Authenticantion Digital Signatures

Authenticantion Digital Signatures

1. Authentication

   • This is used to make sure data has come from a trusted source. You can use passwords for this but also biometrics
     • Additional Checks?
       • PIN
         • date last logged in
           • memorable word/phrase
             • memorable personal data - e.g. mothers name
               • date of birth
                 • email address
                   • recent activities
                     • telephone number
                       • customer number
                         • account number

2. Digital Signatures

   • User A sends a message that is put through a hashing algorithm.
     • The ‘hash’ number is encrypted using a private key
       • The message + hash are sent over the internet. The hash is decrypted by User B using his public key
         • The has number is compared with the message to see if the message has been altered.
           • Why use this:
             • • To prove that an electronic message is genuine, a sender can digitally sign the message.
               • • This means it can be detected if the message has been tampered with and the signature is proof that it has been sent by the correct person. Digital signatures use asymmetric encryption.
             • How the Process Works
               • Encrypt Message:A digest (also known as a hash) is produced from the message using a hash function. The digest is a much reduced version of the original message (it is not possible to change a message digest back into the original message from which it was created)
                 • Digest Encrypt Using Senders Private KeyThe digest is then encrypted using the sender’s private key. The sender’s private key must be used instead of the receiver’s public key to prove it has been encrypted by the sender. The encrypted digest result is the digital signature
                   • Encrypted Digest + MessageThe encrypted digest (digital signature) is then appended to the original message
                     • - Encrypt both using the receivers public key The message and digital signature are then encrypted using the receiver’s public key. The receiver’s public key must be used here so that only the receiver can decrypt the message with the private key.
                       • - The encrypted message is then sent by electronic mail.
               • Encryption
               • Decryption
                 • - Decrypt using Private Key The message and signature are decrypted using the receiver’s private key.
                   • separate filesThe decrypted message is then separated into the original message and digital signature.
                     • Decrypt Digital Signature The digital signature (encrypted digest) is then decrypted using the sender’s public key. This proves it has been sent by the person who owns the private key.
                       • A new digest is produced from the original message using the same hash function as the original digest
                         • The decrypted digest is then compared to the new digest. If the decrypted digest is the same as the new digest then the message has not been tampered with
                           • A digital certificate is issued by a certification authority
                             • It contains your name, a serial number, expiration dates, a copy of the certificate holder's public key (used for encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real
                               • Digital certificates can be kept in registries so that authenticating users can look up other users' public keys.
               • example
                 • Encryption
                   • Message is hashed to get a message digest
                     • The message digest is encrypted with A's private key, this then becomes the signature
                       • The signature is appended to the message
                         • The message is encrypted using B's public key
                           • The encrypted message is sent to B
                 • Decryption
                   • B decrypts the message with B's private key
                     • B decrypts the signature with A's public key to get the original message digest
                       • The decrypted message is hashed again, reproducing the message digest
                         • The message has not been tampered with if the decrypted message digest is the same as the reproduced digest

3. Some Questions

   • Julius makes sure that all data transmission to and from his website is secure. One way a user can check if his website uses secure data transmission is to check its certificate. Give two other ways that a user can identify if his website uses secure data transmission
     • Make sure the URL begins with HTTPS and that the padlock symbol is locked
   • Identify three other methods that could be used to keep the data secure
     • Any three from: − Password − Biometrics (device) − Encryption − Physical methods (e.g. locks) − Two-factor authentication // Two-step verification − Anti-viruses
   • Transport Layer Security (TLS) protocol is used to secure the transmission of data over the Internet. (a) Identify the two layers in the TLS protocol
     • - Handshake - Record
   • Identify one other protocol that can be used to secure data transmission over the Internet
     • SSL – Secure socket layers HTTPS
   • Tina will use the TLS protocol in her website when selling tickets to people for different charity events. This makes sure that their personal data is transmitted securely. (i) Identify the two layers that are present in the TLS protocol
     • Handshake layer Record Layer
   • Explain how data is sent securely using the TLS protocol
     • The client browser requests the server to identify itself, the server provides a digital certificate. The browser validates the digital certificate and sends a signal back to the server to begin transmission. Session caching can be used and a session key is generated. Encryption method is agreed and the data is encrypted.
   • Describe how the proxy server will help protect the website.
     • Any four from: − Acts as a firewall − Monitor/filters/examines incoming and outgoing traffic − Rules/criteria for traffic can be set // blacklist/whitelist set − Blocks any traffic that does not meet criteria … − … and can send a warning message to the user − Stop the website failing in a DoS attack // DoS attack hits the proxy server and not the webserver
   • Identify two biometric systems that would be suitable for securing a smartphone
     • Fingerprint scanning Voice recognition Facial recognition Retina recognition
   • Explain why modern smartphones are secured with a biometric system.acial recognition Retina recognition
     • It provides an extra level of security. Biometric devices require properties unique to the individual. It also allows quicker access as there is no need to input passwords so less passwords to remember.
   • Give three other methods that can be used to secure the data in the office
     • Firewalls - checks and validates data Passwords – provides protection for incoming and outgoing data Proxy Servers -acts as firewall between an organisation and the web where rules can be set in terms of what IP addresses to accept and rules in terms of what users can access Asymmetric encryption