Computer Security, How Cryptography -Encryption and Decryption work, how SSL Certificates work,

1. 10/01/10 Technical presentation - Alex.C.P 1
Computer Security and Cryptography
A very simple presentation : )
Alex.C.P

2. 10/01/10 Technical presentation - Alex.C.P 2
Computer Security
Virus ?
Firewalls ?
Hacker ?

3. 10/01/10 Technical presentation - Alex.C.P 3
Computer Security
Ensuring that information is accessible only to those authorized to have access" (ISO definition excerpt)
It is the accuracy, consistency and reliability of the information content
Means that the information, the computing systems used to process the information, and the security
controls used to protect the information are all available and functioning correctly when the information is
needed.
●
Confidentiality
● Integrity
● Availability
Concerns itself with

4. 10/01/10 Technical presentation - Alex.C.P 4
The Role of Cryptography
in Computer Security
Confidentiality
Availability
Integrity
Cryptographic Techniques

5. 10/01/10 Technical presentation - Alex.C.P 5
Cryptography The Basics
A two step process
Simple? Yes!
but I am in the details

6. 10/01/10 Technical presentation - Alex.C.P 6
Cryptography History
Cryptography or cryptology; derived from Greek kryptós "hidden,"
and the verb gráfo "write" or λεγειν legein "to speak")
An ancient greek scytale
(3rd BC)
This device was used around 3rd century BC
This machine, used in World War II, uses as its base the XOR cipher
For example, the string "Wiki" (01010111 01101001 01101011 01101001 in
8-bit ASCII) can be encrypted with the key 11110011 using this method as
follows:
The German Lorenz cipher
machine (1940’s)

7. 10/01/10 Technical presentation - Alex.C.P 7
Cryptography - Types of algorithms

8. 10/01/10 Technical presentation - Alex.C.P 8
Cryptography – Secret Key Cryptography
Symmetric-key algorithms can be divided into stream ciphers and block ciphers. Stream ciphers encrypt the bits
of the message one at a time, and block ciphers take a number of bits
Popular SKC schemes
Data Encryption Standard (DES): The most common SKC scheme used today, DES was designed by IBM in the 1970s and adopted by the National Bureau of
Standards (NBS) in 1977 for commercial and unclassified government applications. DES is a block-cipher employing a 56-bit key that operates on 64-bit blocks.
Advanced Encryption Standard (AES): This is the next version of DES and is a 128-bit block cipher employing a 128-, 192-, or 256-bit key
Other schemes -Twofish, Serpent, AES (aka Rijndael), Blowfish, CAST5, RC4, TDES, and IDEA.
encrypt decrypt

9. 10/01/10 Technical presentation - Alex.C.P 9
encrypt
Cryptography – Public Key Cryptography
decrypt
PKC depends upon the existence of so-called one-way functions
•Multiplication vs. Factorization
9*16= 144 (can be calculated extremely fast)
But from 144 (2*2*2*2*3*9) it takes more time and effort to guess the correct key (9&16)
•Exponentiation vs. logarithms
3^6 (3 raised to 6) = 729
But the solution to logx 729 = y is non trivial ( note x= 3, y =6)
Note - The mathematical "trick" in PKC is to find a trap door in the one-way function so that the inverse calculation
becomes easy given knowledge of some item of information.

10. 10/01/10 Technical presentation - Alex.C.P 10
Cryptography – Public Key Cryptography Contd
Bob’s
Private
key
(9,16)
Bob’s
Public
key
(144)
Alice writes secret message to Bob & encrypts with Bob’s public
key and gives to mutual friend Dave to deliver to Bob
Curious boy Dave tries to read the letter using Bobs public key –
He can’t
Bob decrypts the letter using his private key

11. 10/01/10 Technical presentation - Alex.C.P 11
Cryptography: Ensuring Identity -Digital Signature
Bob’s
Private
key
Bob’s
Public key
Bob writes message to Alice & encrypts with Bob’s private key
Alice uses Bob’s public key to decrypt it. If it gets decrypted it
means message is from Bob

12. 10/01/10 Technical presentation - Alex.C.P 12
Role of Trust
Secure use of cryptography requires trust.
Bob ? Can
you give me
your public
key
177
Impersonator Dave tricks Alice into
believing that she has Bob Key – Read on
to see what Dave can do next --
Hi !
Hi
Bob
Hi !

Contd…
Then Dave sends a message to Alice “Hi Alice – Our Date is off, too busy – Bob”
Then Dave meets Alice and asks her for a date

13. 10/01/10 Technical presentation - Alex.C.P 13
Role of Trust
Digital Certificate
Hi , Here is
my Public
Key and my
name is
Bob can
you certify
it pls
4
Ok, Can you
prove your ID
Verisign
Certified by
Verisign
+
Verisign Private
Key
=
1
2
3 Bob Shows his Driving License

14. 10/01/10 Technical presentation - Alex.C.P 14
Cryptography against Hackers
SSL, the e-commerce trust engine
SSL does two things:
• First, it encrypts the communication between client and server, so there
is no use in tapping the line and wait for the user to type in his secret password.
But - how can the user know that the web site, which asks him to type in his secret password actually belongs to you
and isn't an imitation meant to seduce him to disclose his password?
That's where the other purpose of SSL comes into play.
• The certificate, which is installed on the server in order to enable
SSL is supposed to be signed by a neutral 3rd party who vouches for
your identity
More details at How SSL Works also see browser settings for safe browsing

15. 10/01/10 Technical presentation - Alex.C.P 15
Trust Models used by cryptographic
schemes
Public Key Certificates and Certificate Authorities
Widely used in e-commerce applications. For purposes of electronic transactions, certificates
are digital documents. The specific functions of the certificate include:
▪ Establish identity: Associate, or bind, a public key to an individual, organization, corporate position, or other entity.
▪ Assign authority: Establish what actions the holder may or may not take based upon this certificate.
▪ Secure confidential information (e.g., encrypting the session's symmetric key for data confidentiality).
Typically, a certificate contains a public key, a name, an expiration date, the name of the authority that issued the certificate
The public key is transmitted as part of a certificate. The digital certificate is used to ensure that the submitted
public key is, in fact, the public key that belongs to the submitter. The client checks that the certificate has
been digitally signed by a certification authority (CA) that the client explicitly trusts.
A CA is a trusted authority that verifies the validity of the combination of entity name and public key in a certificate.
PGP Web of Trust
Is a widely used private e-mail scheme based on public key methods. A PGP user maintains a local key ring of all their known and trusted public keys.
The user makes their own determination about the trustworthiness of a key using what is called a "web of trust.“
If Alice needs Bob's public key, Alice can ask Bob for it in another e-mail or, in many cases, download the public key from an advertised server; this
server might be a well-known PGP key repository or a site that Bob maintains himself. Alice is prepared to believe that Bob's public key, as stored at these locations, is
valid.
Kerberos
Kerberos is a commonly used authentication scheme on the Internet . Kerberos employs a client/server architecture and provides user-to-server
authentication rather than host-to-host authentication. In this model, security and authentication will be based on secret key technology where every host on the network
has its own secret key.

16. 10/01/10 Technical presentation - Alex.C.P 16
Cryptography – Enabling Confidentiality
Confidentiality is the most common use of cryptographic algorithms – protecting
data from prying eyes while in transit over an insecure communications channel
like the Internet.
Once the sender has encrypted the message with the recipient's public key no one (not even the sender) can decrypt it without
access to the recipient's private key.
Confidentiality
Popular PKA Algorithms
RSA: Invented by Ronald Rivest, Adi Shamir, and Leonard Adleman of MIT.
RSA uses a variable size encryption block and a variable size key The key-pair is derived from a very large number, n, that is the
product of two prime numbers chosen according to special rules; these primes may be 100 or more digits in length each, yielding an
n with roughly twice as many digits as the prime factors. The public key information includes n and a derivative of one of the
factors of n; an attacker cannot determine the prime factors of n (and, therefore, the private key) from this information alone and
that is what makes the RSA algorithm so secure.
Diffie-Hellman: After the RSA algorithm was published, Diffie and Hellman came up with their own
algorithm. D-H is used for secret-key key exchange only, and not for authentication or digital signatures.

17. 10/01/10 Technical presentation - Alex.C.P 17
Cryptography- Ensuring Integrity
Popular Algorithms
Message Digest (MD) algorithms:MD2, MD4, MD5 A series of byte-oriented algorithms that produce a 128-bit hash
value from an arbitrary-length message.
Secure Hash Algorithm (SHA):. SHA-1 produces a 160-bit hash value
Integrity
Ensuring Integrity is the second most common use of cryptographic algorithms – ensuring that the data
transmitted between two parties is not tampered with intentionally or unintentionally.

18. 10/01/10 Technical presentation - Alex.C.P 18
Cryptography –
Hash function Cryptography
Hash algorithms are typically used to provide a digital fingerprint of a file's contents, often used to ensure that the file has not been altered
by an intruder or virus.
Compare
Compute hash token
Bob computes token again from Msg
Send Msg + token to Bob
Compare calculated and received tokens

19. 10/01/10 Technical presentation - Alex.C.P 19
AntivirusScanner
Computer Virus & Cryptography
encryption
(xor-ing the instructions with the key)

20. 10/01/10 Technical presentation - Alex.C.P 20
Cryptography against Virus
Technology of granular execution control, backed by strong cryptographic digital signatures, will go a
long way toward increasing the security of our systems in general.
LoveLetter virus (LOVE-LETTER-FOR-YOU.vbs)
A functioning granular execution control the LoveLetter virus would not have spread, because a piece of code would not have
been allowed to send out hundreds of copies of itself in electronic mail.
Similarly, a Win32 Trojan horse arriving at a victim's system would fail to install, since a random program signed by a stranger, or not signed
at all, would not be allowed to alter the registry, or install itself in the TCP/IP stack.
Downloading programs and comparing it with the MD5 values also helps in safeguarding.

21. 10/01/10 Technical presentation - Alex.C.P 21
Wrap up of popular algorithmsIP Security Protocol (IPsec)
(Psec was first proposed for use with IP version 6 (IPv6), but can also be
employed with the current IP version, IPv4. )
This is actually a bunch of RFC’s written in order to overcome the security
limitations of IPv4
Kerberos -A secret-key encryption and authentication system, designed to
authenticate requests for network resources within a user domain rather than to
authenticate messages. Kerberos also uses a trusted third-party approach; a
client communications with the Kerberos server to obtain "credentials" so that it
may access services at the application server
uses DES to generate keys and encrypt message
Message Digest Cipher (MDC) uses a one-way hash function into a block cipher.
Pretty Good Privacy (PGP)
PGP 5.x uses Diffie-Hellman for key management and digital signatures;
IDEA, CAST, or 3DES for message encryption; and MD5 or SHA for computing
the message's hash value.
Secure Hypertext Transfer Protocol (S-HTTP)
An extension to HTTP to provide secure exchange of documents over the World
Wide Web. Supported algorithms include RSA and Kerberos for key exchange,
DES for encryption
Secure Sockets Layer (SSL) -Developed by Netscape Communications to
provide application-independent security and privacy over the Internet. SSL is
designed so that protocols such as HTTP, FTP (File Transfer Protocol), and Telnet
can operate over it transparently.
RSA is used during negotiation to exchange keys and identify the actual
cryptographic algorithm (DES, IDEA, RC2, RC4, or 3DES) to use for the session.
SSL also uses MD5 for message digests and X.509 public-key certificates.
(Found to be breakable soon after the IETF announced formation of group to
work on TLS.)
Transport Layer Security (TLS) -IETF specification (RFC 2246) intended to
replace SSL.
Employs Triple-DES (secret key cryptography), SHA (hash), Diffie-Hellman (key
exchange), and DSS (digital signatures).
X.509 TU-T recommendation for the format of certificates for the public key
infrastructure. Certificates map (bind) a user identity to a public key. The IETF
application of X.509 certificates is documented in RFC 2459.
Secure Shell or SSH is a network protocol that allows data to be exchanged over
a secure channel between two computers. Encryption provides confidentiality and
integrity of data. SSH uses public-key cryptography to authenticate the remote
computer and allow the remote computer to authenticate the user, if necessary.
Uses Diffie-Hellman key exchange and strong integrity checking via message
authentication codes. (something like a hash function)

22. 10/01/10 Technical presentation - Alex.C.P 22
References
1. An Overview of Cryptography-http://www.garykessler.net/library/crypto.html#dhmath
2. Wikipedia -http://en.wikipedia.org/wiki/Main_Page
3. Cryptography basics for infosecurity managers-http://searchsecurity.techtarget.com/tip/1,289483,sid14_gci936670,00.html
4. DAME -http://ftp.fortunaty.net/text/textfiles/virus/datut006.txt
5. Can Cryptography Prevent Computer Viruses? -http://www.research.ibm.com/antivirus/SciPapers/VB2000JFM.htm
6. The History of Computer Viruses -http://www.virus-scan-software.com/virus-scan-help/answers/the-history-of-computer-viruses.shtml
7. Linux vs. Windows Viruses -http://www.theregister.co.uk/2003/10/06/linux_vs_windows_viruses/
8. How SSL works -https://www.securetrust.com/resources/how-ssl-works
9. How SSL works - http://www.askdavetaylor.com/how_does_ssl_work.html
10. Cryptography Law Survey (in difft countries)- http://rechten.uvt.nl/koops/cryptolaw/
11. Digital Signature Law Survey -https://dsls.rechten.uvt.nl/
12. Practical Quantum Cryptography - http://www.youtube.com/watch?v=CKkqUR7FY0o&feature=related
13. Emerging Security Vulnerabilities & the Impact to Business -http://www.youtube.com/watch?v=QTfFCr4G0qA