1. Cryptography is used to provide security in electronic commerce by ensuring privacy, authenticity, and preventing forgery, alteration, eavesdropping and tracing of messages.
2. There are two main types of cryptography - symmetric which uses the same key for encryption and decryption, and asymmetric (public key) which uses different keys for encryption and decryption.
3. Common symmetric algorithms are DES and AES while RSA is an example of an asymmetric algorithm commonly used for digital signatures and encryption.
Computer Security : Introduction, Need for security, Principles of Security,
Types of Attacks
Cryptography : Plain text and Cipher Text, Substitution techniques, Caesar
Cipher, Mono-alphabetic Cipher, Polygram, Polyalphabetic Substitution,
Playfair, Hill Cipher, Transposition techniques, Encryption and Decryption,
Symmetric and Asymmetric Key Cryptography, Steganography, Key Range and
Key Size,
Possible Types of Attacks
Symmetric Key Algorithms and AES: Algorithms types and modes, Overview
of Symmetric key Cryptography, Data Encryption Standard (DES), International
Data Encryption Algorithm (IDEA), RC4, RC5, Blowfish, Advanced Encryption
Standard (AES)
Asymmetric Key Algorithms, Digital Signatures and RSA: Brief history of
Asymmetric Key Cryptography, Overview of Asymmetric Key Cryptography,
RSA algorithm, Symmetric and Asymmetric key cryptography together, Digital
Signatures, Knapsack Algorithm, Some other algorithms (Elliptic curve
cryptography, ElGamal, problems with the public key exchange)
This preentation is about -
Inbound SSL,
SSL Configuration object,
Outbound SSL,
Monitoring Certificate Expiry,
For more details visit -
http://vibranttechnologies.co.in/websphere-classes-in-mumbai.html
Security+ Guide to Network Security Fundamentals, 3rd Edition, by Mark Ciampa
Knowledge and skills required for Network Administrators and Information Technology professionals to be aware of security vulnerabilities, to implement security measures, to analyze an existing network environment in consideration of known security threats or risks, to defend against attacks or viruses, and to ensure data privacy and integrity. Terminology and procedures for implementation and configuration of security, including access control, authorization, encryption, packet filters, firewalls, and Virtual Private Networks (VPNs).
CNIT 120: Network Security
http://samsclass.info/120/120_S09.shtml#lecture
Policy: http://samsclass.info/policy_use.htm
Many thanks to Sam Bowne for allowing to publish these presentations.
In cryptography, a cryptosystem is called a threshold cryptosystem.
If in order to decrypt an encrypted message or to sign a message
several parties must cooperate in the decryption
The OSI security architecture
Threats
Obtaining a user’s certificate
Electronic mail security
PGP operation confidentiality
PGP operation mail compatibility
PGP message format
Domain keys identification mail
Explain security issues and protection about unwanted threat in E-Commerce. Explain Security E-Commerce Environment. Security Threat in E-Commerce Environment.
This presentation covers:
What is Digital Signature ?
How does digital signature work?
Advantages and Shortcomings of Digital Signatures
What is e-Commerce
How does e-commerce work?
Advantages and Disadvantages of e-commerce
Computer Security : Introduction, Need for security, Principles of Security,
Types of Attacks
Cryptography : Plain text and Cipher Text, Substitution techniques, Caesar
Cipher, Mono-alphabetic Cipher, Polygram, Polyalphabetic Substitution,
Playfair, Hill Cipher, Transposition techniques, Encryption and Decryption,
Symmetric and Asymmetric Key Cryptography, Steganography, Key Range and
Key Size,
Possible Types of Attacks
Symmetric Key Algorithms and AES: Algorithms types and modes, Overview
of Symmetric key Cryptography, Data Encryption Standard (DES), International
Data Encryption Algorithm (IDEA), RC4, RC5, Blowfish, Advanced Encryption
Standard (AES)
Asymmetric Key Algorithms, Digital Signatures and RSA: Brief history of
Asymmetric Key Cryptography, Overview of Asymmetric Key Cryptography,
RSA algorithm, Symmetric and Asymmetric key cryptography together, Digital
Signatures, Knapsack Algorithm, Some other algorithms (Elliptic curve
cryptography, ElGamal, problems with the public key exchange)
This preentation is about -
Inbound SSL,
SSL Configuration object,
Outbound SSL,
Monitoring Certificate Expiry,
For more details visit -
http://vibranttechnologies.co.in/websphere-classes-in-mumbai.html
Security+ Guide to Network Security Fundamentals, 3rd Edition, by Mark Ciampa
Knowledge and skills required for Network Administrators and Information Technology professionals to be aware of security vulnerabilities, to implement security measures, to analyze an existing network environment in consideration of known security threats or risks, to defend against attacks or viruses, and to ensure data privacy and integrity. Terminology and procedures for implementation and configuration of security, including access control, authorization, encryption, packet filters, firewalls, and Virtual Private Networks (VPNs).
CNIT 120: Network Security
http://samsclass.info/120/120_S09.shtml#lecture
Policy: http://samsclass.info/policy_use.htm
Many thanks to Sam Bowne for allowing to publish these presentations.
In cryptography, a cryptosystem is called a threshold cryptosystem.
If in order to decrypt an encrypted message or to sign a message
several parties must cooperate in the decryption
The OSI security architecture
Threats
Obtaining a user’s certificate
Electronic mail security
PGP operation confidentiality
PGP operation mail compatibility
PGP message format
Domain keys identification mail
Explain security issues and protection about unwanted threat in E-Commerce. Explain Security E-Commerce Environment. Security Threat in E-Commerce Environment.
This presentation covers:
What is Digital Signature ?
How does digital signature work?
Advantages and Shortcomings of Digital Signatures
What is e-Commerce
How does e-commerce work?
Advantages and Disadvantages of e-commerce
Supervision training for volunteers and novis supervisorsImke WoodT&C
Mostly visual backdrop to define best practise Clinical Supervision for novises in the filed, peer supervision, new supervisees, rethinking best practise in clinical supervision. This applied tyraining in a youth charity.
Penguatan Etika Publik: Innovating Ethics in Public AdministrationTri Widodo W. UTOMO
Dr. Tri Widodo W. Utomo, SH.,MA
Deputi Inovasi Administrasi Negara LAN-RI
http://inovasi.lan.go.id
Disampaikan pada Diskusi Publik Etika Pejabat Publik
Lembaga Administrasi Negara RI
Jakarta, 16 Desember 2015
Encryption is a fundamental concept in cryptography that involves the process of converting plaintext (readable and understandable data) into ciphertext (encoded and unintelligible data) using a mathematical algorithm and an encryption key. The primary purpose of encryption is to ensure the confidentiality and privacy of sensitive information during transmission or storage.
In the encryption process:
1. **Plaintext:** This is the original, readable data that is to be protected. It could be a message, a file, or any form of digital information.
2. **Encryption Algorithm:** An encryption algorithm is a set of mathematical rules and procedures that transform the plaintext into ciphertext. Common encryption algorithms include Advanced Encryption Standard (AES), RSA, and Triple DES.
3. **Encryption Key:** The encryption key is a piece of information used by the encryption algorithm to perform the transformation. The key determines the specific pattern and method by which the plaintext is converted into ciphertext. The strength of the encryption often depends on the length and randomness of the key.
4. **Ciphertext:** This is the result of the encryption process—the transformed and encoded data that appears random and is indecipherable without the corresponding decryption key.
Encryption serves several important purposes in the field of cryptography:
- **Confidentiality:** The primary goal of encryption is to keep information confidential and secure from unauthorized access. Even if an unauthorized party intercepts the ciphertext, they should be unable to understand or decipher it without the correct decryption key.
- **Integrity:** Encryption helps ensure the integrity of data by providing a means to detect any unauthorized modifications. If the ciphertext is altered, the decryption process will produce incorrect results, alerting the recipient to potential tampering.
- **Authentication:** In some encryption scenarios, the use of digital signatures or authenticated encryption helps verify the origin and authenticity of the encrypted data.
- **Secure Communication:** Encryption is widely used to secure communication over networks, such as the internet. Protocols like HTTPS (HTTP Secure) use encryption to protect the confidentiality of data transmitted between a web browser and a web server.
- **Data-at-Rest Protection:** Encryption is applied to data stored on devices or servers, ensuring that even if physical access is gained, the data remains protected from unauthorized viewing.
In summary, encryption is a crucial tool in the field of cryptography, providing a means to safeguard the confidentiality, integrity, and authenticity of sensitive information in various digital environments.
International Refereed Journal of Engineering and Science (IRJES)irjes
International Refereed Journal of Engineering and Science (IRJES) is a leading international journal for publication of new ideas, the state of the art research results and fundamental advances in all aspects of Engineering and Science. IRJES is a open access, peer reviewed international journal with a primary objective to provide the academic community and industry for the submission of half of original research and applications
The ability to conceal the contents of sensitive messages and to verify the contents of messages and the identities of their senders have the potential to be useful in all areas of business
This presentation is about -
Inbound SSL,
SSL Configuration object,
Outbound SSL,
Monitoring Certificate Expiry,
For more details visit -
http://vibranttechnologies.co.in/websphere-classes-in-mumbai.html
This paper analyzes vulnerabilities of the SSL/TLS
Handshake
protocol
, which
is
responsible
for
authentication of
the parties in the
communication
and
negotiation of
security parameters
that
will be used
to protect
confidentiality and
integrity of the
data
. It
will
be
analyzed the
attacks
against the implementation of Handshake
protocol, as well as the
attacks against the other
elements
necessary to SSL/TLS protocol to discover security
flaws that were exploited, modes of
attack, the potential consequences, but also studyi
ng methods of defense
.
All versions of the
protocol are going to be the subject of the researc
h but
emphasis will be placed
on the critical
attack that
the most endanger the safety of data.
The goal of
the research
is
to point out the
danger of
existence
of at least
vulnerability
in the SSL/TLS protocol
, which
can be exploited
and
endanger the safety of
the data
that should be protected.
This paper analyzes vulnerabilities of the SSL/TLS Handshake protocol, which is responsible for authentication of the parties in the communication and negotiation of security parameters that will be used to protect confidentiality and integrity of the data. It will be analyzed the attacks against the implementation of Handshake protocol, as well as the attacks against the other
elements necessary to SSL/TLS protocol to discover security flaws that were exploited, modes of
attack, the potential consequences, but also studying methods of defense. All versions of the
protocol are going to be the subject of the research but emphasis will be placed on the critical attack that the most endanger the safety of data. The goal of the research is to point out the
danger of existence of at least vulnerability in the SSL/TLS protocol, which can be exploited and endanger the safety of the data that should be protected.
10. Type Method Symmetric Stream cipher a string of data to continuously receive the encrypted Stream advantages: Diffusion Immunity insertations & modifications Stream disadvantages.: Slow encryption Error propagation
11. Type Method Symmetric Block cipher Into every block of data to which the blocks are individually password Block advantages: Speed of transformation Low error propagation Block disadvantages.: Low diffusion Malicious insertations & modifications possible
13. Data Encryption Standard (DES) Released by NBS in 1976, based on ‘Lucifer’ Combination of substitution and transposition 16 iterations with 56-bit key (64) Based on diffusion and confusion (Shannon) Supported then adopted by NSA Can be broken (in 22 hours, parallel attack) Key length dilemma, new algorithm to be AES
14. Data Encryption Standard (DES) Firstly the IP (explained below) is applied to the 64 bit plaintext. The result is then divided into two 32 bit halves, named L0 and R0. Then, the following happens 16 times: Key transformation number i (a permutation, but dropping 8 bits off - defined in the specification) is applied to the key to produce 48 bits. Apply the function f(Ri,Ki+1) (explained below) to produce a 32 bit output. Exclusive OR Li and f(Ri,Ki+1), and call this Ri+1. Make Li+1 = Ri
16. RSA Encryption 1978. By Rivest-Shamir-Adelman ) is a popular asymmetric key encryption standard. Difficulty of determinating prime factors It is based on number theory (more specifically the difficulty in factorizing a large number). The key size ranges between 512 and 2048 bits. It is used in many e-commerce applications such as the Secure Electronic Transaction (SET) protocol for credit card payment.
17. RSA Encryption Picks two large prime numbers p and q Multiplies p and q to obtain n Chooses d, such that d and w=(p-1)(q-1)are relatively prime (no common factor). Chooses e such that 1 = d x e mod w Public key is: <e, n> Private key is: <d, n> Message code m, secret code c c = memod n m = cd mod n
18. Public Key Only the decryption key is kept secret. The encryption key is made public. Each user has two keys, one secret and one public. Public keys are maintained in a public directory. To send a message M to user B, encrypt using the public key of B. B decrypts using his secret key. Signing Messages For a user Y to send a signed message M to user X. Y encrypts M using his secret key. X decrypts the message using Y’s public key.
20. Public Key Infrastructure(PKI) A set of technologies and procedures to enable electronic authentication Uses public key cryptography and digital certificates Certificate life-cycle management
21. Public Key Infrastructure(PKI) Many products from many vendors are available for certificate issuance and some management functions Interoperability is a big issue -- especially when it comes to policies Enabling the use of PKI in applications is limited today Building and managing policies is the least understood issue
22. Public Key Infrastructure(PKI) Authentication and registration of certificate applicants System administration and access to signing keys Application use and interfacing Trust between hierarchies Trust decisions to be made at different points within the application need different views Certificate fields, authorization and allowed use is really the hardest issue Authorization policies for management of CAs and RAs
27. Trojan horse A Trojan horse, or Trojan, is that appears to perform a desirable function for the user prior to run or install but instead facilitates unauthorized access of the user's computer system
28. computer worm a computer worm is a self-replicating. It uses a computer network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, even if only by consuming bandwith, whereas viruses almost always corrupt or modify files on a targeted computer
29. Firewalls A firewall is a barrier placed between the private network and the outside world. All incoming and outgoing traffic must pass through it. Can be used to separate address domains. Control network traffic. Cost: ranges from no-cost (available on the Internet) to $ 100,000 hardware/software system. Types: Router-Based Host Based Circuit Gateways
33. Secure Protocols How to communicate securely: SSL – “the web security protocols” IPSEC – “the IP layer security protocol” SMIME – “the email security protocol” SET – “credit card transaction security protocol” S-HTTP – “Secure Hypertext Transfer Protocol” Others …
42. SET SET standard two companies by VISA, Master card with the aim of ensuring security in the credit transaction year 1997 was introduced Privacy information: credit card numbers of buyers see the seller remains hidden (using DES) Cardholder authentication: digital signatures with certificates X.509v3 Authentication vendor: Digital signature certificate X.509v3
43. Goal SET Maintain confidentiality and purchase order payment information Owner authentication Azaynrvkh cardholder authentication of a legitimate user is using a credit card account Maintain the integrity of data transferred kidney Ensure the safety of data transferred all Seller to provide authentication for the transaction Ensure the best security techniques and systems designed to protect all existing laws on electronic commerce transactions
45. S-HTTP Security on application layer Protection mechanism: Digital Signature Message authentication Message encryption Support private & public key cryptograph Enhanced HTTP data exchange
46. S-HTTP Operate on application layer Encryption and digital signature Work only with (HTTP) Application dependant More secure than SSL at end point even after data transfer No particular cryptographic system Multiple times encryption
47. Electronic Mail Security E-mail is the most widely used application in the Internet. Who wants to read your mail ? Business competitors Reporters,Criminals Friends and Family Two approaches are used: PGP: Pretty Good Privacy PEM: Privacy-Enhanced Mail
49. E-mail Security(PEM) A draft Internet Standard (1993). Used with SMTP. Implemented at application layer. Provides: Disclosure protection Originator authenticity Message integrity
52. Agents participating in a Transaction Financial Audit Institute (Acquirer): A financial institution required with the following tasks: Open an Account for Sellers Ceiling set and enabled them credit cards Deposit amount received by the card vendor account Payment Gateway (Payment Gateway): processing messages and vendor payments by the Acquirer or the third person Reference Certification (CA): X509 certificate issuer for cards owners, sellers, and payment gateway
53. Payment Gatway Verify all certificates Decrypt the digital license to obtain and decrypt the symmetric key block Verify the sign vendor Decrypt digital pay to obtain and decrypt the symmetric key block Verify the signature block double payment Requested and received permission Sender