stockée ou transmise n'est pas altérée) L'information reçue est-elle identique à celle émise? Mes fichiers sont-ils corrompus? L'information est-elle fiable? Modification accidentelle ou intentionnelle de l'information hébergée ou des transactions électroniques

Confidentialité (la connaissance de l'information par un groupe restreint de personnes ou de systèmes) L'information n'est-elle connue que de l'émetteur et du récepteur? L'information stockée est-elle accessible uniquement aux personnes autorisées? Détournement de l'information, appropriation non autorisée d'informations

Autorisation (la permission de faire ou d'accéder à quelque chose) Qui peut accéder à mon ordinateur pendant mon absence? L'utilisateur distant accède-t-il uniquement aux services et informations pour lesquels il a obtenu une autorisation? Accès non autorisé à des ressources ou informations

Non répudiation (protection contre la négation d'une action accomplie) Le fournisseur de services peut-il faussement prétendre qu'il n'a pas reçu ou effectué la transaction? L'utilisateur peut-il faussement prétendre qu'il n'a pas effectué une transaction? Nier avoir passé une commande électronique ou avoir effectué un achat

Traçabilité (garder un historique des événements) Qui a fait quoi, utilisé quoi et quand? Impossibilité de reconstituer les étapes qui ont conduit à un incident

Intrusion (accès non autorisé) Comment protéger mon système personnel? Comment détecter les intrus? Comment protéger le serveur? Accès non autorisés et actions malveillantes (introduction de virus ou de mouchards, modification de contenu, blocage des accès,..), accès non souhaités (e-mail publicitaire)

Protection physique (protection contre les accidents ou sabotage) Garder l'intégrité des informations en cas de panne de courant, dégâts des eaux, incendie, ... Interruption non prévue de l'opérationnel et impossibilité de redémarrage rapide, dégâts irréversibles du matériel, de données

Gestion des procédures, des ressources humaines et machines Que doit-on faire? Qui fait quoi, qui est responsable de quoi, qui met à jour quoi? Qui peut entrer en salle machine? Pas de contrôle, manque de rigueur dans la gestion des mots de passe, des mises à jour des fichiers d'autorisation d'accès, des fichiers d'audit, de la configuration des routers et firewalls, ...

Types of Cryptography

The most common types of cryptography are block ciphers and stream ciphers. Each method differs in the way that it groups bits of data to encrypt it.

Encryption

Creating Ciphertext

Each encryption method uses a specific algorithm, called a cipher, to encrypt and decrypt messages. A cipher is a series of well-defined steps used to encrypt and decrypt messages. There are several methods of creating ciphertext:

The Symmetrical Encryption Process

Symmetric algorithms use the same pre-shared key to encrypt and decrypt data, a method also known as Secret-key encryption.

For example, Alice and Bob live in different locations and want to exchange secret messages with one another through the mail system. Alice wants to send a secret message to Bob.

Secret-key encryption uses a symmetric algorithm. As illustrated by the keys in the figure, Alice and Bob have identical keys to a single padlock. The key exchange happened prior to sending any secret messages. Alice writes a secret message and puts it in a small box that she locks using the padlock. She mails the box to Bob. The message is safe inside the box as the box makes its way through the post office system. When Bob receives the box, he uses his key to unlock the padlock and retrieve the message. Bob can use the same box and padlock to send a secret reply back to Alice.

If Bob wants to talk to Carol, he needs a new pre-shared key for that communication to keep it secret from Alice. The more people Bob wants to communicate with securely, the more keys he will need to manage.

Symmetric Encryption Algorithms

The Asymmetrical Encryption Process

Asymmetric encryption, also called public-key encryption, uses one key for encryption that is different from the key used for decryption. A criminal cannot calculate the decryption key based on knowledge of the encryption key, and vice versa, in any reasonable amount of time.

Asymmetric Encryption Algorithms

Asymmetric algorithms use formulas that anyone can look up. The pair of unrelated keys is what makes these algorithms secure. The asymmetric algorithms include:

RSA (Rivest-Shamir-Adleman) - uses the product of two very large prime numbers with an equal length of between 100 and 200 digits. Browsers use RSA to establish a secure connection.

Diffie-Hellman - provides an electronic exchange method to share the secret key. Secure protocols, such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH), and Internet Protocol Security (IPsec), use Diffie-Hellman.

ElGamal - uses the U.S. government standard for digital signatures. This algorithm is free for use because no one holds the patent.

Elliptic Curve Cryptography (ECC) - uses elliptic curves as part of the algorithm. In the U.S., the National Security Agency uses ECC for digital signature generation and key exchange.

Encryption Applications

There are many applications for both symmetric and asymmetric algorithms.

A one-time password-generating token is a hardware device that uses cryptography to generate a one-time password. A one-time password is an automatically generated numeric or alphanumeric string of characters that authenticates a user for one transaction of one session only. The number changes every 30 seconds or so. The session password appears on a display and the user enters the password.

The electronic payment industry uses 3DES. Operating systems use DES to protect user files and system data with passwords. Most encrypting file systems, such as NTFS, use AES.

• Internet Key Exchange (IKE), which is a fundamental component of IPsec Virtual Private Networks (VPNs).
• Secure Socket Layer (SSL), which is a means of implementing cryptography into a web browser.
• Secure Shell (SSH), which is a protocol that provides a secure remote access connection to network devices.
• Pretty Good Privacy (PGP), which is a computer program that provides cryptographic privacy and authentication to increase the security of email communications.

Ensuring Integrity

Hashing

What is Hashing?

Users need to know that their data remains unchanged while at rest or in transit. Hashing is a tool that ensures data integrity by taking binary data (the message) and producing a fixed-length representation called the hash value or message digest.

The hash tool uses a cryptographic hashing function to verify and ensure data integrity. It can also verify authentication. Hash functions replace clear text password or encryption keys because hash functions are one-way functions. This means that if a password is hashed with a specific hashing algorithm, it will always result in the same hash digest. It is considered one-way because with hash functions, it is computationally infeasible for two different sets of data to come up with the same hash digest or output.

Every time the data is changed or altered, the hash value also changes. Because of this, cryptographic hash values are often called digital fingerprints. They can detect duplicate data files, file version changes, and similar applications. These values guard against an accidental or intentional change to the data and accidental data corruption. Hashing is also very efficient. A large file or the content of an entire disk drive results in a hash value with the same size.

Hashing Properties

Hashing is a one-way mathematical function that is relatively easy to compute, but significantly harder to reverse. Grinding coffee is a good analogy of a one-way function. It is easy to grind coffee beans, but it is almost impossible to put all of the tiny pieces back together to rebuild the original beans.

Hashing Algorithms